joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4223f8]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, dword [esp + 0x220]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
mov dword [esp + 0x10], 0
push ecx
mov word [esp + 0x1c], ax
call fcn.004093e0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405ef2
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x41b794
push eax
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00404a70
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004090aa
add esp, 0x218
ret

Function at 0x406130
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4014
call fcn.00409330
mov eax, dword [0x4223f8]
xor eax, esp
mov dword [esp + 0x4010], eax
mov eax, dword [esp + 0x4028]
push ebx
mov ebx, dword [esp + 0x4024]
push ebp
mov ebp, dword [esp + 0x402c]
push esi
mov esi, dword [esp + 0x4024]
push edi
mov edi, dword [esp + 0x402c]
xor ecx, ecx
push 0x3ffe
push ecx
lea edx, [esp + 0x2a]
push edx
mov dword [esp + 0x1c], eax
mov word [esp + 0x2c], cx
call fcn.004093e0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [eax - 1]
cmp ecx, 0x3ffe
ja 0x406206
lea edx, [esp + 0x20]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x406206
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x41b790
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x406206
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
movzx edx, word [eax + 8]
mov word [ebx], dx
movzx ecx, word [eax + 0xe]
mov word [ebp], cx
movzx edx, word [eax + 0xc]
mov eax, dword [esp + 0x10]
mov word [eax], dx
mov eax, 1
jmp 0x406208
xor eax, eax
mov ecx, dword [esp + 0x4020]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004090aa
add esp, 0x4014
ret
Function at 0x4063a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x40c], 0
jne 0x406498
mov eax, dword [esi + 0x410]
push eax
call fcn.004074e0
add esp, 4
test eax, eax
je 0x4063d5
mov eax, dword [esi + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
mov eax, dword [esi]
test eax, eax
je 0x4063fa
push str.EngLib_Init
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x406401
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
xor eax, eax
pop esi
add esp, 0x14
ret
lea ecx, [esi + 8]
push ecx
mov dword [ecx], 0x404
call eax
test eax, eax
jne 0x40641f
mov ecx, esi
call fcn.004062e0
xor eax, eax
pop esi
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
push str.ProxyEnable
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp dword [esp + 4], 0
jne 0x40648e
lea ecx, [esp + 0x10]
push ecx
push 3
mov ecx, esi
mov dword [esp + 0x18], 1
call fcn.004062a0
lea edx, [esp + 0x14]
push edx
push 4
mov ecx, esi
mov dword [esp + 0x1c], 4
call fcn.00406270
mov dword [esi + 0x40c], 1
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x406520
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x41a3e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4223f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00405e50
add esp, 4
push 0x41c2b8
xor edi, edi
push 0x41c2b8
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea ecx, [esp + 0x14]
call fcn.004015a0
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4065b7
lea ecx, [esi - 0xc]
cmp ecx, dword [0x422024]
je 0x4065a3
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4065a3
push esi
call fcn.00408bab
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00406130
add esp, 0x14
test eax, eax
jne 0x4065f3
lea eax, [esi - 0xc]
cmp eax, dword [0x422024]
jmp 0x40658a
cmp word [esp + 0xc], 3
jb 0x40661c
cmp word [esp + 0x10], 2
jb 0x40661c
cmp word [esp + 0x14], 8
jb 0x40661c
mov ecx, 0x835
cmp word [esp + 0x18], cx
jb 0x40661c
mov edi, 1
lea edx, [esi - 0xc]
cmp edx, dword [0x422024]
je 0x40663e
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40663e
push esi
call fcn.00408bab
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x406660
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x41a418
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4223f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.00405e50
add esp, 4
push str._safemon360tray.exe
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x30], 0
call fcn.00404ae0
mov eax, dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
sete bl
cmp ecx, dword [0x422024]
je 0x4066ef
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4066ef
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00408bab
add esp, 4
test bl, bl
je 0x40672b
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x422024]
je 0x406715
lea esi, [eax - 0xc]
push esi
call ebp
test eax, eax
jg 0x406715
push esi
call fcn.00408bab
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x41c2e8
push 0x41c2e8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea ecx, [esp + 0x1c]
call fcn.004015a0
mov edi, dword [esp + 0x14]
push edi
call esi
test eax, eax
je 0x406760
call fcn.00406520
test eax, eax
je 0x406760
mov ebx, 1
jmp 0x406762
xor ebx, ebx
lea edx, [edi - 0xc]
cmp edx, dword [0x422024]
je 0x406780
lea esi, [edi - 0xc]
push esi
call ebp
test eax, eax
jg 0x406780
push esi
call fcn.00408bab
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x406e50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x107c
call fcn.00409330
mov eax, dword [0x4223f8]
xor eax, esp
mov dword [esp + 0x1078], eax
mov eax, dword [esp + 0x1080]
mov ecx, dword [esp + 0x1084]
push ebp
push esi
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 7
push 0x80000000
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406eb8
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x406ed1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1078]
xor ecx, esp
call fcn.004090aa
add esp, 0x107c
ret
push ebx
push edi
lea eax, [esp + 0x20]
push ebp
push eax
mov dword [esp + 0x18], ebp
call fcn.00407c40
add esp, 8
cmp dword [esp + 0x18], ebp
ja 0x406ef9
cmp dword [esp + 0x14], 0x200000
jbe 0x406fcb
cmp dword [esp + 0x1098], ebp
jne 0x406fcb
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
xor edi, edi
lea ebp, [edi + 1]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x1000
lea edx, [esp + 0x94]
push edx
push esi
call ebx
test eax, eax
je 0x406fc7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406fc7
push eax
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00407c90
add edi, dword [esp + 0x1c]
add esp, 0xc
cmp edi, 0x100000
jb 0x406f11
push 2
push 0
push 0xfff00000
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40702f
xor edi, edi
lea esp, [esp]
push 0
lea edx, [esp + 0x14]
push edx
push 0x1000
lea eax, [esp + 0x94]
push eax
push esi
call ebx
test eax, eax
je 0x406fc7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406fc7
push eax
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00407c90
add edi, dword [esp + 0x1c]
add esp, 0xc
cmp edi, 0x100000
jb 0x406f80
jmp 0x40702f
xor ebp, ebp
jmp 0x40702f
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push ecx
push esi
call edi
test eax, eax
je 0x40702f
jmp 0x406ff0
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40702a
push eax
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00407c90
add esp, 0xc
push ebp
lea ecx, [esp + 0x14]
push ecx
push 0x1000
lea edx, [esp + 0x94]
push edx
push esi
call edi
test eax, eax
jne 0x406ff0
jmp 0x40702f
mov ebp, 1
lea eax, [esp + 0x20]
push eax
call fcn.00407db0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
test ebp, ebp
je 0x406eb8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [eax], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x7c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x1080]
pop esi
pop ebp
mov dword [eax + 0xc], edx
xor ecx, esp
mov eax, 1
call fcn.004090aa
add esp, 0x107c
ret
Function at 0x407280
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x41a591
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4223f8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov eax, dword [0x4223f8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20], 0
call fcn.004071f0
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x40], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407310
mov eax, dword [esp + 0x10]
lea edx, [eax - 0xc]
cmp edx, dword [0x422024]
je 0x407309
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x407309
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00408bab
add esp, 4
xor eax, eax
jmp 0x407482
mov edx, dword [esp + 0x10]
xor eax, eax
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.00406e50
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.00407130
mov eax, dword [eax]
push str.dfa18e9b38fb73f25cc53efa61d6221e
mov ebx, 1
push eax
mov byte [esp + 0x44], 1
mov dword [esp + 0x24], ebx
call fcn.00409a66
add esp, 8
test eax, eax
je 0x407391
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x24]
call fcn.00407130
mov eax, dword [eax]
push str.ca73029d32f827974a79dd4cf593aa5f
push eax
mov ebx, 3
call fcn.00409a66
add esp, 8
mov byte [esp + 0xf], 1
test eax, eax
jne 0x407396
mov byte [esp + 0xf], 0
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test bl, 2
je 0x4073cd
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
and ebx, 0xfffffffd
cmp edx, dword [0x422024]
je 0x4073cd
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4073cd
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00408bab
add esp, 4
mov dword [esp + 0x3c], 0
test bl, 1
je 0x407403
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x422024]
je 0x407403
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x407403
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00408bab
add esp, 4
cmp byte [esp + 0xf], 0
mov eax, dword [esp + 0x10]
je 0x40743f
lea ecx, [eax - 0xc]
cmp ecx, dword [0x422024]
je 0x407309
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x407309
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00408bab
add esp, 4
xor eax, eax
jmp 0x407482
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x407457
lea ecx, [esp + 0x10]
call fcn.00401440
xor eax, eax
jmp 0x407482
push str.CreateInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40744a
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x4240d0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.00401440
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004090aa
add esp, 0x34
ret
Function at 0x40819b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x424158], 0
push esi
jne 0x40810e
call fcn.00408034
test eax, eax
je 0x408151
mov eax, dword [0x424158]
cmp eax, 1
jne 0x40812f
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x408151
pop esi
ret
push eax
call dword [0x424160]
test eax, eax
jne 0x408199
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x408155
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x424158]
call dword [0x424160]
mov edi, eax
test edi, edi
je 0x40817a
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408196
mov edi, esi
add esi, 0xff0
push edi
push dword [0x424158]
call dword [0x42415c]
add edi, 0x10
cmp edi, esi
jb 0x408182
mov eax, edi
pop edi
pop esi
ret
jmp 0x4080fb

Function at 0x4090aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4223f8]
jne 0x4090b4
repz ret
jmp fcn.0040e83c

Function at 0x4103ed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b130
and dword [ebp - 4], 0
cmp dword [0x424c20], 0
mov ebx, eax
jne 0x41049e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41054f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41054f
push eax
call fcn.0040b0be
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x424c20], eax
call esi
push eax
call fcn.0040b0be
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x424c24], eax
call esi
push eax
call fcn.0040b0be
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x424c28], eax
call esi
push eax
call fcn.0040b0be
pop ecx
mov dword [0x424c30], eax
test eax, eax
je 0x41049e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b0be
pop ecx
mov dword [0x424c2c], eax
mov eax, dword [0x424c2c]
cmp eax, ebx
je 0x4104f6
cmp dword [0x424c30], ebx
je 0x4104f6
push eax
call fcn.0040b139
push dword [0x424c30]
mov esi, eax
call fcn.0040b139
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4104f6
test edi, edi
je 0x4104f6
call esi
test eax, eax
je 0x4104ed
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4104ed
test byte [ebp - 0xc], 1
jne 0x4104f6
or dword [ebp + 0x10], 0x200000
jmp 0x41052f
mov eax, dword [0x424c24]
cmp eax, ebx
je 0x41052f
push eax
call fcn.0040b139
pop ecx
test eax, eax
je 0x41052f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41052f
mov eax, dword [0x424c28]
cmp eax, ebx
je 0x41052f
push eax
call fcn.0040b139
pop ecx
test eax, eax
je 0x41052f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424c20]
call fcn.0040b139
pop ecx
test eax, eax
je 0x41054f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410551
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414350
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x41a67b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4223f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.004093e0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x18], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x4143eb
push 0x420428
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.00408528
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x550339
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
test eax, 0x80000000
je 0x550356
mov edx, eax
and edx, 0x7fffffff
mov dword [ebp - 0xc], edx
jmp 0x55035b
xor edx, edx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x3c]
push edi
mov esi, dword [eax + ebx + 0x78]
lea eax, [eax + ebx + 0x18]
add esi, ebx
mov eax, dword [eax + 0x64]
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24]
add edi, ebx
add ecx, ebx
add eax, ebx
test edx, edx
mov dword [ebp - 0x10], eax
je 0x55039b
mov eax, dword [esi + 0x10]
imul eax, eax, 0x3fffffff
add eax, edx
jmp 0x5503d9
and dword [ebp + 8], 0
cmp dword [esi + 0x18], 0
jbe 0x5503e1
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, ebx
push eax
call fcn.00550407
pop ecx
test eax, eax
pop ecx
jne 0x5503cf
inc dword [ebp + 8]
add dword [ebp - 8], 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x5503a8
jmp 0x5503e1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], 0
je 0x5503ff
cmp dword [ebp - 4], esi
jbe 0x5503ff
mov eax, dword [ebp - 0x14]
add eax, esi
cmp dword [ebp - 4], eax
jae 0x5503ff
push dword [ebp - 0xc]
push ebx
call dword [ebp + 0x10]
jmp 0x550402
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x550431
Capabilities:
Encode data using xor

Disassembly:
push ecx
push eax
push esi
push edi
mov ecx, edi
sub ecx, eax
mov esi, eax
mov edi, esi
lodsb al, byte [esi]
xor al, 0x4c
stosb byte es:[edi], al
loop 0x55043d
pop edi
pop esi
pop eax
pop ecx
ret

Function at 0x550448
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x496990
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x4969aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4969b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4969a0
mov eax, 1
add ebx, ebx
jne 0x4969c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4969d4
jne 0x4969f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4969f3
dec eax
add ebx, ebx
jne 0x4969e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4969b8
add ebx, ebx
jne 0x4969ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x496a45
xor ecx, ecx
sub eax, 3
jb 0x496a0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x496a7a
sar eax, 1
mov ebp, eax
jmp 0x496a16
add ebx, ebx
jne 0x496a16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4969e4
inc ecx
add ebx, ebx
jne 0x496a24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4969e4
add ebx, ebx
jne 0x496a31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x496a26
jne 0x496a42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x496a26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x496a64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x496a56
jmp 0x4969a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x496a64
add edi, ecx
jmp 0x4969a6
pop esi
mov edi, esi
mov ecx, 0x318d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x496a82
cmp byte [edi], 0x1a
jne 0x496a82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x496a87
lea edi, [esi + 0x93000]
mov eax, dword [edi]
or eax, eax
je 0x496aff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9914c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x99264]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x496ab4
mov ecx, edi
jns 0x496ae3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x99268]
or eax, eax
je 0x496af9
mov dword [ebx], eax
add ebx, 4
jmp 0x496ad1
call dword [esi + 0x99278]
mov ebp, dword [esi + 0x9926c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x496b33
sub esp, 0xffffff80
jmp 0x453e3d
Function at 0x402350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402367
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402398
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402394
cmp esi, eax
jae 0x402398
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x402384
cmp esi, eax
jb 0x40239e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret