joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c88bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5c895e
cmp dword [ebx + 0xac], 0
jne 0x5c8958
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c87fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c8958
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c891e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c8958
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.0049f5ec
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c892d
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c8ca0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x71bc9c]
cmp dword [eax + 0x190], 0
je 0x5c8e09
test bl, bl
jne 0x5c8d5c
cmp dword [esi + 0xb4], 0
jne 0x5c8d51
mov eax, esi
call fcn.005cbea4
push eax
push 0x5c8ba0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c8d22
mov eax, dword [0x71bc9c]
cmp byte [eax + 0xeb], 0
je 0x5c8d22
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c8d03
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c8d22
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c8d0b
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c8d51
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0049f5ec
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c8d31
inc dword [esi + 0xb4]
jmp 0x5c8e09
cmp dword [esi + 0xb4], 0
jle 0x5c8e09
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c8e09
cmp dword [esi + 0x58], 0
je 0x5c8dbe
mov eax, dword [0x71bc9c]
cmp byte [eax + 0xeb], 0
je 0x5c8dbe
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c8d9f
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c8dbe
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c8da7
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c8ded
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.0049f5ec
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c8dcd
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b90dc]
call fcn.0040d3a4
pop edi
pop esi
pop ebx
ret
Function at 0x5c9bc4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c9c21
cmp byte [ebx + 0xeb], 0
jne 0x5c9c21
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a374
mov eax, dword [esi]
test eax, eax
je 0x5c9c0e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c9c2e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a5cc
jmp 0x5c9c2e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a5cc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5cb72c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5cb79d
mov eax, esi
call fcn.0051e0f0
test al, al
je 0x5cb79d
mov eax, dword [ebx + 0x98]
call fcn.0051dc88
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5cb79d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5cb78e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051dc88
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00514298
jmp 0x5cb79d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005cb538
pop esi
pop ebx
ret
Function at 0x60c1d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 0xd], cl
mov esi, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x60c38e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x60c337
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, esi
test ebx, ebx
je 0x60c211
sub ebx, 4
mov ebx, dword [ebx]
test ebx, ebx
je 0x60c222
mov dl, 1
mov eax, esi
call fcn.00425d48
test al, al
jne 0x60c22f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x60c364
lea edx, [ebp - 4]
mov eax, esi
call fcn.0042e308
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x60c3a8
call fcn.0040b42c
test eax, eax
jle 0x60c26d
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00426540
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x60c266
sub eax, 4
mov eax, dword [eax]
test eax, eax
setg al
jmp 0x60c26f
xor eax, eax
test al, al
je 0x60c312
xor ebx, ebx
inc ebx
push dword [ebp - 4]
push 0x60c3b8
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00425074
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040b188
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00425d48
test al, al
jne 0x60c279
mov eax, dword [ebp - 8]
call fcn.0040ae9c
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x60c2f5
cmp byte [ebp - 0xd], 0
je 0x60c2df
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0060c028
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x609b54]
call fcn.00613f68
call fcn.004b11b8
jmp 0x60c32d
cmp byte [ebp - 0xd], 0
je 0x60c307
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0060be1c
jmp 0x60c32d
xor edx, edx
mov eax, esi
call fcn.00616520
jmp 0x60c32d
cmp byte [ebp - 0xd], 0
je 0x60c324
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0060be1c
jmp 0x60c32d
xor edx, edx
mov eax, esi
call fcn.00616520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x60c364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60c395
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040a23c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a23c
pop eax
jmp eax
Function at 0x615a08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x615b2a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x615adf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x615ad0
mov eax, ebx
call fcn.00407294
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x615ad5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x615b40
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x615ad5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
xor edx, edx
or eax, dword [ebp - 8]
or edx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp 0x615ad5
call fcn.00615b80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x615b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x615b31
cmp dword [ebp - 0xc], 0
je 0x615b27
mov eax, dword [ebp - 0xc]
call fcn.004072b0
pop eax
jmp eax

Function at 0x615c90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x615da7
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x615d57
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, ebx
call fcn.00425cb0
test al, al
je 0x615d4d
push 0x20
mov ecx, ebx
mov dl, 1
mov eax, dword [0x47cc6c]
call fcn.004a498c
mov dword [ebp - 8], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
lea edx, [ebp - 0x48]
mov ecx, 0x40
mov eax, dword [ebp - 8]
call fcn.004a43f8
cmp word [ebp - 0x48], 0x5a4d
jne 0x615d4d
cmp dword [ebp - 0xc], 0
je 0x615d4d
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004a3dd8
lea edx, [ebp - 0x140]
mov ecx, 0xf8
mov eax, dword [ebp - 8]
call fcn.004a43f8
cmp dword [ebp - 0x140], 0x4550
jne 0x615d4d
movzx eax, word [ebp - 0x13c]
mov dword [esi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x615d84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x615dae
cmp dword [ebp - 8], 0
je 0x615da4
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.00408510
pop eax
jmp eax
Function at 0x616934
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x61693d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x616aec
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
xor edx, edx
push ebp
push 0x616a95
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
je 0x616989
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x616982
sub eax, 4
mov eax, dword [eax]
test eax, eax
setg al
jmp 0x61698b
xor eax, eax
test al, al
je 0x6169a2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x61699b
sub eax, 4
mov eax, dword [eax]
test eax, eax
setg bl
jmp 0x6169a4
xor ebx, ebx
test bl, bl
je 0x616a8b
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00425d48
test al, al
je 0x616a8b
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.00425d48
test al, al
jne 0x6169dc
mov eax, dword [ebp - 0x10]
call fcn.00426740
test al, al
je 0x616a8b
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x616a6e
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0042e2c0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
pop ecx
call fcn.0040b100
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.0042e2c0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
pop ecx
call fcn.0040b100
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00425cb0
test al, al
je 0x616a6d
mov eax, dword [ebp - 8]
call fcn.0040ae9c
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x616a6d
inc dword [ebp - 0x18]
inc ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
cmp ebx, eax
jl 0x6169e8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0x18]
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x616ac2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x616af3
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.0040a23c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a23c
pop eax
jmp eax

Function at 0x652ac8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test ecx, ecx
jbe 0x652af9
dec ecx
test ecx, ecx
jb 0x652af9
inc ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, dword [eax]
and edi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x71c038]
mov edi, dword [eax]
shr edi, 8
xor esi, edi
mov dword [eax], esi
inc ebx
dec ecx
jne 0x652ad7
pop edi
pop esi
pop ebx
ret
Function at 0x654d38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x654e86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x711a80]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x654e5f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x711a8c], 0
jne 0x654e32
mov dword [0x711a8c], 0x104
mov eax, dword [0x711a88]
test eax, eax
je 0x654dae
cmp word [eax], 0
je 0x654dae
lea eax, [ebp - 4]
mov edx, dword [0x711a88]
call fcn.0040aefc
mov eax, dword [ebp - 4]
sub eax, 0xa
movzx esi, word [eax]
jmp 0x654db2
mov si, 2
movzx eax, si
imul dword [0x711a8c]
call fcn.00407294
mov dword [0x711a88], eax
mov eax, dword [0x711a88]
push eax
mov eax, dword [0x711a8c]
push eax
call sub.kernel32.dll_GetTempPathW
mov dword [0x711a8c], eax
mov eax, ebx
mov ecx, dword [0x711a8c]
mov edx, dword [0x711a88]
call fcn.0040a374
mov eax, dword [ebx]
call fcn.00654d1c
mov eax, dword [ebx]
call fcn.00655b54
test al, al
jne 0x654e45
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, 0x654d14
call fcn.004106d8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x41d180]
call fcn.0042ca4c
call fcn.004098d4
jmp 0x654e45
mov eax, ebx
mov ecx, dword [0x711a8c]
mov edx, dword [0x711a88]
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x654e66
mov eax, dword [0x711a80]
mov edx, dword [eax]
call dword [edx + 4]
pop eax
jmp eax
Function at 0x6557d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
seta byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x6558bc
mov eax, ebx
call fcn.00407294
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x6558b5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x65589d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x6558cc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x65589d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov dword [esi], edx
and eax, 0xffff
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6558bc
mov eax, dword [ebp - 0xc]
call fcn.004072b0
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x6558d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
mov edx, dword [0x714c24]
mov edx, dword [edx]
call fcn.0040a5cc
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x6559b1
mov eax, ebx
call fcn.00407294
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6559aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x655992
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x6559b8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655963
mov ecx, dword [ebp - 8]
dec ecx
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040a374
jmp 0x655992
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x655a00
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655992
mov eax, dword [ebp - 0x14]
test byte [eax + 0x1c], 1
je 0x655992
mov eax, edi
mov edx, 0x655a10
call fcn.0040a5cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6559b1
mov eax, dword [ebp - 4]
call fcn.004072b0
pop eax
jmp eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6589cc
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
xor edx, edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040b634
xor eax, eax
push ebp
push 0x658b88
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425cb0
test al, al
je 0x658a2a
mov eax, dword [ebp - 0x274]
call fcn.004261bc
lea edx, [ebp - 0x278]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x278]
mov edx, 0x658ba0
call fcn.0040b0a8
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.0042612c
test eax, eax
jne 0x658b35
xor eax, eax
push ebp
push 0x658b2e
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x260], 0x10
jne 0x658aaf
lea edx, [ebp - 0x27c]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x27c]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x27c]
call fcn.004261bc
jmp 0x658b00
mov eax, dword [ebp - 0x25c]
mov edx, 0x658bb4
call fcn.0040b298
je 0x658b00
mov eax, dword [ebp - 0x25c]
mov edx, 0x658bc4
call fcn.0040b298
je 0x658b00
lea edx, [ebp - 0x280]
mov eax, dword [ebp - 0x274]
call fcn.0042e2c0
lea eax, [ebp - 0x280]
mov edx, dword [ebp - 0x25c]
call fcn.0040b0a8
mov eax, dword [ebp - 0x280]
call fcn.006589cc
lea eax, [ebp - 0x270]
call fcn.0042617c
test eax, eax
je 0x658a77
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658b35
lea eax, [ebp - 0x270]
call fcn.004261a0
pop eax
jmp eax
mov dl, 1
mov eax, dword [ebp - 0x274]
call fcn.00425d48
test al, al
je 0x658b57
mov eax, dword [ebp - 0x274]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658b8f
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 0x270]
mov edx, dword [0x41cb60]
call fcn.0040ba20
pop eax
jmp eax
Function at 0x658c78
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x658dd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71863c]
call fcn.0040db1c
mov ebx, eax
push 0xa
push 0x658de4
push ebx
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
jne 0x658d24
mov eax, esi
call fcn.00658c10
mov eax, dword [esi]
test eax, eax
je 0x658cc7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
cmp ebx, 2
jl 0x658dab
lea eax, [ebp - 0x10]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004243ac
mov edx, dword [ebp - 0x14]
pop eax
call fcn.0040b298
jne 0x658d19
mov edx, esi
mov ecx, ebx
mov eax, 0x658e14
call fcn.0040b374
dec ebx
cmp ebx, 1
jne 0x658cd3
jmp 0x658dab
push edi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x658da6
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x658d9f
push edi
push ebx
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404cf0]
call fcn.0040d280
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.004077e0
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.004320cc
mov ecx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004315c0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x658d8e
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00431f74
jmp 0x658dab
call fcn.0042f4e8
jmp 0x658dab
call fcn.0042f4e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658ddd
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 4]
mov edx, dword [0x404cf0]
call fcn.0040d3a4
pop eax
jmp eax
Function at 0x65b8e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x65b9e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4799b4]
call fcn.004a3cdc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x65b9c2
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x65b99f
xor eax, eax
push ebp
push 0x65b998
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0xc]
jmp 0x65b979
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040aefc
mov edx, dword [ebp - 4]
mov eax, 0x65b9fc
call fcn.004bd710
mov ebx, eax
test bl, bl
jne 0x65b969
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, esi
call fcn.0040a700
mov edi, eax
inc edi
mov eax, edi
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x65b941
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b99f
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b9c9
mov eax, dword [ebp - 0x10]
call fcn.00408510
pop eax
jmp eax