joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2920
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x4f294d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x660650]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x4f2930
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4f29d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov ecx, 0x80
mov dword [ebp - 4], ebx
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x4f2a01
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6a1a00]
test eax, eax
je 0x4f2a0c
call eax
lea eax, [esi*8]
push eax
call fcn.004ef120
mov ecx, dword [0x6a1a04]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x4f2a2d
call ecx
test esi, esi
je 0x4f29f8
push dword [ebx + 0xc]
call fcn.004ef420
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x69754c]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.00572db0
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x4f2b10
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x4f2a9f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x660650]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x4f2a82
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x4f2aea
mov eax, dword [esi]
test eax, eax
je 0x4f2abd
mov edx, dword [esi + 4]
jmp 0x4f2abf
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x4f2aea
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4f2adf
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x4f2b06
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x4f2b06
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x4f2afc
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x4f2a76
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x4f2c84
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x4f2c74
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x660650]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x4f2c54
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x4f2c86
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.004f2b20
add esp, 8
test eax, eax
je 0x4f2ca0
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4f2cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x4f2d05
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x4f2cf5
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x660650]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x4f2cd5
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x4f2d0a
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.004f2b20
add esp, 8
test eax, eax
je 0x4f2d52
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4f2d42
push ebx
mov edx, eax
mov ecx, esi
call fcn.004f2bd0
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4f2df0
push 0x14
call fcn.004ef120
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f2d76
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x4f2db6
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x4f2db6
add edx, edx
mov ecx, esi
call fcn.004f29d0
test eax, eax
je 0x4f2db6
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004f2920
xor edx, edx
div dword [esi]
jmp 0x4f2db9
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4f2dd7
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.004f2960
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x4f2de6
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fa970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x694240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0x14], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x4fa9ba
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x4faa97
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x4fa9f3
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.005784f0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
test edi, edi
je 0x4faa95
mov ebx, dword [edi + 0x14]
cmp ebx, dword [esi + 0x18]
ja 0x4faa87
test byte [edi + 0x18], 0x20
jne 0x4faa87
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.005784f0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp ebx, 1
jne 0x4faa33
mov ecx, edi
call fcn.004f9c60
push dword [ebp - 0x14]
mov eax, dword [esi + 0x3c]
push dword [ebp - 0x18]
mov edx, dword [edi + 4]
push dword [esi + 0x80]
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0xc], edx
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 0x14], eax
cmp ebx, 1
jne 0x4faa69
mov eax, dword [ebp - 0xc]
movdqu xmm0, xmmword [eax + 0x18]
movdqu xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x4faa71
mov dword [esi + 0x20], ebx
inc dword [esi + 0xa8]
mov edx, ebx
push dword [edi + 4]
mov ecx, dword [esi + 0x58]
call fcn.00509b50
add esp, 4
mov ebx, dword [ebp - 0x14]
mov edi, dword [edi + 0xc]
test ebx, ebx
je 0x4fa9f3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005712ac
mov esp, ebp
pop ebp
ret
Function at 0x524e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov esi, ecx
mov dword [ebp - 0xc], esi
mov ebx, edx
push edi
test edx, edx
je 0x524ead
cmp byte [edx], al
je 0x524ea5
inc ebx
cmp byte [ebx], al
jne 0x524ea0
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 0x14], eax
jle 0x524f4f
mov ecx, edi
cmp edi, 2
jge 0x524ec7
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x524eca
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x524f1e
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x524f00
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x660650]
cmp cl, byte [edx + 0x660650]
jne 0x524f00
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x524ee3
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + 0x660650]
movzx eax, byte [eax + 0x660650]
sub eax, ecx
jne 0x524f3f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.004f2c30
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x524f4f
jmp 0x524f42
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x524eb8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x525070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x52509d
cmp byte [edx], al
je 0x525095
jmp 0x525090
inc ebx
cmp byte [ebx], al
jne 0x525090
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x525143
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x5250bd
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x52511b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x525100
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x660650]
cmp cl, byte [edx + 0x660650]
jne 0x5250fd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x5250e0
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x660650]
movzx ecx, byte [ecx + 0x660650]
sub eax, ecx
jne 0x525130
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.004f2c30
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x525143
jmp 0x525133
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
jl 0x5250b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x525470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], ebx
push edi
test esi, esi
je 0x525610
test ebx, ebx
je 0x52549d
cmp dword [ebx + 0x1f0], 0
jne 0x5254ac
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x525610
mov edi, dword [esi + 8]
mov dword [esp + 0x14], edi
test edi, edi
je 0x5255b2
jmp 0x5254c0
mov eax, dword [edi + 0x14]
mov dword [esp + 0x2c], eax
test ebx, ebx
je 0x5254d8
cmp dword [ebx + 0x1f0], 0
jne 0x525589
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x20], esi
test esi, esi
je 0x5254fe
cmp byte [esi], 0
je 0x5254f6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x5254f0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [edi + 0x18]
add eax, 0x18
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov edx, dword [eax]
mov dword [esp + 0x24], edx
test edx, edx
je 0x52555f
xor edi, edi
mov dword [esp + 0x1c], esi
mov ebx, ecx
test ecx, ecx
jle 0x525549
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x660650]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x525524
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov eax, edi
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x24]
mov eax, dword [esp + 0x10]
jmp 0x525561
xor edx, edx
push edx
mov dword [esp + 0x10], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.004f2b20
add esp, 8
test eax, eax
je 0x525589
push dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.004f2bd0
add esp, 4
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.004ef4c0
mov edx, edi
mov ecx, ebx
call fcn.004ef4c0
mov eax, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x5254c0
mov esi, dword [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.00530bf0
mov edx, esi
mov ecx, ebx
call fcn.005253f0
mov edx, dword [esi]
mov ecx, ebx
call fcn.004ef4c0
mov edx, dword [esi + 0x14]
mov ecx, ebx
call fcn.004ef4c0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x5255f0
mov edx, esi
mov ecx, ebx
call fcn.00539420
mov edx, esi
mov ecx, ebx
call fcn.004ef4c0
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esi + 0x18]
call fcn.0051d360
mov edx, esi
mov ecx, ebx
call fcn.00546d90
mov edx, esi
mov ecx, ebx
call fcn.004ef4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x527270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x694240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.004f0c90
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x5272e6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x5272e0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x527421
mov edi, ebx
cmp ebx, 2
jge 0x527311
xor edi, 1
test esi, esi
je 0x52736f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x52734d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x660650]
cmp cl, byte [edx + 0x660650]
jne 0x52734d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x527330
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x660650]
movzx ecx, byte [ecx + 0x660650]
sub eax, ecx
jne 0x5273e3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x5273bb
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x5273b0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x660650]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x527390
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x5273bd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.004f2b20
add esp, 8
test eax, eax
je 0x5273dc
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x527400
jmp 0x5273e6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x5273e6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x527307
test eax, eax
je 0x527421
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.00524dd0
add esp, 0x18
jmp 0x527424
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 3
jle 0x5272b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005712ac
mov esp, ebp
pop ebp
ret
Function at 0x559059
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x694240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x138]
xor ebx, ebx
mov dword [ebp - 0x150], 0xc
mov esi, ecx
mov dword [ebp - 0x14c], ebx
push pe_nt_image_headers32
push ebx
push eax
mov dword [esi], vtable.._AV1076_________________________________.0
mov dword [esi + 4], ebx
mov dword [ebp - 0x148], ebx
call fcn.00572db0
add esp, 0xc
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x55912e
cmp dword [ebp - 0x138], 6
mov ecx, str.D:_A__GA___WD__A__GA___AN_
mov eax, str.D:_A__GA___WD__A__GA___AN_S:_ML__NW___S_1_16_0_
cmovb eax, ecx
lea ecx, [ebp - 0x14c]
push ebx
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
dec eax
neg eax
sbb al, al
inc al
je 0x55912e
cmp dword [edi + 0x10], ebx
jne 0x5590fb
push ebx
jmp 0x559104
cmp dword [edi + 0x14], 8
jb 0x559103
mov edi, dword [edi]
push edi
push ebx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x55913a
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x140], str._776
jmp 0x559144
mov dword [ebp - 0x140], str._777
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x28]
call fcn.004775be
push 0x6910b4
lea eax, [ebp - 0x28]
push eax
call fcn.00572d44
int3

Function at 0x55a5fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x38
mov eax, 0x5abd07
call fcn.00576e00
mov eax, dword [ebp + 0x14]
and dword [ebp - 0x40], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push fcn.0055a5fa
push 6
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp dword [ebp - 0x3c], 0
jne 0x55a66a
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], str._754
push eax
lea ecx, [ebp - 0x34]
call fcn.004775be
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], vtable.._AV1080____________________________________________________________________.0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x34]
push 0x6915d8
push eax
call fcn.00572d44
cmp byte [ebp - 0x38], 0
movzx eax, si
push edi
cmovne esi, eax
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x55a6a1
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], str._755
push eax
lea ecx, [ebp - 0x34]
call fcn.004775be
mov dword [ebp - 4], 2
jmp 0x55a651
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp - 0x3c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push eax
mov ecx, ebx
call fcn.00478f3a
and dword [ebp - 4], 0
mov dword [ebp - 0x40], 1
mov eax, ebx
call fcn.00576daf
ret
Function at 0x56e660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5acaf0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0057139f
mov dword [esi], vtable.._AV808________________________.0
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.00479655
mov dword [esi], vtable.._AV792_______________.0
mov dword [esi + 0x2c], vtable.._AV803______________.0
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x56e6f2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.._AU1084______________________________________________________________.0
mov dword [esi + 0x2c], vtable.._AU1084______________________________________________________________.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x56e730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5acb18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.0057139f
mov dword [edi], vtable.._AV808________________________.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.00479655
mov dword [edi + 0x2c], vtable.._AV803______________.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.._AU1084______________________________________________________________.0
mov dword [edi + 0x2c], vtable.._AU1084______________________________________________________________.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4