joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61a8cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [eax - 0x31]
rdtsc
push word [esp + 0x19]
popal
setl bh
jmp 0x61a88b

Function at 0x61a97e
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x61a9d5
mov ebp, 0x6678d10
pop word [esp]
mov si, di
mov dl, dh
pop bp
rdtsc
jmp 0x61a9b4
add ax, 0xa3ce
mov ebp, 0x16da2a80
xchg dword [esp], esi
cpuid
mov dx, word [esp + 3]
cpuid
jmp 0x61a980

Function at 0x61aaef
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov dl, 0x64
xchg di, ax
sub esp, 0x14
pushal
lea esp, [esp + 0x4b]
mov ebx, dword [esp]
jmp 0x619ff9
pop word [esp + 3]
push word [esp + 6]
lea edx, [edi*4]
mov cx, word [esp + 0xc]
not ah
pop bp
jmp 0x61a01d
xchg dword [esp + 8], ebx
jmp 0x61a091

Function at 0x61abd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 0xd]
mov si, di
mov bh, byte [esp + 0xb]
shl ax, cl
sub esp, 0x10
cmc
jmp 0x61aba7
rdtsc
popal
neg dh
setl bh
pushal
mov bx, dx
jmp 0x61ab5d
jmp 0x61ab82

Function at 0x61adf2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], dx
sub esp, 4
mov ecx, esi
clc
btc ebp, ebx
mov edi, 0xab195e1c
pop edx
jmp 0x61ad94
mov byte [esp + 9], bh
xchg ch, dl
popal
sub esp, 0
push dword [esp + 2]
jmp 0x61adad

Function at 0x61bb8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 2], bx
sub esp, 0x18
mov byte [esp + 0xd], bh
jmp 0x61bcf0
mov dl, dh
popal
rdtsc
neg ch
rdtsc
push word [esp + 1]
jmp 0x61bbe2
mov di, sp
lea eax, [esp + edx]
pushal
bswap ebx
rdtsc
push word [esp + 0xa]
jmp 0x61bc01
add eax, ebp
mov cx, word [esp]
add esp, 0
lea esp, [esp]
bsr bp, bp
not ecx
jmp 0x61bc60
bsr di, bp
popal
clc
bswap ebx
inc esi
mov cl, 0x4a
jmp 0x61bc87

Function at 0x61bf41
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
mov bp, di
add esp, 1
mov word [esp], di
neg ax
mov byte [esp], ah
jmp 0x61bf43
pop ax
xchg edi, eax
mov bp, bx
mov edi, dword [esp]
lea ecx, [edi*4]
mov al, 0xa6
jmp 0x61bef4
jmp 0x61bf17
bsf dx, si
neg eax
bsr cx, bp
mov ebx, dword [esp]
xchg byte [esp], cl
xchg dh, al
jmp 0x61bf7a
Function at 0x61bfd5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, eax
xchg dh, al
and edx, ecx
jmp 0x61bfe1
mov bp, word [esp + 0x16]
mov edi, dword [esp + 0x13]
rcl bp, cl
sub esp, 0x1e
push edx
xchg byte [esp + 0x25], cl
jmp 0x61dfa9
cpuid
inc di
mov edi, dword [esp]
mov edx, ebp
rdtsc
cpuid
jmp 0x61c078
mov edi, ebp
mov dl, byte [esp]
not dh
mov si, dx
clc
mov cx, bx
jmp 0x61bffb
lea edi, [ebp - 0x42dcb179]
inc ebx
inc al
pushal
lea esp, [esp + 0x41]
rdtsc
jmp 0x61c022
mov esi, ebp
inc si
bsr di, bp
mov di, 0xcc95
cpuid
btc ebx, edi
call fcn.0061c00a
push dword [esp + 0x13]
mov di, dx
push dword [esp + 0x14]
pop dword [esp + 8]
push dword [esp + 0xa]
lea ecx, [eax + edx]
jmp 0x61c047
inc bl
rcr esi, 9
not ecx
bswap eax
mov al, 0xe
mov word [esp + 0x11], dx
jmp 0x61c0a5
mov bl, 0x48
mov esi, dword [esp + 0x11]
mov di, 0x6147
mov byte [esp + 7], ah
push dword [esp + 0x14]
cmc
jmp 0x61c1a6
popal
sub esp, 0x14
xchg cx, di
mov si, word [esp + 4]
mov ecx, esi
bswap esi
jmp 0x61c347
mov byte [esp + 0xd], dh
xor dl, ch
neg dh
push edx
mov ch, byte [esp + 0x1d]
mov bp, bx
jmp 0x61c423
stc
lea eax, [esi + 0x95]
add esp, 1
push word [esp + 4]
xchg byte [esp + 8], al
inc cl
jmp 0x61c7ec
clc
popal
bswap edi
clc
mov ax, word [esp + 0x1a]
cpuid
jmp 0x61deec

Function at 0x61c179
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi*4]
bswap ebx
rcl ax, cl
bswap edi
xchg esi, ecx
pop word [esp + 5]
jmp 0x61c162
xchg dword [esp + 4], ebp
mov dh, byte [esp + 7]
cld
mov dl, dh
mov si, word [esp]
cld
jmp 0x61c11c
clc
stc
inc cl
bswap edi
sub esp, 0x10
rdtsc
jmp 0x61c187
add al, dh
pop ebp
mov byte [esp + 4], ch
mov word [esp], bx
pushal
stc
jmp 0x61c149
push dword [esp]
mov word [esp + 2], sp
mov byte [esp + 0xa], ah
jmp 0x61c137
not edx
bswap eax
mov ch, byte [esp + 0x1b]
push dword [esp]
mov bl, 0x48
add esp, 0x31
jmp 0x61c2e2
mov cx, 0x4c85
pop cx
pop ecx
mov ch, byte [esp + 1]
lea ebp, [ebx + edi]
rcr ah, 1
jmp 0x61c1fe
pop word [esp + 0x18]
mov dl, 0xa4
xchg esi, ebp
popal
stc
setnp ah
jmp 0x61c1bb
mov bl, bh
mov si, di
neg ch
pop ax
clc
xchg bh, cl
jmp 0x61c1d8
mov cx, 0x5e25
btc edi, edi
mov byte [esp + 1], ch
bsf di, ax
mov ch, byte [esp + 1]
xchg dh, al
jmp 0x61c2bd
mov edx, 0xce837f68
lea esi, [edi*4]
mov bx, sp
mov edx, eax
lea ecx, [esi + edi]
mov ecx, 0x79c5296
jmp 0x61c1f0
push esp
push word [esp + 1]
mov dword [esp + 3], ecx
neg ecx
bswap eax
xchg bh, cl
jmp 0x61c28e
mov dx, word [esp + 2]
btc edx, ebx
rol bp, cl
push dword [esp + 2]
xchg ch, dl
sub bl, ah
jmp 0x61c245
mov bx, di
neg bh
pushal
xchg ch, dl
call fcn.0061c2a7
rcr dword [ebp - 0x33], 1
xchg esp, eax
mov esp, dword [bx + di]
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x54
aas
lea edi, [eax*4]
mov word [esp + 6], sp
sub esp, 0xc
rdtsc
cpuid
push dword [esp + 0xe]
jmp 0x61c274
lea esp, [esp + 1]
bswap edi
xchg byte [esp], dl
push edx
cpuid
pop cx
jmp 0x61c25f
pushal
lea ebp, [esi - 0xa5]
not ecx
lea edx, [eax + 0x61]
mov eax, esi
push dword [esp + 0x1c]
jmp 0x61c22a
Function at 0x61c2a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x42]
mov ecx, dword [esp]
jmp 0x61c324
cmc
mov dh, byte [esp + 3]
pushal
mov eax, 0xc99f72a8
mov word [esp + 2], di
rdtsc
jmp 0x61c382
xchg dh, al
inc cx
cld
neg bx
bswap edx
shr ebp, 0x17
jmp 0x61c35f
mov si, 0x2645
bswap ebp
lea ebx, [ebp + 0x37]
mov esi, dword [esp]
push esp
mov bx, 0x55d1
jmp 0x61c2f9
mov esi, ecx
sub esp, 0x10
rol dx, cl
clc
lea edi, [eax + 0x81]
lea esp, [esp + 5]
jmp 0x61c3c2
mov bh, byte [esp + 3]
mov bl, bh
mov bl, bh
mov dword [esp + 0x17], esi
bsf di, ax
xchg dword [esp + 0xc], esi
jmp 0x61c30d
neg esi
push edx
lea edi, [ecx + ebx]
inc di
xchg word [esp + 0x17], ax
pop ecx
jmp 0x61c409
mov word [esp + 0x16], sp
stc
popal
btr eax, esp
not esi
btr edi, esp
jmp 0x61c3ee
xchg dword [esp + 6], ebx
add al, dh
mov bh, byte [esp + 0x2b]
xchg word [esp + 0x24], bx
cpuid
rdtsc
jmp 0x61c39b
mov bx, word [esp + 8]
call fcn.0061c57f
fiadd dword [eax - 0x2a]
mov cl, 0x40
invalid
not bh
mov cx, 0x2cdb
sub esp, 0
push dword [esp]
mov dl, 0x84
cpuid
jmp 0x61c3d7
lea esp, [esp + 5]
mov dword [esp + 0x11], ecx
rcl cx, cl
mov dl, 0x8c
pop ecx
bsr dx, cx
jmp 0x61c3ab

Function at 0x61c46f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0x589e9726
mov word [esp], sp
mov ecx, 0x2617ead2
bswap ebx
push edx
mov ebx, dword [esp + 3]
jmp 0x61c51a
pop cx
pop ecx
bswap ebx
xchg word [esp + 8], bp
lea esp, [esp + 2]
mov esi, dword [esp + 0xa]
jmp 0x61c440
lea esp, [esp + 7]
push edx
xchg dx, di
inc ebx
lea eax, [ecx - 0x53c7cedd]
jmp 0x61c4c4
add si, 0xa786
rdtsc
mov dl, dh
push edx
mov eax, dword [esp + 4]
mov ecx, 0x1a36781e
jmp 0x61c498
lea esp, [esp + 5]
not dx
inc cl
pushal
mov ax, dx
call fcn.0061c560
xchg ebp, eax
or dword [ecx + 0x288e0bf8], ebx
dec ebx
loop 0x61c4fd
insb byte es:[edi], dx
jg 0x61c470
lea ecx, [eax*4]
or al, 0x85
add byte [eax], al
add byte [eax], al
rdtsc
lea esp, [esp]
xchg byte [esp], al
mov cl, 0x22
jmp 0x61c4af
mov word [esp + 0xa], bx
pop esp
and al, 0xa
pop ebp
lea edx, [ebx + ebx]
pop bx
pop cx
mov eax, 0x89053bee
jmp 0x61c4e2
ror ah, 1
cpuid
add dx, 0x57ce
setbe bh
pop ecx
jmp 0x61c4fb
Function at 0x61c592
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x12
jmp 0x61c760
add esp, 0
mov cl, ch
lea ebx, [ebp - 0xaf]
bsr cx, cx
jmp 0x61c604
mov byte [esp], dh
stc
mov bx, 0x183
inc dx
mov byte [esp], ah
mov ebx, dword [esp]
jmp 0x61c5db
lea ebp, [ebx*4]
mov bx, sp
mov edi, ebp
mov bl, 0x38
add esp, 0
shr edx, 1
jmp 0x61c745
mov ecx, esi
mov bl, 0xd8
and cx, 0xf41a
inc al
rdtsc
mov byte [esp], ch
jmp 0x61c5f2
xchg cx, dx
push dword [esp + 8]
btr edi, esp
xchg dword [esp + 6], esi
push dword [esp]
mov ecx, 0xc7aaf946
jmp 0x61c703
stc
mov dword [esp + 0xd], esi
add esp, 0x15
mov al, ah
mov cl, 0xca
pop word [esp + 7]
jmp 0x61c641
mov esi, 0x24d8373a
bsr cx, cx
cld
neg bh
lea ecx, [ebp - 0x87]
popal
jmp 0x61c6d8
mov eax, dword [esp + 0xd]
pop word [esp + 0xb]
cpuid
sub esp, 0x18
btc ecx, edi
xchg byte [esp + 0xa], al
jmp 0x61c67f
mov bp, sp
xchg ch, dl
btc ebp, ebx
push word [esp + 5]
xchg byte [esp + 0xf], dl
xchg ah, bl
jmp 0x61c69c
sub esp, 0x12
mov di, word [esp + 0x14]
push dword [esp + 0x18]
pop dword [esp + 0x14]
lea ebp, [esi - 0x9d]
rdtsc
jmp 0x61c791
mov bl, bh
neg edi
not ebx
pop si
xchg dh, al
mov word [esp], dx
jmp 0x61c6c3
bswap ecx
mov dx, word [esp]
bsf cx, si
not ax
xchg dx, di
pushal
jmp 0x61c66c
xchg ch, dl
mov si, 0x983d
btc ebx, edi
btr ecx, edx
mov dx, bx
not ax
jmp 0x61c71e
mov si, 0x40a7
inc cl
lea esp, [esp + 2]
mov bl, bh
mov ax, 0xa61f
xchg ecx, ebp
jmp 0x61c62f
popal
pop dx
mov cx, 0x1911
push dword [esp + 2]
pop di
sub esp, 0xe
jmp 0x61c7c3
pop ebx
mov dl, dh
neg ebp
sub esp, 0x16
bswap ebp
mov si, di
jmp 0x61c777
lea eax, [edx + esi]
call 0x61c7a0
mov ch, byte [esp + 0xc]
pushal
btc eax, edi
call fcn.0061d6fb
sub eax, 0xb8492eb8
adc dword [0x9f6c0595], ecx
sub eax, 0xf394069d
push cs
cmpsd dword [esi], dword es:[edi]
aaa
push ds

Function at 0x61c9ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc di
mov dl, 0xdc
clc
inc bp
bswap edx
jmp 0x61ca0f
mov cl, ch
sub esp, 2
pop eax
bsr ax, bp
add esp, 0
mov ebp, dword [esp]
jmp 0x61ca51
mov di, word [esp + 4]
xchg ah, bl
neg edi
mov cl, 0xf2
pop word [esp]
btc ecx, ebx
jmp 0x61c9ef
lea eax, [ebp*4]
stc
not edx
xchg edi, ecx
lea ebx, [esi + edi]
jmp 0x61ca7e
mov dl, 0x3c
btr ebp, esp
mov al, ah
add esp, 0
xchg byte [esp], dl
jmp 0x61ca23
lea esp, [esp]
xchg ah, bl
lea ebp, [edi*4]
mov cx, sp
mov al, ah
mov ax, word [esp]
jmp 0x61ca39
xchg di, si
lea ebp, [ebp + 0xc7]
mov cx, 0x190d
setae dh
jmp 0x61caf5
xchg dx, di
pushal
mov edx, 0xce5510c4
xchg bx, di
setae bh
jmp 0x61ca68
bsr bx, bp
btc ebp, ebx
cpuid
xchg esi, ebp
lea esp, [esp + 9]
add edi, ebp
jmp 0x61ca9f
neg bh
not bx
cmc
btr ebx, esp
cld
push word [esp + 0x22]
jmp 0x61cabf
push word [esp + 0x1f]
mov byte [esp + 1], ah
xchg dx, si
xchg word [esp + 0x13], dx
cpuid
btr ebp, esp
jmp 0x61cad8

Function at 0x61cf1d
Capabilities:
Parse pe header

Disassembly:
call fcn.0061c037
push word [esp + 3]
mov byte [esp + 1], dh
call fcn.0061cd37
mov eax, dword [eax + 8]
push eax
jmp 0x61c032
Function at 0x41ade0
Capabilities:
Check if file exists

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
mov ecx, dword [edi]
mov esi, eax
neg esi
sbb esi, esi
neg esi
push ecx
neg esi
call dword [sym.imp.SHLWAPI.DLL_PathIsDirectoryW]
test eax, eax
je 0x41ae0d
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov ax, si
pop esi
ret 4

Function at 0x41bdf0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x402386
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401b20
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov ecx, 8
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov esi, dword [sym.imp.SHLWAPI.DLL_PathRemoveBackslashW]
mov edx, dword [ebp - 0x24]
push edx
call esi
mov edi, eax
mov eax, dword [ebp - 0x24]
push eax
call esi
cmp edi, eax
jne 0x41be4d
lea ecx, [ebp - 0x24]
push ecx
call fcn.0041ae20
test ax, ax
je 0x41bf2c
mov edx, dword [ebp - 0x24]
push 0x80
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
neg eax
cmp ax, bx
mov dword [ebp - 0x48], eax
jne 0x41bf2c
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, 1
jo 0x41bf52
imul eax, eax, 2
jo 0x41bf52
lea edx, [ebp - 0x20]
add eax, 2
push edx
jo 0x41bf52
push eax
call fcn.004239b0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x20
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
call dword [sym.imp.USER32.DLL_GetActiveWindow]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x414
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
call dword [sym.imp.MSVBVM60.DLL___vbaI2I4]
lea ecx, [ebp - 0x44]
push ecx
mov word [ebp - 0x34], ax
call dword [sym.imp.SHELL32.DLL_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
lea edx, [ebp - 0x20]
neg eax
push edx
mov dword [ebp - 0x48], eax
call fcn.00423a40
push 0x41bf3b
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x41c330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x402386
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401b60
mov edi, dword [sym.imp.MSVBVM60.DLL_rtcVarBstrFromAnsi]
xor esi, esi
push esi
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x6c], esi
call edi
lea ecx, [ebp - 0x2c]
push ecx
push 0x104
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcStringVar]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x1c]
call ebx
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov ecx, dword [ebp - 0x1c]
push esi
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x5c], 8
call edi
push 1
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push esi
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x6c], 2
call dword [sym.imp.MSVBVM60.DLL___vbaInStrVar]
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarSub]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Var]
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharBstr]
mov edx, eax
lea ecx, [ebp - 0x1c]
call ebx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov edx, dword [ebp - 0x1c]
add esp, 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 0x41c47f
jmp 0x41c475
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret

Function at 0x41c530
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push eax
xor ebx, ebx
call edi
cmp eax, 0xffffffff
jne 0x41c551
pop edi
pop esi
or eax, eax
pop ebx
ret 4
mov ecx, dword [esi]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
jne 0x41c57a
pop edi
pop esi
or eax, eax
pop ebx
ret 4
pop edi
pop esi
mov ax, bx
pop ebx
ret 4
Function at 0x41c590
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x402386
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401b80
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
mov esi, dword [ebp + 0xc]
mov edx, dword [esi]
push 1
push ecx
xor eax, eax
push edx
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
mov edi, eax
test edi, edi
je 0x41c631
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov ecx, dword [ebx]
mov edx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [edx]
add esi, edi
jo 0x41c668
push esi
push ecx
push eax
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
test eax, eax
je 0x41c631
mov edx, dword [ebx]
lea ecx, [ebp - 0x30]
push ecx
sub eax, esi
push esi
jo 0x41c668
push edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 3
call dword [sym.imp.MSVBVM60.DLL_rtcMidCharBstr]
mov edx, eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 0x41c652
jmp 0x41c651
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
push ebp
mov ebp, esp
sub esp, 0xc
push 0x402386
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401b90
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov edx, dword [ebp + 0x18]
lea eax, [ebp - 0x30]
push eax
push 0x400
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x54], bl
mov dword [edx], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], 2
call dword [sym.imp.MSVBVM60.DLL_rtcStringVar]
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x1c]
call esi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
add esp, 0xc
push eax
mov eax, dword [edx]
push 0x400
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push ebx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp eax, ebx
jne 0x41c735
xor edx, edx
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
jmp 0x41c74c
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov byte [ebp - 0x54], bl
call fcn.0041b1c0
mov edx, eax
lea ecx, [ebp - 0x18]
call esi
push 0x41c780
jmp 0x41c776
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219