joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414b80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
jmp 0x414b9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414ba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b90
mov eax, 1
add ebx, ebx
jne 0x414bb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414ba8
jne 0x414bc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ba8
xor ecx, ecx
sub eax, 3
jb 0x414bd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c4a
mov ebp, eax
add ebx, ebx
jne 0x414be3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c14
inc ecx
add ebx, ebx
jne 0x414c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bf5
jne 0x414c11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bf5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c25
jmp 0x414b96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c34
add edi, ecx
jmp 0x414b96
pop esi
mov edi, esi
mov ecx, 0xce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c52
cmp byte [edi], 6
jne 0x414c52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c57
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cc6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x168dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16918]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c84
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1691c]
or eax, eax
je 0x414cc0
mov dword [ebx], eax
add ebx, 4
jmp 0x414ca1
call dword [esi + 0x1692c]
mov ebp, dword [esi + 0x16920]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cfa
sub esp, 0xffffff80
jmp 0x403861
Function at 0x4054c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4054c0
push esi
mov esi, ecx
call fcn.004021d0
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4054f4
push esi
push 0x4046a0
mov ecx, esi
call fcn.004021f0
push eax
push 0x6d
mov ecx, esi
call fcn.004021d0
push eax
call fcn.00402a10
mov dword [esi + 0x24], eax
pop esi
ret
push eax
call dword [0x407244]
mov ecx, esi
pop esi
jmp fcn.00404a00
Function at 0x401300
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x449ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp]
push esi
push eax
call fcn.00421110
lea ecx, [esp + 4]
push str.modules360Inst.exe
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x1c], 0
call fcn.004018f0
mov eax, dword [esp + 0x18]
mov byte [esp + 0x10], 1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40145f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004014d0
add esp, 4
test eax, eax
jne 0x4013d8
mov esi, dword [esp + 0x18]
push 1
call fcn.00435ba0
push eax
push esi
call fcn.00435e30
mov eax, dword [esp + 0x24]
mov ecx, dword [0x455054]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0xc
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4013b0
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4013b0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.0042ac06
add esp, 4
mov eax, dword [esp + 4]
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4014bb
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4014bb
jmp 0x4014ab
mov eax, dword [esp + 0x18]
push 5
push str._S__URL:http:__pinst.360.cn_zhuomian_desktopsafe.cab
push eax
push 0
call fcn.00401a90
mov eax, dword [esp + 0x28]
mov edx, dword [0x455054]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0x10
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40141f
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40141f
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, dword [esp + 4]
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40144a
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40144a
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov edx, dword [0x455054]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x401490
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x401490
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, dword [esp + 4]
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4014bb
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4014bb
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401c40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d538
push 0x436528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
cmp esi, edi
je 0x401d64
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], edi
push edi
push edi
push 3
push edi
push 3
push 0x80
push str..360SelfProtection
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x34], edi
cmp edi, 0xffffffff
jne 0x401cb0
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x401ce9
push 0
lea eax, [ebp - 0x38]
push eax
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
lea edx, [ebp - 0x3c]
push edx
push 0x22204c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
mov dword [ebp - 0x2c], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, dword [ebp - 0x30]
mov eax, esi
mov dword [ebp - 0x40], eax
mov esi, dword [ebp + 8]
test eax, eax
jne 0x401d2e
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x401d2e
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401d2e
push ebx
call fcn.00435f50
add esp, 4
test eax, eax
je 0x401d2e
push ebx
call fcn.004014d0
add esp, 4
test eax, eax
jne 0x401d2e
push 1
call fcn.00435ba0
push eax
push ebx
call fcn.00435e30
add esp, 0xc
xor eax, eax
jmp 0x401d33
mov eax, 1
mov dword [ebp - 0x48], eax
test eax, eax
je 0x401d64
push esi
call fcn.00436080
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402cc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push edi
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x402d05
mov eax, dword [esp + 8]
test eax, eax
jne 0x402d05
mov eax, 1
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret
Function at 0x404d70
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry value

Disassembly:
sub esp, 0x81c
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push ebp
push esi
push edi
mov dword [esp + 0x1c], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se.exe
mov dword [esp + 0x20], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
mov dword [esp + 0x24], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_5.exe
mov dword [esp + 0x28], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
mov dword [esp + 0x10], 0
lea esi, [esp + 0x1c]
mov ebp, 1
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x2c]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x2c]
push eax
mov eax, dword [esi]
push ecx
push edx
push 0x45b334
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 0x400
call ebx
test eax, eax
jne 0x404e38
cmp dword [esp + 0x14], ebp
jne 0x404e38
cmp word [esp + 0x2c], 0
je 0x404e38
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x404e38
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404e38
lea edx, [esp + 0x2c]
push edx
call fcn.004014d0
add esp, 4
test eax, eax
jne 0x404e87
mov eax, dword [esp + 0x10]
add esi, 4
inc eax
cmp eax, 4
mov dword [esp + 0x10], eax
jb 0x404db1
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360se6
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404e94
mov ecx, dword [esp + 0x10]
mov esi, ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x81c
ret
Function at 0x404eb0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x449d50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp]
push esi
push eax
call fcn.00421110
lea ecx, [esp + 4]
push str.modules360Inst.exe
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x1c], 0
call fcn.004018f0
mov eax, dword [esp + 0x18]
mov byte [esp + 0x10], 1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40500f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004014d0
add esp, 4
test eax, eax
jne 0x404f88
mov esi, dword [esp + 0x18]
push 1
call fcn.00435ba0
push eax
push esi
call fcn.00435e30
mov eax, dword [esp + 0x24]
mov ecx, dword [0x455054]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0xc
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x404f60
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x404f60
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.0042ac06
add esp, 4
mov eax, dword [esp + 4]
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40506b
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40506b
jmp 0x40505b
mov eax, dword [esp + 0x18]
push 5
push str._S__URL:http:__pinst.360.cn_360se_wssj_setup.cab
push eax
push 0
call fcn.00401a90
mov eax, dword [esp + 0x28]
mov edx, dword [0x455054]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0x10
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x404fcf
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x404fcf
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, dword [esp + 4]
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x404ffa
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x404ffa
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov edx, dword [0x455054]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x405040
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x405040
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, dword [esp + 4]
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40506b
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x40506b
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405080
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x449d81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x455050]
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [ebx + 4], eax
mov ecx, dword [0x455050]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx + 8], ecx
mov edx, dword [0x455050]
mov dword [ebx + 0xc], edx
mov byte [esp + 0x1c], 2
mov dword [ebx], 0x44d57c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, edi
jne 0x4050db
xor ebp, ebp
jmp 0x4050e4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
mov eax, dword [ebx + 0xc]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, 1
jg 0x4050f7
cmp ebp, dword [eax - 4]
jle 0x40515e
mov edx, dword [0x455054]
add eax, 0xfffffff4
cmp eax, edx
je 0x405127
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40511e
mov eax, dword [ebx + 0xc]
sub eax, 0xc
push eax
call fcn.0042ac06
add esp, 4
mov ecx, dword [0x455050]
mov dword [ebx + 0xc], ecx
cmp ebp, edi
jne 0x405136
mov edx, dword [0x455050]
mov dword [ebx + 0xc], edx
jmp 0x40515e
lea eax, [ebp + ebp + 0xe]
push eax
call fcn.0043649a
add esp, 4
cmp eax, edi
je 0x40518c
mov dword [eax], 1
mov word [eax + ebp*2 + 0xc], di
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
add eax, 0xc
mov dword [ebx + 0xc], eax
lea eax, [ebp + ebp]
lea ecx, [ebp + ebp + 2]
cmp ecx, eax
jb 0x40517d
mov edi, dword [ebx + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0xc]
mov dword [ecx - 8], ebp
mov edx, dword [ebx + 0xc]
mov word [edx + eax], 0
mov ecx, ebx
call fcn.00405260
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x405b40
Capabilities:
Get disk size

Disassembly:
sub esp, 0x224
push ebx
mov ebx, dword [esp + 0x22c]
push esi
xor esi, esi
cmp ebx, esi
je 0x405bce
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], si
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x2c]
push esi
push eax
push ebx
call fcn.0043770c
add esp, 0x14
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
push ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
pop edi
je 0x405bce
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, 1
pop ebx
add esp, 0x224
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x224
ret
Function at 0x406a60
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
lea eax, [esp]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x406a7e
test byte [esp], 7
mov eax, 1
jne 0x406a83
call fcn.004069d0
pop ecx
ret

Function at 0x406a90
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x449e5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80c
push ebx
push ebp
push esi
push edi
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
lea esi, [esp + 0x1c]
cmp word [esp + 0x1c], bx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
je 0x406b8f
mov edi, dword [esp + 0x830]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [0x455050]
mov dword [esp + 0x10], ecx
xor edx, edx
lea eax, [esp + 0x10]
mov dx, word [esi]
mov dword [esp + 0x824], ebx
push edx
push 0x45583c
push eax
call fcn.004074e0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.00405b40
mov eax, dword [esp + 0x2c]
add esp, 0x14
cmp eax, edi
jg 0x406bab
jl 0x406b43
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x82c]
cmp ecx, eax
ja 0x406bab
push esi
call fcn.00437625
mov ecx, dword [0x455054]
lea esi, [esi + eax*2 + 2]
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x824], 0xffffffff
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x406b86
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x406b86
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0042ac06
add esp, 4
cmp word [esi], bx
jne 0x406af2
xor ax, ax
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x818
ret
mov eax, dword [esp + 0x10]
mov edx, dword [0x455054]
mov si, word [esi]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x406bd9
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x406bd9
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov ax, si
jmp 0x406b92
Function at 0x406be0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x614
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x218]
push 0x20
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x455050]
lea eax, [esp + 0xc]
test eax, eax
mov dword [esp + 8], edx
je 0x406d2d
lea ecx, [esp + 0xc]
shr ecx, 0x10
jne 0x406ced
xor edi, edi
lea edx, [esp + 0xc]
lea eax, [esp + 0x41c]
mov di, dx
push pe_nt_image_headers32
push eax
push edi
call fcn.00404ba0
mov ecx, pe_nt_image_headers32
sub ecx, eax
cmp ecx, 1
jle 0x406ca1
lea edx, [esp + 0x41c]
lea ecx, [esp + 8]
push edx
call fcn.00403e20
jmp 0x406d2d
push 0x1ff
lea ecx, [esp + 0xc]
mov esi, 0x200
call fcn.004048a0
test eax, eax
je 0x406ce0
push esi
push eax
push edi
call fcn.00404ba0
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x406ce0
add esi, 0x100
lea ecx, [esp + 8]
lea edx, [esi - 1]
push edx
call fcn.004048a0
test eax, eax
jne 0x406cb8
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00404960
jmp 0x406d2d
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x406d2d
push esi
lea ecx, [esp + 0xc]
call fcn.00401820
test eax, eax
je 0x406d2d
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
cmp edx, ecx
jb 0x406d2d
mov edi, dword [esp + 8]
mov eax, ecx
lea esi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jl 0x406d55
lea ecx, [esp + 0x214]
push ecx
push eax
call fcn.0043679e
add esp, 8
test eax, eax
je 0x406d55
sub eax, dword [esp + 8]
sar eax, 1
jmp 0x406d58
or eax, 0xffffffff
xor edx, edx
test eax, eax
mov eax, dword [esp + 8]
setge dl
mov esi, edx
mov edx, dword [0x455054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x406d90
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x406d90
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0042ac06
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x614
ret
Function at 0x4076f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x449f20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x18], ebx
or eax, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov byte [esi + 0x94], bl
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
lea edi, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.0041c880
mov dword [esi], 0x44d608
mov dword [edi], 0x44d5fc
mov dword [esi + 0x58], 0x44d5d4
lea eax, [esi + 0x98]
mov dword [esp + 0x18], 2
cmp eax, ebx
je 0x407782
lea ebx, [eax - 0x98]
push eax
lea ecx, [ebx + 8]
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 3
call fcn.0041ed50
lea ecx, [esi + 0x110]
mov byte [esp + 0x18], 4
call fcn.0041ed50
lea ecx, [esi + 0x180]
mov byte [esp + 0x18], 5
call fcn.0041ed50
lea ecx, [esi + 0x1f0]
mov byte [esp + 0x18], 6
call fcn.0041cd40
lea ecx, [esi + 0x2a4]
mov byte [esp + 0x18], 7
call fcn.0041cd40
lea ecx, [esi + 0x358]
mov byte [esp + 0x18], 8
call fcn.0041cd40
lea ecx, [esi + 0x40c]
mov byte [esp + 0x18], 9
call fcn.0041cd40
mov eax, dword [0x455050]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x4c0], eax
mov dword [edi], 0x44d5c8
mov dword [esi], 0x44d5bc
mov dword [esi + 0x58], 0x44d594
mov dword [esi + 0x74], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret