joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10172010
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.1018f810
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
inc ebx
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 8]
mov ecx, dword [edi + 4]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x101720dc
mov edx, dword [esp + 0x20]
lea eax, [ebx + edx]
cmp eax, ecx
ja 0x101720e4
add dword [edi + 0xc], edx
add dword [edi + 0x10], edx
sub ecx, edx
mov dword [edi + 4], ecx
test dword [esi + 0x100], 0x200
mov eax, dword [edi + 0xc]
movzx ebx, byte [eax + ecx - 1]
je 0x101720aa
cmp dword [esi + 0x88], 0
jne 0x101720aa
mov eax, dword [esi + 0x58]
push 8
add eax, 8
push 0x10246164
push eax
call fcn.100cdb60
add esp, 0xc
test eax, eax
jne 0x1017209d
test bl, 1
jne 0x1017209d
mov eax, dword [esi + 0x58]
or dword [eax], 8
mov eax, dword [esi + 0x58]
test byte [eax], 8
je 0x101720aa
test ebx, ebx
je 0x101720aa
dec ebx
mov eax, dword [esi + 0x80]
push ebp
push dword [eax]
call fcn.100d1bf0
mov ebp, dword [edi + 4]
add esp, 4
mov dword [esp + 0x14], ebp
and eax, 0x200000
je 0x101720ed
sub ebp, ebx
mov eax, 1
dec ebp
mov dword [edi + 4], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp ebx, ecx
jbe 0x1017205b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x28]
mov edx, ebp
add ecx, ebx
mov eax, ebp
sub edx, ecx
xor eax, ecx
xor edx, ecx
mov ecx, 0xff
or edx, eax
lea eax, [ebp - 1]
xor edx, ebp
shr edx, 0x1f
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
xor esi, esi
test ecx, ecx
je 0x10172173
mov eax, ebx
shr eax, 0x1f
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
lea edi, [ebp - 1]
add edi, eax
mov ebp, ecx
nop
mov al, byte [esp + 0x28]
lea edi, [edi - 1]
mov edx, ebx
mov ecx, esi
sub edx, esi
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc esi
or dl, al
movzx eax, byte [edi + 1]
xor dl, byte [esp + 0x28]
xor eax, ebx
dec dl
movzx ecx, dl
mov edx, dword [esp + 0x1c]
and ecx, eax
not ecx
and edx, ecx
mov dword [esp + 0x1c], edx
cmp esi, ebp
jb 0x10172130
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
not edx
lea eax, [ebx + 1]
movzx ecx, dl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub ebp, eax
shl eax, 8
or dword [edi], eax
mov eax, ecx
mov dword [edi + 4], ebp
and eax, 1
pop ebp
pop edi
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x1018788b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x101878b9
cmp eax, edi
jge 0x101878ad
push esi
call fcn.10184916
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x101878dc
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x101878c2
mov dword [esi + 8], edx
jmp 0x101878f1
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x101878e7
xor dl, dl
jmp 0x101878ec
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x101878dc
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x1018792a
mov dword [0x1029db08], str.zlib_corrupt
xor eax, eax
jmp 0x1018796c
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x1018793f
mov dword [0x1029db08], str.read_past_buffer
jmp 0x10187926
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x10187956
push edi
push esi
call fcn.10189d6f
pop ecx
pop ecx
test eax, eax
je 0x10187926
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.101a6860
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x10190e0e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x101c7219
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101c708f

Function at 0x101cd430
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101ccf83
Function at 0x101d5f00
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x18
call fcn.1018f810
mov eax, dword [0x1028dc74]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x24]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov dword [esp + 0x10], 1
mov edi, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
xor esi, esi
nop
movsx edx, byte [edi]
lea edi, [edi + 1]
lea eax, [edx - 0x30]
cmp eax, 9
ja 0x101d5fc7
mov eax, dword [esp + ecx*4 + 0x14]
mov esi, 1
lea eax, [eax + eax*4]
lea eax, [eax - 0x18]
lea eax, [edx + eax*2]
mov dword [esp + ecx*4 + 0x14], eax
cmp eax, 0xff
jbe 0x101d5f40
xor esi, esi
call fcn.101d63d0
cmp eax, 1
jne 0x101d60bc
test esi, esi
jne 0x101d60d1
push 0xa1
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.100cd9d0
add esp, 0x10
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
jne 0x101d6038
push 0xa7
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.100c4710
add esp, 0x14
jmp 0x101d608f
cmp edx, 0x2e
jne 0x101d5ff8
test esi, esi
je 0x101d5fdb
cmp ecx, 3
je 0x101d5f6b
inc ecx
jmp 0x101d5f3d
push 0x88
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.100c4710
add esp, 0x14
jmp 0x101d60ac
test edx, edx
jne 0x101d5f6b
cmp ecx, 3
jne 0x101d5f6b
test esi, esi
je 0x101d5f6b
movzx eax, byte [esp + 0x14]
lea esi, [edx + 1]
mov byte [ebx], al
movzx eax, byte [esp + 0x18]
mov byte [ebx + 1], al
movzx eax, byte [esp + 0x1c]
mov byte [ebx + 2], al
movzx eax, byte [esp + 0x20]
mov byte [ebx + 3], al
jmp 0x101d5f6d
cmp word [ecx + 8], 2
je 0x101d6059
push 0xae
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.100c4710
add esp, 0x14
jmp 0x101d608f
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x10], 0
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [ebx], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
mov byte [ebx + 1], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
mov byte [ebx + 2], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
mov byte [ebx + 3], al
push 0xb7
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.100cd9d0
add esp, 0x10
cmp dword [esp + 0x10], 0
je 0x101d60d1
push ebp
push str.host
push 2
call fcn.100c3ad0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1018ea37
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1018ea37
add esp, 0x18
ret

Function at 0x101d6450
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x101d6490
push 0x248
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.100c4710
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x101d7438
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.101e2fd2
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x101d7465
xor eax, eax
jmp 0x101d7561
mov eax, dword [ebp - 4]
mov ecx, accept
push 0x40
push 0x101a8a6e
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.101d84be
push esi
push eax
call fcn.101a8a80
add esp, 0x14
test eax, eax
je 0x101d74a0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.101e3179
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.101d84a0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.101d9bba
add esp, 0x28
test eax, eax
jne 0x101d74d7
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x101d7518
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.101e314a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x101d7513
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x101d7548
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.101e309f
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.101e3059
add esp, 0x14
jmp 0x101d745e
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.101e2f21
push dword [ebp - 4]
call fcn.101d7607
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x101d9969
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x101d999f
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x101d9992
push eax
call fcn.101e3045
push 2
call fcn.101e2fbe
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.101a8300
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x101dade7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.101e2fd2
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x101dae14
xor eax, eax
jmp 0x101dafb8
mov eax, dword [ebp - 4]
mov ecx, accept
push 0x40
push 0x101a8a6e
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.101d84be
push esi
push eax
call fcn.101a8a80
add esp, 0x14
test eax, eax
je 0x101dae61
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.101e3179
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.101d84a0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.101d9bba
add esp, 0x28
test eax, eax
jne 0x101dae98
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x101daed4
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.101e314a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x101daed4
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x101d9cb9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.101d9d08
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x101daf54
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.101eabe5
add esp, 0xc
cmp eax, 0xfffffffa
je 0x101daf3d
cmp eax, 0xfffffffc
je 0x101daf36
cmp eax, 0xfffffffe
je 0x101daf2f
test eax, eax
je 0x101daf4f
push str.Unknown_zlib_error
jmp 0x101daf42
push str.zlib_stream_error
jmp 0x101daf42
push str.zlib_memory_error
jmp 0x101daf42
push str.zlib_version_error
push dword [ebp - 4]
call fcn.101d84da
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x101daf84
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.101e309f
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.101e3059
add esp, 0x14
jmp 0x101dae0d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.101dff8d
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x101eadbf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x101eadcc
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.101eadd2

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x10840058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.108401a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1084007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084006a
add dl, dl
jne 0x10840089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108400dc
xor eax, eax
add dl, dl
jne 0x10840096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084017d
add dl, dl
jne 0x108400a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108400d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10840075
mov eax, 1
add dl, dl
jne 0x108400ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108400e1
sub eax, ebx
mov ebx, 1
jne 0x10840128
mov ecx, 1
add dl, dl
jne 0x1084010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10840119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10840105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10840075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1084013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1084014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10840136
cmp eax, 0x7d00
jae 0x1084016d
cmp eax, 0x500
jb 0x10840168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10840075
cmp eax, 0x7f
ja 0x10840170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10840075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1084019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10840075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x24ab2101
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e060
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5f9a2fba
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x8c2129
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x8c1ea3
or ecx, esi
add ecx, 0x421edf1f
mov esi, 0xa9e27031
call fcn.008c216a
inc esi
xor dword [eax], ebx
sub esi, 0x2234ba4b
and esi, ecx
inc eax
add esi, 0xc0d1d687
sub esi, ecx
sub ecx, 0x2678de73
cmp eax, edi
jne fcn.008c2129
sub esi, ecx
mov ecx, esi
ret
Function at 0x4080f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.004fa040
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.0053efc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.PCStore.exe
push dword [esi]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call esi
push 0x800
lea eax, [ebp - 0xa0c]
push 0
push eax
call fcn.0053efc0
add esp, 0xc
lea eax, [ebp - 0xa0c]
push 1
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x120c]
push 0
push eax
call fcn.0053efc0
add esp, 0xc
lea eax, [ebp - 0xa0c]
push 0x57fa78
push eax
lea eax, [ebp - 0x120c]
push eax
call esi
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x120c]
push eax
push str.__fromdesktop
lea eax, [ebp - 0x20c]
push eax
push 0x57fac4
call fcn.004081d0
mov ecx, dword [ebp - 4]
add esp, 0x1c
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.004fa004
mov esp, ebp
pop ebp
ret
Function at 0x4085b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004fa040
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
xor esi, esi
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0053efc0
add esp, 0xc
lea eax, [ebp - 0x804]
push 1
push 0x19
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0053efc0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x57fa78
push eax
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 1
cmovne esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fa004
mov esp, ebp
pop ebp
ret

Function at 0x408b30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004fa040
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.0053efc0
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x408c26
test edi, edi
je 0x408c26
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x408c26
cmp eax, 0x3fff
ja 0x408c26
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x408c26
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x57fb14
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x408c26
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.0053efc0
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x57fb18
lea eax, [esi - 1]
push eax
push edi
call fcn.00408db0
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004fa004
mov esp, ebp
pop ebp
ret
Function at 0x408e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x408ec7
test ebx, ebx
je 0x408ec7
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x408ec7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x408ec7
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x408ec1
push esi
push ebx
push edi
call fcn.0053e4c0
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x408ec1
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa004
mov esp, ebp
pop ebp
ret

Function at 0x408ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408f39
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408f39
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x408f2a
cmp esi, edx
jae 0x408f39
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x408f18
cmp esi, edx
jae 0x408f39
cmp word [esi], 0
je 0x408f39
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret