joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + 0x40fffffc], esi
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00404881
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404836
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00404881
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404836
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00404881
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404836
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00404871
ja 0x4052d6
sar ah, 0xff
invalid
mov word [ebx], fs
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.00404881
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404836
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.00404871
rcl dword [ecx], cl
sbb ah, byte [eax + eax*4 - 0x5b]
pushfd
stc
invalid
Function at 0x406883
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x380], 0xffffffff
je 0x4068bb
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
invalid
mov ch, 0x80
cld
invalid

Function at 0x406bfa
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4098b8
mov ebx, 0x45b2d8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x406c48
push 1
push ebp
push edi
call fcn.00405fb0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406dc3
cmp eax, esi
jg 0x406dc3
push esi
mov edi, 0x460930
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406dc3
cmp eax, esi
jg 0x406dc3
push ebp
push ebp
push esi
push 0x45bad8
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406dc3
push ebp
push ebp
push esi
mov esi, 0x45c128
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406dc3
push esi
push 0x45bad8
push str._s_s_r_n
push 0x45c528
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x472ddc]
push dword [eax + 0x128]
push edi
call fcn.00406966
push 4
push 0xc0000000
push edi
call fcn.00405fb0
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x406dc3
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406db9
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406db9
cmp edi, dword [esp + 0x10]
jne 0x406db9
push str._Rename__r_n
push esi
call fcn.00405f16
cmp eax, ebp
jne 0x406d4c
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406d81
push 0x4098ac
add eax, 0xa
push eax
call fcn.00405f16
mov ebp, eax
test ebp, ebp
je 0x406d7f
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x406d76
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406d6c
sub ebp, esi
lea eax, [ebp + 1]
xor ebp, ebp
jmp 0x406d83
xor ebp, ebp
mov eax, edi
push ebx
push 0x45c528
add eax, esi
push eax
call fcn.00405f6c
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4097b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x409580
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00414003
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xfd51fe2
jmp 0x409810
mov dword [ebp - 0x10], 0xb52a08c2
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cmp eax, 0x4bda1a0a
jg 0x409830
cmp eax, 0xb52a08c1
jg 0x409840
cmp eax, 0x8776e255
jne 0x409810
jmp 0x409804
cmp eax, 0x4bda1a0b
jne 0x409810
jmp 0x409921
cmp eax, 0xc0a7af5c
jg 0x409857
cmp eax, 0xb52a08c2
jne 0x409810
mov dword [ebp - 0x10], 0x59c1371
jmp 0x409810
cmp eax, 0xf917f591
jg 0x40987d
cmp eax, 0xc0a7af5d
jne 0x409810
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0x4bda1a0b
jmp 0x409810
cmp eax, 0xfad93c36
jg 0x409897
cmp eax, 0xf917f592
jne 0x409810
mov dword [ebp - 0x10], 0xb52a08c2
jmp 0x409810
cmp eax, 0x59c1370
jg 0x4098c1
cmp eax, 0xfad93c37
jne 0x409810
mov eax, 0xc0a7af5d
cmp dword [ebp - 0xc], 0
jne 0x4098b9
mov eax, 0x4bda1a0b
mov dword [ebp - 0x10], eax
jmp 0x409810
cmp eax, 0x59c1371
je 0x4098f2
cmp eax, 0xf17adae
jne 0x4098fe
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x10], 0xfad93c37
jmp 0x409810
mov dword [ebp - 0x10], 0xfad93c37
jmp 0x409810
cmp eax, 0xfd51fe2
jne 0x409810
mov eax, 0xf917f592
cmp dword [ebp - 4], 0
je 0x409919
mov eax, 0xf17adae
mov dword [ebp - 0x10], eax
jmp 0x409810
add esp, 0x28
pop ebp
ret
Function at 0x40d370
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [0x40e194]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x9788d281
jmp 0x40d3c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x41d11c], eax
call fcn.00413a6f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xdfbf5b07
nop
nop
nop
mov eax, dword [ebp - 0x24]
cmp eax, 0x6b650db2
jg 0x40d3f0
cmp eax, 0x9788d280
jg 0x40d400
cmp eax, 0x840b7330
jne 0x40d3c0
mov dword [ebp - 0x24], 0xfb05f67e
jmp 0x40d3c0
cmp eax, 0x6b650db3
jne 0x40d3c0
jmp 0x40d3a3
cmp eax, 0x225982d1
jg 0x40d48f
cmp eax, 0x1e0dca8e
jg 0x40d49c
cmp eax, 0xfb05f67d
jg 0x40d4ba
cmp eax, 0xdfbf5b06
jg 0x40d519
cmp eax, 0x9788d281
je 0x40d526
cmp eax, 0x97ccddcb
jne 0x40d53e
mov dword [esp], 0
call fcn.0040d570
mov esi, eax
call fcn.00402690
imul eax, esi
mov dword [esp], eax
call fcn.00413a92
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00404d70
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0xfb05f67e
jmp 0x40d3c0
cmp eax, 0x225982d2
jne 0x40d3c0
jmp 0x40d4a7
cmp eax, 0x1e0dca8f
jne 0x40d3c0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0xdfbf5b07
jmp 0x40d3c0
cmp eax, 0xfb05f67e
jne 0x40d3c0
mov dword [esp], 0
call fcn.0040d570
mov esi, eax
call fcn.00402690
imul eax, esi
mov dword [esp], eax
call fcn.00413a92
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00404d70
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
sete byte [ebp - 9]
mov dword [ebp - 0x24], 0xd405b21d
jmp 0x40d3c0
cmp eax, 0xdfbf5b07
jne 0x40d3c0
jmp 0x40d562
mov eax, 0x1e0dca8f
cmp dword [ebp - 0x10], 0
je 0x40d536
mov eax, 0x840b7330
mov dword [ebp - 0x24], eax
jmp 0x40d3c0
cmp eax, 0xd405b21d
jne 0x40d3c0
mov al, byte [ebp - 9]
test al, al
mov eax, 0x6b650db3
jne 0x40d55a
mov eax, 0x225982d2
mov dword [ebp - 0x24], eax
jmp 0x40d3c0
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop esi
pop edi
pop ebp
ret
Function at 0x41baaa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00418907
mov dword [ebp - 0x14], eax
cmp dword [0x465588], edi
jne 0x41bb9b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41bb28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41bc7b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41bc7b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41bc7b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x465588], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x46558c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x465590], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465598], eax
test eax, eax
je 0x41bb98
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465594], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41bbc0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41bbb3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41bbd5
push 4
pop eax
jmp 0x41bc7d
cmp dword [ebp - 0x14], edi
je 0x41bbd5
push dword [0x465588]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41bbba
mov eax, dword [0x465594]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41bc33
cmp dword [0x465598], esi
je 0x41bc33
push eax
call ebx
push dword [0x465598]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41bc33
test eax, eax
je 0x41bc33
call ecx
test eax, eax
je 0x41bc28
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41bc28
test byte [ebp - 8], 1
jne 0x41bc33
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41bc63
mov eax, dword [0x46558c]
cmp eax, esi
je 0x41bc60
push eax
call ebx
test eax, eax
je 0x41bc60
call eax
mov edi, eax
test edi, edi
je 0x41bc60
mov eax, dword [0x465590]
cmp eax, esi
je 0x41bc60
push eax
call ebx
test eax, eax
je 0x41bc60
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x465588]
call ebx
test eax, eax
je 0x41bc7b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41bc7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415a19
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x453232f6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x20bd3bb4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40265c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x40271d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40271d
mov eax, dword [0x457200]
lea edi, [ebx + 0x14]
and dword [edi], 0
and eax, 1
push edi
push 0x448c5c
push eax
push 0
push 0x448bbc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x402722
mov edx, eax
mov ecx, edi
call fcn.00410c23
test eax, eax
js 0x402722
mov ecx, dword [edi]
lea eax, [ebx + 0x10]
push eax
push 0x4486bc
push ecx
mov edx, dword [ecx]
call dword [edx]
test eax, eax
js 0x402722
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x194]
cmp eax, 1
jne 0x4026e0
mov eax, 0x80004005
jmp 0x402722
test eax, eax
js 0x402722
mov eax, dword [edi]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb8]
cmp eax, 1
jne 0x402700
lea eax, [ebx - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x4026d9
test eax, eax
js 0x402722
mov ecx, dword [0x4588d0]
test ecx, ecx
je 0x402719
mov ecx, dword [ecx]
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
mov dword [ebx + 0x48], eax
xor eax, eax
jmp 0x402722
mov eax, 0x80070057
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40363e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4218
call fcn.0044471d
mov eax, dword [0x4570cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov byte [ebp - 0x4215], 0
mov byte [ebp - 0x4216], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x4036a2
mov esi, 0x448d40
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x403688
inc ecx
cmp ecx, 0xb
jne 0x403677
jmp 0x40369e
mov esi, str._Embedding
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x4036a2
inc ecx
cmp ecx, 0xb
jne 0x40368f
mov bl, 1
jmp 0x4036a4
xor bl, bl
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4037bd
mov byte [ebp - 0x4216], 1
test bl, bl
je 0x4036cc
call fcn.00407738
test eax, eax
js 0x403848
call fcn.00402fac
mov byte [ebp - 0x4215], 1
mov dword [0x458900], 1
mov dword [0x4588f8], edi
test bl, bl
je 0x4036f6
call fcn.004031f2
jmp 0x4037bd
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
lea eax, [ebp - 0x20c]
mov ebx, esi
push ebx
push 0x448d24
push 0xffffffffffffffff
push 0x104
push eax
call fcn.00402c5d
mov eax, 0x409
add esp, 0x14
cmp si, ax
je 0x403743
push 0xffffffffffffffff
push str._1033
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
push ecx
lea edx, [ebp - 0x20c]
mov ecx, edi
call fcn.004032b9
mov edi, eax
test edi, edi
je 0x4037a9
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x2210]
push 0x1001
push eax
push 0x8062
push edi
call esi
push 0x1001
lea eax, [ebp - 0x4214]
push eax
push 0x8063
push edi
call esi
mov ecx, ebx
call fcn.00402f3e
xor ecx, ecx
mov edx, 0x180000
test eax, eax
lea eax, [ebp - 0x2210]
cmovne ecx, edx
push ecx
push eax
lea eax, [ebp - 0x4214]
push eax
jmp 0x4037b5
push 0
push str.Microsoft_Office
push str.This_program_can_only_run_from_within_another_program.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [0x4588e8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x4588d0]
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test esi, esi
je 0x4037e2
call fcn.0040771c
push esi
call ebx
pop ecx
and dword [0x4588d0], 0
call fcn.00401fe7
mov edi, eax
test edi, edi
je 0x40382b
mov ecx, dword [edi]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [edi]
mov dword [ecx + 4], ecx
and dword [edi + 4], 0
cmp eax, dword [edi]
je 0x40381b
mov esi, dword [eax]
xor edx, edx
push 0xc
inc edx
mov ecx, eax
call fcn.00401f2f
mov eax, esi
cmp esi, dword [edi]
jne 0x403807
mov ecx, dword [edi]
xor edx, edx
push 0xc
inc edx
call fcn.00401f2f
push edi
call ebx
pop ecx
cmp byte [ebp - 0x4215], 0
je 0x403839
call fcn.0040df90
cmp byte [ebp - 0x4216], 0
je 0x403848
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004429bf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x408cb5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444d2f
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4570cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, 0x104
lea eax, [ebp - 0x21c]
push esi
push eax
push 0x449448
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x408d09
mov al, 1
jmp 0x408db7
cmp eax, esi
jae 0x408db5
and dword [ebp - 0x220], 0
and dword [ebp - 4], 0
push 8
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x408d34
call fcn.00403dde
mov dword [ebp - 0x224], esi
mov byte [ebp - 4], 2
push 0x84
mov dword [esi], 0x449434
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
test eax, eax
je 0x408d2f
mov ecx, eax
call fcn.00408aec
mov dword [esi + 4], eax
test eax, eax
je 0x408d6b
add eax, 8
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
push ecx
mov ecx, esi
mov dword [ebp - 0x220], esi
call fcn.00408e26
mov dword [0x4588fc], esi
jmp 0x408d02
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004429bf
mov esp, ebp
pop ebp
ret

Function at 0x40a018
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x444ecb
call fcn.004443c9
mov ebx, ecx
mov esi, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
mov eax, dword [esi + 8]
mov edi, dword [eax + 8]
lea eax, [ebx + 0x58]
push eax
mov dword [ebp + 8], edi
call fcn.0040a40c
and dword [ebp - 4], 0
lea ecx, [ebx + 0x3c]
mov eax, dword [ebx + 0x70]
mov dword [edi + 8], eax
inc dword [ebx + 0x70]
push dword [edi + 8]
call fcn.00404084
push esi
mov ecx, eax
call fcn.0040a4b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a3ea
push 5
pop ecx
lea eax, [esi + 0xc]
mov esi, 0x4494b8
push eax
mov edi, eax
mov eax, dword [ebp + 8]
push 0
rep movsd dword es:[edi], dword [esi]
push dword [eax + 0xc]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40a0a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40a0a3
call fcn.00404969
call fcn.0044439d
ret 4
Function at 0x40a0ff
Capabilities:
Read file on windows

Disassembly:
push 4
mov eax, 0x444eee
call fcn.004443c9
mov ebx, ecx
cmp byte [ebx + 0x21], 0
jne 0x40a1d4
cmp dword [ebp + 8], 0x10
jne 0x40a2e3
mov eax, dword [ebx + 0x80]
cmp eax, 0x10
jb 0x40a2e3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x40a159
mov eax, dword [ebx + 0x24]
test eax, eax
sete cl
test cl, cl
jne 0x40a156
and dword [ebx + 0x24], 0
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov dword [ebx + 0x24], esi
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jne 0x40a165
call fcn.004047f0
push dword [ebp + 8]
mov edx, dword [ebx + 0x80]
lea eax, [ebx + 0x74]
push eax
call fcn.00402b40
mov edx, dword [ebx + 0x80]
pop ecx
pop ecx
cmp edx, dword [ebp + 8]
je 0x40a1d4
push 5
pop ecx
lea eax, [ebx + 0x28]
mov word [ebx + 0x20], 0x101
push eax
mov edi, eax
mov esi, 0x4494b8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x24]
lea eax, [ebp + 8]
push eax
lea eax, [edx - 0x10]
push eax
lea eax, [ecx + 0x10]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a2e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40a2e3
mov byte [ebx + 0x20], 0
call fcn.00404969
lea edi, [ebx + 0x24]
mov ecx, dword [edi]
test ecx, ecx
sete al
test al, al
je 0x40a1ee
push 0
push 0x8c2697
call fcn.00406370
test dword [ecx + 4], 0x2000000
je 0x40a253
mov eax, ecx
test eax, eax
je 0x40a1e2
push dword [eax + 0xc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x40a212
call fcn.00403dde
mov eax, dword [edi]
test eax, eax
je 0x40a1e2
push dword [eax + 0xc]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp dword [ebx + 0x18], 0
je 0x40a241
push 0
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
test esi, esi
je 0x40a2cb
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x40a2cb
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x7c]
mov ecx, ebx
call fcn.0040a392
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x40a2bc
mov ecx, dword [edi]
test ecx, ecx
sete al
test al, al
jne 0x40a1e2
test byte [ecx + 7], 1
je 0x40a29f
test ecx, ecx
sete al
test al, al
jne 0x40a1e2
mov ecx, dword [ecx]
test ecx, ecx
js 0x40a2b4
mov ecx, 0x8007000d
jmp 0x40a2b4
mov ecx, dword [esi + 8]
push edi
mov eax, dword [ecx]
call dword [eax + 0xc]
xor ecx, ecx
mov edx, 0x8007000d
test al, al
cmove ecx, edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40a2cb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [edi]
test eax, eax
je 0x40a2dc
and dword [edi], 0
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, ebx
call fcn.0040a0ab
call fcn.0044439d
ret 4