joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456c10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
mov esi, ecx
push 0x40000000
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x456d87
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi + 0x20c]
push ecx
push ebx
mov ecx, esi
call fcn.00456b30
test eax, eax
jne 0x456c73
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
mov eax, dword [edi + 0x20c]
xor ebp, ebp
test eax, eax
jbe 0x456d22
lea esi, [edi + 0x224]
mov al, byte [esi - 0x10]
mov dl, byte [esi - 0x14]
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov byte [esp + 0x18], dl
mov byte [esp + 0x1b], 0
mov cx, word [eax + 0xc]
mov word [esp + 0x1c], cx
mov dx, word [eax + 0xe]
mov word [esp + 0x1e], dx
mov ecx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and eax, 0xffff
imul ecx, eax
cmp ecx, 8
jl 0x456cd2
mov byte [esp + 0x1a], 0
jmp 0x456cda
mov dl, 1
shl dl, cl
mov byte [esp + 0x1a], dl
mov eax, dword [esi - 4]
mov ecx, dword [esp + 0x14]
push ebp
push edi
mov dword [esp + 0x28], eax
call fcn.00456be0
lea ecx, [esp + 0x30]
push 0
push ecx
lea edx, [esp + 0x20]
push 0x10
push edx
push ebx
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x456d87
cmp dword [esp + 0x30], 0x10
jne 0x456d87
mov eax, dword [edi + 0x20c]
inc ebp
add esi, 0x20
cmp ebp, eax
jb 0x456c89
mov eax, dword [edi + 0x20c]
xor ebx, ebx
test eax, eax
jbe 0x456d7c
lea esi, [edi + 0x224]
mov eax, dword [esi]
push 0
mov ebp, dword [eax + 0x14]
mov dword [eax + 0x14], 0
mov ecx, dword [esi - 4]
mov edx, dword [esi - 8]
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x456d87
mov ecx, dword [esp + 0x30]
mov eax, dword [esi - 4]
cmp ecx, eax
jne 0x456d87
mov edx, dword [esi]
inc ebx
add esi, 0x20
mov dword [edx + 0x14], ebp
mov eax, dword [edi + 0x20c]
cmp ebx, eax
jb 0x456d34
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
Function at 0x456da0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x456e1f
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x456e1f
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x456e1f
push ebx
push ebp
push edi
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov ebp, eax
mov eax, ecx
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x456fa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45708d
mov esi, dword [esp + 0x28]
mov ecx, edi
push esi
mov word [esp + 0x14], 0x4d42
mov word [esp + 0x1a], bp
mov word [esp + 0x1c], bp
call fcn.00456f60
and eax, 0xffff
push esi
add eax, 0x36
mov ecx, edi
mov dword [esp + 0x1e], eax
call fcn.00456f70
imul eax, dword [esi + 8]
mov edx, dword [esp + 0x1a]
lea ecx, [esp + 0x24]
add eax, edx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
lea edx, [esp + 0x18]
push 0xe
shr eax, 2
push edx
push ebx
mov dword [esp + 0x26], eax
call ebp
test eax, eax
je 0x457086
cmp dword [esp + 0x24], 0xe
jne 0x457086
mov eax, dword [esi + 8]
push esi
cdq
sub eax, edx
mov ecx, edi
sar eax, 1
mov dword [esi + 8], eax
call fcn.00456f70
mov edi, eax
mov ecx, dword [esp + 0x1a]
imul edi, dword [esi + 8]
lea eax, [esp + 0x24]
add edi, ecx
push 0
push eax
push edi
push esi
push ebx
call ebp
test eax, eax
je 0x457086
cmp dword [esp + 0x24], edi
jne 0x457086
mov ecx, dword [esi + 8]
push ebx
shl ecx, 1
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x4596c0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x459763
test eax, eax
jbe 0x459763
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x459763
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45970e
xor esi, esi
jmp 0x459714
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45973f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040b730
add esi, eax
push esi
mov ebx, esi
call fcn.0040b730
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x459720
pop ebp
test edi, edi
pop edi
jne 0x459763
test ebx, ebx
je 0x459763
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00464f20
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4598a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4599bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4599bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00476132
mov esi, eax
test esi, esi
je 0x4599bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4599bd
mov ecx, esi
call fcn.00459810
cmp edi, eax
jge 0x4599bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x459943
mov dword [esp + 0x34], 1
jmp 0x45999e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4599bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00458de0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x476ad6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x476b0e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00474b7b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00474b53
jmp 0x476b1a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4781c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47820a
call fcn.0047deb2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47820a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x478201
xor eax, eax
jmp 0x478212
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00478218
pop edi
pop esi
pop ebx
ret 4

Function at 0x47e3e2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47e410
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47e42e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047e348
jmp 0x47e42e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47e42e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047e348
test edi, edi
mov eax, edi
jne 0x47e418
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xa900a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x24]
je 0xa01bf2
shrd si, di, 9
neg edx
bt ax, si
test cl, 0x43
mov esi, dword [eax + 0x3c]
call int.00aa5ab4
fcomp dword [edx - 0x14]
hlt
mov byte [esp], 0x29
lea esp, [esp + 0x30]
jb 0xa01bf8
bt edi, esi
cmp eax, dword [ebp - 0x10]
pushal
pushal
push edi
lea esp, [esp + 0x44]
jae 0xa01bf8
bts cx, 0xb
dec cl
xchg edi, ebx
xor cl, 0xaa
mov ebx, eax
bt bp, 9
bswap di
btc di, dx
test bl, 0x5b
mov edi, eax
test dl, 0xa4
cmp cl, ah
bsr cx, si
mov ecx, 0x104
cmp al, cl
push 0xdfb9ad51
xor al, al
cmc
repne scasb al, byte es:[edi]
jmp 0x79a4f7
clc
cmc
clc
test eax, eax
pushfd
jmp 0x7967d4
jmp 0x78e55d
call 0xaa64a5
lea eax, [ebx + 0x26778a19]
aas
sal ax, cl
cmc
mov ebp, esp
cwde
shl al, cl
btc ax, 1
rcr ah, 2
sub esp, 0x18
adc al, bl
stc
push 0x7be696
aaa
mov dword [esp], esi
sub al, 0xc7
push edi
dec eax
lea eax, [edi + 0x24bfd5b7]
cwde
push ebx
lea eax, [ebx*8 + 0x24ed40fc]
shrd ax, di, 2
xor ax, di
push edx
rol al, cl
aad 0x52
rcr ax, 1
cwde
mov eax, dword [ebp + 8]
pushfd
cmp di, dx
lea esp, [esp + 4]
jns 0x794ee2
test bl, bl
test eax, eax
call int.00a8f8dd
jmp 0x790a00
shr ah, 6
push ebp
test ah, bh
push ebx
rcr bp, cl
add esp, 4
jnp 0x9f40e7
mov ebp, esp
movzx ax, al
aad 0x59
sal ah, 2
ror al, cl
sub esp, 0x18
aad 0x69
push esi
pushal
mov dword [esp + 0x1c], edi
btr ax, 1
mov dword [esp + 0x18], ebx
clc
mov dword [esp + 0x14], edx
adc ah, 0xf0
sbb al, bl
bsr eax, ebx
mov eax, dword [ebp + 8]
test cx, 0x1584
test eax, eax
push esp
pushal
jmp 0x795e1f
Function at 0xaa6e70
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x20]
jne 0xa8c3e3
not al
mov byte [edi - 1], 0
push eax
setg ah
mov dword [esp], ebx
push ebp
movzx ax, dl
push esp
lea eax, [0xaa590d]
push dword [esp + 4]
call fcn.00a8f365
push ecx
lea esp, [esp + 4]
jne 0xaa544a
btc di, bp
btr di, 5
pushfd
mov edi, dword [edx + 0x24]
pushal
add edi, eax
test dh, 0xe4
cmp cl, 0xbc
pushal
movzx ecx, word [edi + ecx*2]
shl di, cl
rol edi, 0x1b
mov edi, dword [edx + 0x1c]
add esp, 0x44
jns 0xa8e532
add edi, eax
clc
jmp 0xaa572e
pushfd
mov edi, dword [edi + ecx*4]
clc
bt cx, 0xd
test edi, edi
call fcn.007934c2
test ebx, edx
sbb eax, 0x97b964a5
movsb byte es:[edi], byte [esi]
imul edi, dword [edx], 0xffffffe8
adc eax, 0xc7a1687
inc eax
pop edx
enter 0x1539, 0x7f
or eax, dword [0x493b4739]
cmp eax, 0xf98dc43f
sbb dword [esi - 0x5441aad6], 0xffffffc5
fsubr st(5), st(0)
and edi, dword [edx - 0x22f55b3a]
sub ebx, dword [esi]
popal
pop edx
push ds
pop ss
lodsb al, byte [esi]
fisub dword [ecx - 0x67]
stc
cmp dword [eax], 0x79
xlatb
xor al, 0x44
dec ecx
mov ebx, 0x348f8c06
and byte [edx + 0x91d79d6], bh
invalid
pushal
add edi, eax
clc
cmc
jmp 0xa8a91d
mov edi, dword [edi + ecx*4]
pushal
cmc
test edi, edi
pushfd
pushal
mov byte [esp + 4], dh
lea esp, [esp + 0x44]
je 0xa01bf2
bt eax, 0x1e
cmp bh, cl
cmc
add eax, edi
test ch, 0xca
cmp eax, edx
pushal
push esi
mov byte [esp], 0x69
lea esp, [esp + 0x24]
jb 0xa01bf8
pushal
call fcn.0078acd7
push ecx
call fcn.00a8ca8d
push ebp
pushal
lea esp, [esp + 0x24]
ja 0x789e13
and al, 0x4e
sub ebx, edi
movzx edi, bl
dec al
sar al, cl
dec al
add ebx, esp
shl al, cl
lea edi, [ebp*8 + 0x57b647c0]
mov edi, ebx
or al, bh
test si, di
inc al
test ch, 0x52
mov al, 0x2e
stc
test ah, bh
stc
repne scasb al, byte es:[edi]
jmp 0x78b2fd
Function at 0x40d880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x40d8a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d8a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d898
mov eax, 1
add ebx, ebx
jne 0x40d8bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d8b0
jne 0x40d8cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d8b0
xor ecx, ecx
sub eax, 3
jb 0x40d8e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d952
mov ebp, eax
add ebx, ebx
jne 0x40d8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d8f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d91c
inc ecx
add ebx, ebx
jne 0x40d908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d8fd
jne 0x40d919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d8fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d93c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d92d
jmp 0x40d89e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d93c
add edi, ecx
jmp 0x40d89e
pop esi
mov edi, esi
mov ecx, 0x167
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40d95a
cmp byte [edi], 5
jne 0x40d95a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40d95f
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d9d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe494]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe548]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d98c
mov ecx, edi
jns 0x40d9bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe54c]
or eax, eax
je 0x40d9d1
mov dword [ebx], eax
add ebx, 4
jmp 0x40d9a9
call dword [esi + 0xe55c]
mov ebp, dword [esi + 0xe550]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40da0b
sub esp, 0xffffff80
jmp 0x401c56
Function at 0x451ee0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x403426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401378
mov eax, dword [ebp + 0x10]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [eax], esi
mov edx, dword [0x49208c]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], esi
jne 0x451f80
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea edx, [ebp - 0x30]
push 0x40a81c
push edx
call esi
push eax
lea eax, [ebp - 0x2c]
push 0x40a988
push eax
call esi
push eax
push 0x80000001
call fcn.0040c108
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x2c]
push ecx
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
push 0x452023
jmp 0x452019
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstrB]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
lea edx, [ebp - 0x34]
push ecx
push edx
call esi
push eax
push 1
lea eax, [ebp - 0x30]
push 0x40a81c
push eax
call esi
push eax
lea ecx, [ebp - 0x2c]
push 0x40a988
push ecx
call esi
push eax
push 0x80000001
call fcn.0040c188
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x18]
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x2c]
push edx
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
push 0x452023
jmp 0x452019
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
Function at 0x4615f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x403426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401bf8
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor esi, esi
mov edx, 0x40ae08
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x6c], esi
call edi
mov edx, 0x40d1bc
lea ecx, [ebp - 0x2c]
call edi
mov edx, 0x40ec58
lea ecx, [ebp - 0x1c]
call edi
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x24], 0x100
mov dword [ebp - 0x64], 0x40d688
mov dword [ebp - 0x6c], 8
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x5c]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcStringVar]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x4c]
push ecx
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov ecx, dword [ebp - 0x30]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
add esp, 0xc
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x3c]
push eax
push ecx
push edx
call edi
mov ecx, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x38]
push eax
push ecx
push edx
call edi
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push eax
push ecx
call edi
push eax
push 0x80000001
call fcn.0040c1cc
mov ebx, eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov edx, dword [ebp - 0x34]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
lea eax, [ebp - 0x2c]
push edx
push eax
call edi
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x1c]
push ecx
push edx
call edi
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
push eax
push ecx
call edi
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x34]
push eax
push ecx
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
cmp ebx, esi
jne 0x46176b
mov edx, dword [ebp - 0x30]
push 1
push edx
push 0x40d688
push esi
call dword [sym.imp.MSVBVM60.DLL___vbaInStr]
sub eax, 1
jo 0x4617d3
push eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharBstr]
mov edx, eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push 0x4617bf
jmp 0x4617a9
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x1c]
call esi
lea ecx, [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x30]
call esi
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
Function at 0x100336a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1005268
call fcn.01003a58
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x10013cc
mov dword [esi + 4], 0x10013bc
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CCritSec::constructor_void_]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], eax
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esi + 0x10], ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x1003792
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007044]
jne 0x10037a3
test ecx, 0xffff0000
jne 0x10037a3
ret
jmp fcn.010037ad

Function at 0x1003892
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001460
call fcn.01003b58
cmp word [0x1000000], 0x5a4d
jne 0x10038d1
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x10038d1
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x10038ea
cmp ecx, 0x20b
je 0x10038d7
and dword [ebp - 0x1c], 0
jmp 0x1003901
cmp dword [eax + 0x1000084], 0xe
jbe 0x10038d1
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x10038fb
cmp dword [eax + 0x1000074], 0xe
jbe 0x10038d1
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10073ec], 0xffffffff
or dword [0x10073f0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10073a0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100739c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10073f4], eax
call fcn.01002715
cmp dword [0x1007050], 0
jne 0x100395e
push fcn.01002715
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003af3
push 0x10011e4
push 0x10011e0
call sub.msvcrt.dll__initterm
mov eax, dword [0x1007398]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1007394]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x10011dc
push 0x10011cc
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01004dc8
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x10039d6
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1003a0b
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003b93
ret