joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44ae90]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x44ae90], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret
Function at 0x4038fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004038aa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.004038bf
lea eax, [ebp - 0x72c]
push eax
push dword [ebp + 8]
call fcn.004038bf
add esp, 0x14
push 0x70
pop ebx
lea esi, [ebp - 0x71c]
mov edi, ebx
lea eax, [esi - 0x10]
push esi
push eax
call fcn.004038bf
push esi
call fcn.00403872
add esp, 0xc
add esi, 0x10
dec edi
jne 0x403937
movsx edx, word [0x44ab00]
xor esi, esi
shl edx, 2
mov edi, dword [ebp + 0x10]
movsx eax, si
mov ecx, eax
add eax, edx
mov eax, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and eax, dword [ebp + ecx - 0x1c]
inc esi
mov dword [ecx + edi], eax
cmp si, 4
jb 0x40395c
mov dword [ebp - 8], 0x44acc8
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403872
and dword [ebp - 4], 0
pop ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx - 0x1c6]
movzx ecx, word [ecx]
movsx esi, cx
movsx edi, ax
shl esi, 2
shl edi, 2
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ebx, [esi + eax]
mov ebx, dword [ebp + ebx*4 - 0x72c]
mov ecx, eax
add eax, edi
xor ebx, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and ebx, dword [ebp + ecx - 0x1c]
add edx, ecx
xor dword [edx], ebx
inc dword [ebp - 4]
cmp word [ebp - 4], 4
jb 0x4039af
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x403988
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ea7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
xor ecx, ecx
push esi
inc ecx
push edi
mov eax, ecx
xor edi, edi
mov esi, 0xe3
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ebf
cmp ax, cx
jne 0x403f01
mov eax, 0xe2
xor edi, edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ee5
jmp 0x403f22
push 0x71
pop edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
movzx eax, dx
mov edx, 0xe2
cmp di, dx
jl 0x403f04
mov eax, ecx
mov word [0x44ab00], ax
or eax, 0xffffffff
mov word [0x44acc6], ax
mov edi, ecx
mov dword [ebp - 8], 0x70
lea eax, [ecx + ecx]
cdq
mov ecx, esi
idiv ecx
movzx eax, dx
movsx ecx, ax
lea eax, [ecx + ecx]
mov edx, eax
neg edx
mov bx, word [ebp + edx - 0x10]
mov dx, word [ebp + edx - 0x14]
mov word [ebp - 0xe], dx
mov dx, word [ebp + eax - 0x1da]
mov ax, word [ebp + eax - 0x1d6]
mov word [ebp - 0xc], dx
xor edx, edx
mov word [ebp - 0x10], bx
mov word [ebp - 0xa], ax
mov dword [ebp - 4], edx
movsx eax, word [ebp - 4]
movzx eax, word [ebp + eax*2 - 0x10]
cmp ax, 0x71
jge 0x403fa3
movsx ebx, dx
imul ebx, ebx, 0xe3
add ebx, edi
mov word [ebx*2 + 0x44ab00], ax
inc edx
inc dword [ebp - 4]
cmp dx, 2
jl 0x403f80
inc edi
dec dword [ebp - 8]
jne 0x403f3c
push 0x70
pop ebx
xor eax, eax
push 0x10
mov word [0x44aae0], ax
pop eax
mov edx, eax
mov edi, 0xffff0000
mov esi, edi
and esi, ebx
je 0x403fd6
add word [0x44aae0], dx
mov ebx, esi
cdq
sub eax, edx
sar eax, 1
movzx edx, ax
movsx eax, dx
mov esi, edi
mov ecx, eax
shr esi, cl
xor edi, esi
test dx, dx
jne 0x403fc7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403ff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.0040383c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038fa
mov esi, dword [ebp + 0xc]
add esp, 0x18
push dword [ebp + 0x10]
xor edi, edi
cmp word [esi], di
je 0x404042
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004038fa
add esp, 0xc
jmp 0x404048
call fcn.004038aa
pop ecx
mov edx, dword [ebp + 0x10]
movsx eax, di
mov ecx, eax
mov eax, dword [esi + eax*4 + 0x14]
shl ecx, 2
xor eax, dword [ebp + ecx - 0x20]
add edx, ecx
xor dword [edx], eax
inc edi
cmp di, 4
jb 0x404048
pop edi
pop esi
leave
ret
Function at 0x41bdf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, 0x10
call esi
mov ecx, 1
mov byte [esp + 0xb], al
call esi
mov bl, al
mov al, byte [esp + 0xb]
cmp bl, al
mov byte [esp + 0xc], bl
ja 0x41be74
mov ecx, 1
call esi
cmp bl, al
je 0x41be4c
mov ecx, 2
call esi
cmp bl, al
je 0x41be4c
mov ecx, 9
call esi
cmp bl, al
je 0x41be4c
mov ecx, 0x10
call esi
cmp bl, al
mov ecx, 2
jne 0x41be51
mov ecx, 1
call esi
push eax
call fcn.0041b160
mov eax, dword [esp + 0xc]
push eax
call fcn.0041b800
add bl, 1
mov al, byte [esp + 0xb]
jb 0x41be7a
cmp bl, al
mov byte [esp + 0xc], bl
jbe 0x41be1b
pop esi
pop ebx
add esp, 8
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
Function at 0x41e2c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x409da6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401400
xor eax, eax
push 0x40ccd8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaAptOffset]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x78], eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push ecx
push edx
push 8
mov dword [ebp - 0x30], 1
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, 8
call edi
mov ecx, 1
mov byte [ebp - 0x68], al
call edi
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x68]
cmp byte [ebp - 0x14], al
ja 0x41e473
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x4c]
and edx, 0xff
push ecx
lea eax, [ebp - 0x28]
push edx
push eax
push 8
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x4c], 2
call dword [sym.imp.MSVBVM60.DLL___vbaStrFixstr]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x38]
call esi
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcMidCharBstr]
mov edx, eax
lea ecx, [ebp - 0x3c]
call esi
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x28]
push ecx
push edx
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaLsetFixstr]
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcAnsiValueBstr]
mov ecx, eax
call edi
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x38]
push ecx
push edx
push 2
mov byte [ebp - 0x34], al
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov ecx, 7
call edi
xor ecx, ecx
mov byte [ebp - 0x70], al
call edi
mov bl, al
mov al, byte [ebp - 0x70]
cmp bl, al
mov byte [ebp - 0x18], bl
ja 0x41e465
movsx esi, word [ebp - 0x30]
dec esi
cmp esi, 0x40
jb 0x41e404
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov eax, dword [ebp - 0x18]
and eax, 0xff
mov dword [ebp - 0x7c], eax
fild dword [ebp - 0x7c]
fstp qword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x84]
push ecx
push edx
push 0x40000000
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaPowerR8]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov dl, byte [ebp - 0x34]
mov ecx, dword [ebp - 0x78]
and al, dl
mov edx, dword [ecx + 0x4b1154]
neg al
sbb eax, eax
neg eax
neg eax
mov word [edx + esi*2], ax
mov ax, word [ebp - 0x30]
add ax, 1
jo 0x41e4b5
mov dword [ebp - 0x30], eax
mov al, 1
add al, bl
jb 0x41e4b5
jmp 0x41e3e8
mov cl, byte [ebp - 0x14]
mov al, 1
add al, cl
jb 0x41e4b5
jmp 0x41e34b
wait
push 0x41e4a2
jmp 0x41e498
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
Function at 0x41e4c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x409da6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401410
xor edi, edi
push 0x40ccd8
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x5c], edi
call dword [sym.imp.MSVBVM60.DLL___vbaAptOffset]
mov edx, 0x40d5bc
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x28], 1
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, 8
call esi
mov ecx, 1
mov byte [ebp - 0x68], al
call esi
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x68]
cmp byte [ebp - 0x18], al
ja 0x41e66b
mov ecx, 7
call esi
xor ecx, ecx
mov byte [ebp - 0x70], al
call esi
mov bl, al
mov byte [ebp - 0x1c], bl
cmp bl, byte [ebp - 0x70]
ja 0x41e609
movsx esi, word [ebp - 0x28]
dec esi
cmp esi, 0x40
jb 0x41e572
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx + 0x4b1268]
cmp word [edx + esi*2], 0
je 0x41e5de
mov eax, dword [ebp - 0x1c]
and eax, 0xff
mov dword [ebp - 0x80], eax
fild dword [ebp - 0x80]
fstp qword [ebp - 0x88]
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x88]
push ecx
push edx
push 0x40000000
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaPowerR8]
movsx eax, di
mov dword [ebp - 0x8c], eax
fild dword [ebp - 0x8c]
fstp qword [ebp - 0x94]
fadd qword [ebp - 0x94]
fnstsw ax
test al, 0xd
jne 0x41e6c0
call dword [sym.imp.MSVBVM60.DLL___vbaFpI2]
mov edi, eax
mov cx, word [ebp - 0x28]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
add cx, 1
mov al, 1
jo 0x41e6c5
add al, bl
mov dword [ebp - 0x28], ecx
jb 0x41e6c5
mov bl, al
mov byte [ebp - 0x1c], bl
jmp 0x41e559
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x3c]
movsx eax, di
push eax
push ecx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x5c], 8
call dword [sym.imp.MSVBVM60.DLL_rtcVarBstrFromAnsi]
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x4c]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaVarAdd]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x3c]
push edx
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
mov cl, byte [ebp - 0x18]
mov al, 1
add esp, 0xc
xor edi, edi
add al, cl
jb 0x41e6c5
jmp 0x41e537
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
wait
push 0x41e6ac
jmp 0x41e6a2
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
jmp 0x409dac
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
Function at 0x41e6d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x40ccd8
call dword [sym.imp.MSVBVM60.DLL___vbaAptOffset]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, 1
mov ebp, eax
call esi
mov bl, al
mov ecx, 8
mov byte [esp + 0x18], bl
call esi
mov ecx, 2
mov byte [esp + 0x14], al
call esi
mov ecx, 2
mov byte [esp + 0x15], al
call esi
mov cl, byte [esp + 0x14]
mov byte [esp + 0x13], al
cmp al, cl
ja 0x41e7e5
jmp 0x41e72a
mov al, byte [esp + 0x13]
movzx ax, al
mov esi, 7
mov word [esp + 0x16], ax
mov cx, si
imul cx, cx, 8
jo 0x41e8c5
add cx, word [esp + 0x16]
jo 0x41e8c5
movsx eax, cx
dec eax
cmp eax, 0x40
mov dword [esp + 0x1c], eax
jb 0x41e763
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov edi, dword [esp + 0x18]
and edi, 0xff
dec edi
cmp edi, 0x40
jb 0x41e779
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov edx, dword [ebp + 0x4b1154]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x4b1170]
mov dx, word [edx + ecx*2]
xor cx, cx
mov cl, bl
mov word [eax + edi*2], dx
add cx, 1
jo 0x41e8c5
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
sub si, 1
mov bl, al
jo 0x41e8c5
test si, si
mov byte [esp + 0x18], bl
jge 0x41e738
mov al, byte [esp + 0x15]
mov dl, byte [esp + 0x13]
mov cl, byte [esp + 0x14]
add al, dl
jb 0x41e8c5
cmp al, cl
mov byte [esp + 0x13], al
jbe 0x41e726
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, 7
call esi
mov ecx, 2
mov byte [esp + 0x14], al
call esi
mov ecx, 1
mov byte [esp + 0x15], al
call esi
mov cl, byte [esp + 0x14]
mov byte [esp + 0x13], al
cmp al, cl
ja 0x41e8bd
jmp 0x41e818
mov al, byte [esp + 0x13]
movzx ax, al
mov esi, 7
mov word [esp + 0x16], ax
mov cx, si
imul cx, cx, 8
jo 0x41e8c5
add cx, word [esp + 0x16]
jo 0x41e8c5
movsx eax, cx
dec eax
cmp eax, 0x40
mov dword [esp + 0x1c], eax
jb 0x41e851
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov edi, dword [esp + 0x18]
and edi, 0xff
dec edi
cmp edi, 0x40
jb 0x41e867
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov edx, dword [ebp + 0x4b1154]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x4b1170]
mov dx, word [edx + ecx*2]
xor cx, cx
mov cl, bl
mov word [eax + edi*2], dx
add cx, 1
jo 0x41e8c5
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
sub si, 1
mov bl, al
jo 0x41e8c5
test si, si
mov byte [esp + 0x18], bl
jge 0x41e826
mov al, byte [esp + 0x15]
mov dl, byte [esp + 0x13]
mov cl, byte [esp + 0x14]
add al, dl
jb 0x41e8c5
cmp al, cl
mov byte [esp + 0x13], al
jbe 0x41e814
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
Function at 0x41e8d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 0x40ccd8
call dword [sym.imp.MSVBVM60.DLL___vbaAptOffset]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, 0x40
mov ebp, eax
call esi
mov ecx, 1
mov byte [esp + 0xf], al
call esi
mov bl, al
mov al, byte [esp + 0xf]
cmp bl, al
mov byte [esp + 0x10], bl
ja 0x41e9a5
push edi
cmp bl, 0x21
jae 0x41e94b
mov eax, dword [esp + 0x14]
and eax, 0xff
lea esi, [eax - 1]
cmp esi, 0x40
jb 0x41e92a
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
cmp esi, 0x20
jb 0x41e935
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov ecx, dword [ebp + 0x4b1170]
mov edx, dword [ebp + 0x4b118c]
mov ax, word [ecx + esi*2]
mov word [edx + esi*2], ax
jmp 0x41e98f
mov esi, dword [esp + 0x14]
and esi, 0xff
dec esi
cmp esi, 0x40
jb 0x41e961
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
xor cx, cx
mov cl, bl
sub cx, 0x20
jo 0x41e9ac
movsx edi, cx
dec edi
cmp edi, 0x20
jb 0x41e97b
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov edx, dword [ebp + 0x4b1170]
mov eax, dword [ebp + 0x4b11a8]
mov cx, word [edx + esi*2]
mov word [eax + edi*2], cx
mov al, byte [esp + 0x13]
add bl, 1
jb 0x41e9ac
cmp bl, al
mov byte [esp + 0x14], bl
jbe 0x41e90e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x420c00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov ecx, dword [eax]
cmp ecx, edx
jne 0x420c8c
mov dx, word [eax + 4]
cmp dx, word [esi + 4]
jne 0x420c8c
mov cx, word [eax + 6]
cmp cx, word [esi + 6]
jne 0x420c8c
push edi
add eax, 8
push 8
lea edx, [esp + 0x10]
push eax
push edx
call fcn.0040e5c0
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call edi
add esi, 8
push 8
lea eax, [esp + 0x18]
push esi
push eax
call fcn.0040e5c0
call edi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp ecx, eax
pop edi
jne 0x420c8c
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp edx, eax
jne 0x420c8c
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
mov ax, bx
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x408322
pop dword [ebp - 0x10]
mov eax, 0x794cfcca
add eax, 0x86f38658
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x66d892be
sub dword [ebp - 0x20], 0x18864d73
mov dword [ebp - 0x1c], 0x5745e710
sub dword [ebp - 0x1c], 0x25129acb
mov dword [ebp - 0x18], 0x8c6a8018
sub dword [ebp - 0x18], 0x401e3bea
mov dword [ebp - 0x14], 0xc5b4800c
add dword [ebp - 0x14], 0x3a4b7ff4
lea eax, [ebp - 0x20]
push eax
mov eax, 0x1255da76
add eax, 0xedeaf5d6
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x5803f39
add dword [ebp - 0x20], 0x6ef22a1d
mov dword [ebp - 0x1c], 0x52f1ceef
sub dword [ebp - 0x1c], 0x11856d7a
mov dword [ebp - 0x18], 0xc6cc59fd
sub dword [ebp - 0x18], 0x635ced91
mov dword [ebp - 0x14], 0x278fa228
add dword [ebp - 0x14], 0xd8705dd8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xab61ce92
add eax, 0x54df01b6
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38523
push 0
call eax
mov ecx, 0xfb28a62b
sub ecx, 0xfb2862ab
xor ebx, ebx
add ebx, eax
mov edx, 0xdb0b54ae
add edx, 0x25365b52
add edx, dword [ebp - 0x10]
mov edi, 0x2fe84a21
add edi, 0xd859b280
add dword [ebp - 4], 0x4d924bc
mov esi, dword [edx]
add dword [ebp - 8], esi
sub esi, edi
add dword [ebp - 8], ecx
mov dword [ebx], esi
xor dword [ebp - 0xc], edx
add ebx, 0xbb7867e9
add ebx, 0x4487981b
add edx, 0xac2606a5
sub edx, 0xac2606a1
loop 0x408446
add eax, 0x100d3
xor ebx, ebx
add ebx, eax
add eax, 0xf7a91f60
add eax, 0x856e0a5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4015f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x66c
mov eax, dword [0x413004]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x468]
push edi
push 0x104
push eax
call fcn.00403230
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x474]
add esp, 0xc
push str..
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x40175a
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp word [esp + 0x3c], 0x2e
je 0x4016e2
push edi
lea eax, [esp + 0x264]
push 0x104
push eax
call fcn.00403230
add esp, 0xc
lea eax, [esp + 0x260]
push 0x41171c
push eax
call esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x264]
push eax
call esi
test byte [esp + 0x10], 0x10
je 0x4016bd
mov dl, 1
lea ecx, [esp + 0x260]
call fcn.004015f0
test eax, eax
jne 0x40175c
jmp 0x4016e2
push 0x80
lea eax, [esp + 0x264]
push eax
call ebx
test eax, eax
je 0x401734
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x401734
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x401662
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
jne 0x40175c
push 0x80
push edi
call ebx
test eax, eax
jne 0x40174f
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.004017a0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.004017a0
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40171d
xor eax, eax
mov ecx, dword [esp + 0x674]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004017a0
mov esp, ebp
pop ebp
ret
Function at 0x417a10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push str.CONOUT_
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
mov esi, eax
call edi
cmp eax, 7
jne 0x417a4b
push 1
call edi
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x417a73
mov ecx, dword [0x4c4a8c]
push 0x4c477c
push ecx
mov dword [0x4c1064], esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret