joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78b25fc6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl

Function at 0x78b25fdc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
invalid
inc ebp
invalid

Function at 0x78b27ce4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x78b27d28
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x78b27d2d
jmp fcn.78b27680
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x78b27d74
lea eax, [ebp - 0x714]
push eax
call fcn.78b25cee
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.78b25ca3
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x78b27d7f
jmp 0x78b27d84
jmp fcn.78b27680
Function at 0x78b2ab2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x78b52610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call sym.MSVCR100.dll__encoded_null
and dword [ebp - 0x14], 0
cmp dword [0x78b56598], 0
mov dword [ebp - 0x18], eax
jne 0x78b2abe2
push 0x78ae0dd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x78b2ac8a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x78b2acb8
push ebx
call edi
test eax, eax
je 0x78b2ac8a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x78ae0dc4
push ebx
mov dword [0x78b56598], eax
call edi
push eax
call esi
push 0x78ae0db0
push ebx
mov dword [0x78b5659c], eax
call edi
push eax
call esi
push 0x78b2ac9c
push ebx
mov dword [0x78b565a0], eax
call edi
push eax
call esi
mov dword [0x78b565a8], eax
test eax, eax
je 0x78b2abe2
push 0x78ae0d98
push ebx
call edi
push eax
call esi
mov dword [0x78b565a4], eax
mov eax, dword [0x78b565a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x78b2ac3b
cmp dword [0x78b565a8], ecx
je 0x78b2ac3b
push eax
call esi
push dword [0x78b565a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x78b2ac3b
test ebx, ebx
je 0x78b2ac3b
call edi
test eax, eax
je 0x78b2ac32
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x78b2ac32
test byte [ebp - 8], 1
jne 0x78b2ac3b
or dword [ebp + 0x10], 0x200000
jmp 0x78b2ac6e
mov eax, dword [0x78b5659c]
cmp eax, dword [ebp - 0x18]
je 0x78b2ac6e
push eax
call esi
test eax, eax
je 0x78b2ac6e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x78b2ac6e
mov eax, dword [0x78b565a0]
cmp eax, dword [ebp - 0x18]
je 0x78b2ac6e
push eax
call esi
test eax, eax
je 0x78b2ac6e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x78b56598]
call esi
test eax, eax
je 0x78b2ac8a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x78b2ac8c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.78ab1180
leave
ret
Function at 0x78b2b61f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x78b566b8], eax
mov dword [0x78b566b4], ecx
mov dword [0x78b566b0], edx
mov dword [0x78b566ac], ebx
mov dword [0x78b566a8], esi
mov dword [0x78b566a4], edi
mov word [0x78b566d0], ss
mov word [0x78b566c4], cs
mov word [0x78b566a0], ds
mov word [0x78b5669c], es
mov word [0x78b56698], fs
mov word [0x78b56694], gs
pushfd
pop dword [0x78b566c8]
mov eax, dword [ebp]
mov dword [0x78b566bc], eax
mov eax, dword [ebp + 4]
mov dword [0x78b566c0], eax
lea eax, [ebp + 8]
mov dword [0x78b566cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x78b56608], 0x10001
mov eax, dword [0x78b566c0]
mov dword [0x78b565bc], eax
mov dword [0x78b565b0], 0xc0000409
mov dword [0x78b565b4], 1
mov eax, dword [0x78b52610]
mov dword [ebp - 0x328], eax
mov eax, dword [0x78b53328]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x78b56600], eax
push 1
call sym.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x78b2b720
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x78b56600], 0
jne 0x78b2b70b
push 1
call sym.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x78b2e91a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x78b52610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call sym.MSVCR100.dll__encoded_null
and dword [ebp - 0x14], 0
cmp dword [0x78b568d4], 0
mov dword [ebp - 0x18], eax
jne 0x78b2e9cd
push 0x78ae0dd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x78b2ea75
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x78b2eaa4
push ebx
call edi
test eax, eax
je 0x78b2ea75
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x78ae0dc4
push ebx
mov dword [0x78b568d4], eax
call edi
push eax
call esi
push 0x78ae0db0
push ebx
mov dword [0x78b568d8], eax
call edi
push eax
call esi
push 0x78b2ea88
push ebx
mov dword [0x78b568dc], eax
call edi
push eax
call esi
mov dword [0x78b568e4], eax
test eax, eax
je 0x78b2e9cd
push 0x78ae0d98
push ebx
call edi
push eax
call esi
mov dword [0x78b568e0], eax
mov eax, dword [0x78b568e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x78b2ea26
cmp dword [0x78b568e4], ecx
je 0x78b2ea26
push eax
call esi
push dword [0x78b568e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x78b2ea26
test ebx, ebx
je 0x78b2ea26
call edi
test eax, eax
je 0x78b2ea1d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x78b2ea1d
test byte [ebp - 8], 1
jne 0x78b2ea26
or dword [ebp + 0x10], 0x200000
jmp 0x78b2ea59
mov eax, dword [0x78b568d8]
cmp eax, dword [ebp - 0x18]
je 0x78b2ea59
push eax
call esi
test eax, eax
je 0x78b2ea59
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x78b2ea59
mov eax, dword [0x78b568dc]
cmp eax, dword [ebp - 0x18]
je 0x78b2ea59
push eax
call esi
test eax, eax
je 0x78b2ea59
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x78b568d4]
call esi
test eax, eax
je 0x78b2ea75
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x78b2ea77
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.78ab1180
leave
ret
Function at 0x4037b5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x439400
call fcn.00406205
push 0x439400
call fcn.00405fb8
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403808
sub esp, 0xc
push 0x439400
call fcn.00406320
sub esp, 0xc
push 0
push 0x439400
call sub.KERNEL32.dll_CreateDirectoryA
push 0x439400
push 0x439000
call fcn.004066df
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x4066df
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x64
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
jmp 0x406722
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov ecx, 0x1a
xor edx, edx
push esi
push 0
div ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
add ebx, edx
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x40672d
dec edi
cmp edi, 0xffffffff
jne 0x4066f2
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406739
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
push 0x400
push dword [ebp + 8]
push 0x42daa8
call sub.KERNEL32.dll_lstrcpynA
push ebx
push ebx
push 0x42daa8
call fcn.0040619c
add esp, 0xc
test eax, eax
mov ebx, eax
je 0x4067f4
sub esp, 0xc
push eax
call fcn.00406205
add esp, 0xc
cmp byte [0x42f9a8], 0
jns 0x4067b7
mov al, byte [ebx]
test al, al
je 0x4067f4
cmp al, 0x5c
jne 0x4067b7
jmp 0x4067f4
sub esp, 0xc
push 0x42daa8
call fcn.0040613d
add esp, 0xc
test eax, eax
je 0x4067a5
test byte [eax], 0x10
je 0x4067f4
sub esp, 0xc
push 0x42daa8
call fcn.004062eb
add esp, 0xc
jmp 0x4067bd
sub ebx, 0x42daa8
sub esp, 0xc
push 0x42daa8
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
cmp eax, ebx
jg 0x40678c
sub esp, 0xc
push 0x42daa8
call fcn.00406320
push 0x42daa8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x4067f6
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4067fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
pop ecx
cmp eax, 0xffffffff
setne dl
neg edx
push 0
and edx, eax
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406835
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x40685b
push edx
and eax, 0xfffffffe
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4068c8
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, dword [ebp + 8]
push 1
mov ebx, dword [ebp + 0xc]
call fcn.004060ee
add esp, 0xc
test eax, eax
je 0x4068f5
push edx
push 5
push ebx
push esi
call eax
pop edi
test eax, eax
jne 0x406ac7
test ebx, ebx
mov dword [0x42cea8], 0x4c554e
je 0x40693e
push ecx
push 1
push 0
push ebx
call fcn.004067fd
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x42cea8
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406acd
cmp eax, 0x400
jg 0x406acd
push eax
push 0x400
push 0x42d2a8
push esi
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406acd
cmp eax, 0x400
jg 0x406acd
push 0x42d2a8
push 0x42cea8
push str._s_s_r_n
push 0x42d6a8
call sub.USER32.dll_wsprintfA
pop ebx
pop esi
mov dword [ebp - 0x24], eax
mov eax, dword [0x42f948]
push dword [eax + 0x128]
push 0x42d2a8
call fcn.00406414
sub esp, 0xc
push 4
push 0xc0000000
push 0x42d2a8
call fcn.004067fd
add esp, 0x14
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x406ac7
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
test esi, esi
pop eax
pop edx
je 0x406ab9
sub esp, 0xc
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x406ab9
cmp ebx, dword [ebp - 0x10]
jne 0x406ab9
push edi
push edi
push str._Rename__r_n
push esi
call fcn.00406862
pop edx
pop ecx
test eax, eax
jne 0x406a36
push eax
push 0x400
lea eax, [esi + ebx]
add ebx, 0xa
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpynA
mov edx, ebx
pop edi
jmp 0x406a70
push ecx
add eax, 0xa
push ecx
push 0x40a397
push eax
call fcn.00406862
pop edi
pop edx
mov edx, ebx
test eax, eax
je 0x406a70
mov edx, dword [ebp - 0x24]
lea edi, [eax + 1]
lea ecx, [eax + edx]
mov edx, edi
lea eax, [esi + ebx]
mov dword [ebp - 0x28], eax
jmp 0x406a66
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp edx, dword [ebp - 0x28]
jb 0x406a61
mov edx, edi
sub edx, esi
lea edi, [esi + edx]
mov ecx, dword [ebp - 0x24]
xor edx, edx
jmp 0x406a85
mov al, byte [edx + 0x42d6a8]
dec ecx
mov byte [edi + edx], al
inc edx
test ecx, ecx
jg 0x406a7a
push 0
push 0
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
sub esp, 0xc
push 0
push eax
lea eax, [ebx + edx]
push eax
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [0x42f8f8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x406dd1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x10]
push eax
push 0x42e2a8
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
mov dword [0x42e2a8], 0x44
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x406e19
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x406e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x42e2fc], 0
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push ebx
jne 0x406e61
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr edx, 1
xor edx, eax
cmp ecx, 8
jne 0x406e3b
mov dword [ebx*4 + 0x42e2f8], edx
inc ebx
cmp ebx, 0x100
jne 0x406e37
mov edx, dword [ebp + 8]
not edx
jmp 0x406e7b
mov al, byte [edi]
dec esi
inc edi
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x42e2f8]
test esi, esi
jne 0x406e68
not edx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push 0x411b7c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x411b80
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011d2
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411c20
push 0x411c30
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411c40
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411bf0
push 0x411c10
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4011f1
lea eax, [esp + 4]
push eax
push 0x411bf0
push 0x411c10
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411c00
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10004386
pop dword [ebp - 8]
mov eax, 0x1cb7a32a
add eax, 0xf348a05c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x3ae715c6
add dword [ebp - 0x18], 0x136b2f85
mov dword [ebp - 0x14], 0x363a3c21
sub dword [ebp - 0x14], 0x406efdc
mov dword [ebp - 0x10], 0x57a512a1
add dword [ebp - 0x10], 0xf4a7318d
mov dword [ebp - 0xc], 0xcaf47fe
add dword [ebp - 0xc], 0xf350b802
lea eax, [ebp - 0x18]
push eax
mov eax, 0xb849f9df
sub eax, 0xa849a987
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xf7e25a35
add dword [ebp - 0x18], 0x7c900f21
mov dword [ebp - 0x14], 0x479e46c9
sub dword [ebp - 0x14], 0x631e554
mov dword [ebp - 0x10], 0x8bf69e6f
add dword [ebp - 0x10], 0xd778cdfd
mov dword [ebp - 0xc], 0x10db303d
add dword [ebp - 0xc], 0xef24cfc3
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39628
push 0
call eax
mov ecx, 0x5c4b54ad
add ecx, 0xa3b4feab
mov edi, eax
mov edx, 0xdfe85d96
sub edx, 0xcfe7b596
add edx, dword [ebp - 8]
mov esi, 0xc0b4391c
add esi, 0xbadf92e7
xor dword [ebp - 4], 0x6c2710dc
mov ebx, dword [edx]
xor ebx, esi
xor dword [ebp - 4], edx
mov dword [edi], ebx
xor dword [ebp - 4], 0xbaffde4f
add edi, 4
add edx, 0xac5e426e
sub edx, 0xac5e426a
loop 0x100044a3
add eax, 0x50be12a0
add eax, 0xaf432d93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc682372a
sub ecx, 0xb682372a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x6ddb6991
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x6ddb69a0
pop dword [ebp - 0x3c]
mov eax, 0x6ddb69a0
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd100b347
add dword [ebp - 0x4c], 0x7d519204
mov dword [ebp - 0x48], 0xe3b108a3
add dword [ebp - 0x48], 0x4e8243a2
mov dword [ebp - 0x44], 0x4104188a
add dword [ebp - 0x44], 0xb482ba4
mov dword [ebp - 0x40], 0x98c6a30
add dword [ebp - 0x40], 0xf67395d0
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x123f75c7
add eax, 0x5b9bfac1
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbad6533d
add dword [ebp - 0x4c], 0xb99c1619
mov dword [ebp - 0x48], 0x8e21743
add dword [ebp - 0x48], 0x388a4a32
mov dword [ebp - 0x44], 0xaa5e590
sub dword [ebp - 0x44], 0xa7367924
mov dword [ebp - 0x40], 0x851be68a
sub dword [ebp - 0x40], 0x851be68a
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x188dd255
sub eax, 0xaab26195
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x36150
push 0
call eax
mov ecx, 0xda8f8ca
add ecx, 0xf2574c2f
xor edx, edx
add edx, eax
mov esi, 0x65f49375
add esi, 0x7e7a88b
add esi, dword [ebp - 0x3c]
mov ebx, 0xb3baeb90
add ebx, 0x1b729bbf
xor dword [ebp - 0x28], 0x7f273287
mov edi, dword [esi]
add dword [ebp - 0x28], 0x501aebfc
xor edi, ebx
mov dword [ebp - 0x10], 0xff718004
mov dword [edx], edi
add dword [ebp - 0x18], esi
add edx, 4
add esi, 4
loop 0x6ddb6abf
add eax, 0x3a3a3204
add eax, 0xc5c6d4b3
mov ebx, eax
add eax, 0x21d138a9
sub eax, 0x21d138a4
mov ecx, 0x2fe858fa
sub ecx, 0xc20d58fa
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6f1e5606
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x134279cf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401030
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x413128]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.00402ec0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.ACUninstall.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
call fcn.00401150
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010a4
lea eax, [ebp - 0x20c]
push eax
call fcn.00401240
push 0x411b58
push 0x82
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401410
pop edi
test eax, eax
je 0x40112a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40112a
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00402ec0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0
push 0x411b60
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00401170
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00401913
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401240
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x40127b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401279
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
pop ebp
ret 4