joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a42
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [section..data], eax
push 0x30
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push dword [section..data]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40186b
mov dword [ebp - 0x10], 6
mov dword [ebp - 8], str.xxxgerwegggfg
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [section..data]
push 0
push 0
push 0x190
push 0x258
push 0x64
push 0x64
push 0xcf0000
push str.dfgdfgd
push str.xxxgerwegggfg
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x403004], eax
push 1
push dword [0x403004]
call sub.user32.dll_ShowWindow
push dword [0x403004]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401b1a
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401af3
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x438bec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x438c22
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x438c15
cmp esi, ecx
jae 0x438d05
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x438c9b
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x45a278]
xor ecx, eax
or ecx, edx
jmp 0x438ceb
cmp edi, 6
jbe 0x438ceb
cmp edx, 4
jne 0x438ceb
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x438c34
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x439b1e
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, ecx
push ecx
lea esi, [edi + 4]
mov ecx, esi
call fcn.0040846d
test al, al
je 0x439b36
pop edi
xor al, al
pop esi
ret
push 0xc
call fcn.0043b1a7
pop ecx
push edi
push 0x439acf
mov ecx, eax
call fcn.00415a70
push eax
mov ecx, esi
call fcn.004084a6
mov ecx, esi
call fcn.00408402
pop edi
mov ecx, eax
pop esi
jmp fcn.00415c10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x435e10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
xor edi, edi
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push esi
mov dword [0x544b50], eax
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov ecx, dword [0x544b50]
mov edx, dword [0x544f34]
mov ebp, dword [esp + 0x20]
mov dword [0x544b4c], eax
lea ebx, [ecx - 1]
mov ecx, dword [0x544b58]
cmp ebx, edi
mov dword [esp + 0x14], ebx
jl 0x435ebc
mov eax, dword [edx + 0x14]
mov esi, ebp
sub esi, eax
mov edi, dword [ecx + 0x14]
mov eax, esi
xor ebp, ebp
shl eax, 4
add eax, esi
shl edi, 1
lea esi, [eax + eax*2]
shl esi, 1
inc ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [ecx + 0xc]
mov eax, ebp
sub eax, edi
add ebp, 2
mov ax, word [eax + ebx]
mov ebx, dword [edx + 0xc]
sub ax, 0x20
movsx eax, ax
add eax, ebx
xor ebx, ebx
mov bl, byte [eax + esi + 6]
mov eax, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
dec eax
mov dword [esp + 0x24], eax
jne 0x435e7f
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
sub esi, eax
xor edi, edi
test ebx, ebx
mov dword [esp + 0x28], esi
jl 0x435f95
jmp 0x435edc
mov ecx, dword [0x544b58]
mov esi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
mov eax, edi
sub eax, esi
mov ax, word [ecx + eax*2]
mov ecx, ebp
sub ax, 0x20
lea ebp, [esp + 0x18]
movsx esi, ax
mov eax, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, eax
push ebp
mov eax, ecx
push 0x3f800000
shl eax, 4
add eax, ecx
lea ecx, [eax + eax*2]
movsx eax, word [edx + ecx*2]
movsx ebp, word [edx + ecx*2 + 2]
lea ecx, [edx + ecx*2]
push ebp
push eax
imul eax, esi
movsx ecx, word [ecx + 4]
mov edx, dword [0x544b3c]
push ecx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
mov ebx, dword [edx]
push eax
push ecx
push 5
push edx
call dword [ebx + 0x7c]
test eax, eax
fnclex
jge 0x435f59
mov edx, dword [0x544b3c]
push 0x7c
push 0x42099c
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x544f34]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
sub ecx, dword [edx + 0x14]
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*2]
xor ecx, ecx
mov cl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add esi, ecx
inc edi
mov dword [esp + 0x28], esi
cmp edi, eax
jle 0x435ed6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x439140
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov edx, dword [0x544f34]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, ebp
push esi
mov eax, ecx
push edi
shl eax, 4
add eax, ecx
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
lea ebp, [eax + eax*2]
shl ebp, 1
lea eax, [edx + ebp]
mov edx, 1
mov ax, word [eax + 2]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
sub edi, eax
xor eax, eax
mov dword [esp + 0x28], ebx
mov al, byte [edi + edx]
mov ecx, edx
mov esi, eax
test esi, esi
je 0x4391dd
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov al, byte [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
xor ebx, ebx
add eax, ebp
mov bl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add esi, ebx
cmp ecx, eax
mov dword [esp + 0x28], esi
je 0x4391d9
inc ecx
xor eax, eax
mov al, byte [edi + ecx]
mov esi, eax
test esi, esi
jne 0x4391af
mov ebx, dword [esp + 0x10]
movsx eax, word [esp + 0x30]
cmp dword [esp + 0x28], eax
jle 0x439200
test ebx, ebx
jle 0x439200
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add esi, eax
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
cmp edx, ecx
jg 0x439222
xor eax, eax
mov al, byte [edi + edx]
mov esi, eax
mov eax, dword [esp + 0x18]
add esi, eax
xor eax, eax
mov al, byte [esi + ebp + 6]
add ebx, eax
inc edx
cmp edx, ecx
jle 0x439204
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x2c]
lea edx, [ecx + 1]
xor ecx, ecx
mov cl, byte [eax + 4]
cmp edx, ecx
jle 0x439191
mov ax, word [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x4425e0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401630
mov edx, dword [ebp + 0x10]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
call edi
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
call edi
mov eax, dword [ebp + 0xc]
or al, 0x66
movzx ecx, byte [eax]
Function at 0x478af0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x544b70]
push esi
push edi
xor eax, eax
lea edx, [ecx + ecx*4]
shl edx, 0xa
add edx, ecx
mov ecx, dword [0x544f48]
mov ecx, dword [ecx + edx*8 + 0x9ff8]
mov edx, dword [esp + 0xc]
mov esi, edx
mov edi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub esi, edi
pop edi
mov ecx, dword [ecx + esi*8 + 4]
pop esi
test ecx, ecx
jne 0x478b3d
push ecx
push ecx
push 8
push 7
push 1
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.00478a80
ret 8
cmp ecx, 4
je 0x478d71
cmp ecx, 6
je 0x478d71
cmp ecx, 9
je 0x478d59
cmp ecx, 0xa
je 0x478d59
cmp ecx, 0xd
je 0x478d41
cmp ecx, 0xe
je 0x478d41
cmp ecx, 0x12
je 0x478d41
cmp ecx, 0x13
je 0x478d41
cmp ecx, 0x17
je 0x478d29
cmp ecx, 0x18
je 0x478d29
cmp ecx, 0x1c
je 0x478d11
cmp ecx, 0x1d
je 0x478d11
cmp ecx, 0x1f
jne 0x478bc6
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0x28
push 2
push edx
push eax
call fcn.00478a80
ret 8
cmp ecx, 0x21
je 0x478cf9
cmp ecx, 0x22
je 0x478cf9
cmp ecx, 0x24
je 0x478ce1
cmp ecx, 0x25
je 0x478ce1
cmp ecx, 0x28
je 0x478cc9
cmp ecx, 0x29
je 0x478cc9
cmp ecx, 0x2c
je 0x478cc9
cmp ecx, 0x2d
je 0x478cc9
cmp ecx, 0x31
je 0x478cb1
cmp ecx, 0x32
je 0x478cb1
cmp ecx, 0x34
je 0x478c99
cmp ecx, 0x35
je 0x478c99
cmp ecx, 0x3a
jl 0x478c4c
cmp ecx, 0x3c
jg 0x478c4c
mov ecx, dword [esp + 8]
push 0x34
push 0x33
push 0x32
push 0x31
push 2
push edx
push ecx
call fcn.00478a80
ret 8
cmp ecx, 0x3f
je 0x478c81
cmp ecx, 0x40
je 0x478c81
cmp ecx, 0x44
je 0x478c81
cmp ecx, 0x45
je 0x478c81
cmp ecx, 0x47
jne 0x478d86
push 0
push 0
push 0x12
push 0x11
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.00478a80
ret 8
mov eax, dword [esp + 8]
push 0x39
push 0x38
push 0x37
push 0x36
push 2
push edx
push eax
call fcn.00478a80
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0x2d
push 2
push edx
push ecx
call fcn.00478a80
ret 8
push 0
push 0
push 0x3f
push 0x3e
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.00478a80
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0x3d
push 0x3c
push 2
push edx
push eax
call fcn.00478a80
ret 8
mov ecx, dword [esp + 8]
push 0x42
push 0x41
push 0x40
push 0x3b
push 2
push edx
push ecx
call fcn.00478a80
ret 8
push 0
push 0x1a
push 0x19
push 0x18
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.00478a80
ret 8
mov eax, dword [esp + 8]
push 0
push 0x21
push 0x20
push 0x1f
push 2
push edx
push eax
call fcn.00478a80
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0x15
push 0x14
push 2
push edx
push ecx
call fcn.00478a80
ret 8
push 0xf
push 0xe
push 0xd
push 0xc
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.00478a80
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0xc
push 2
push edx
push eax
call fcn.00478a80
ret 8
mov ecx, dword [esp + 8]
push 5
push 4
push 3
push 2
push 2
push edx
push ecx
call fcn.00478a80
ret 8
Function at 0x4ad3f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4032c8
fild dword [ebp + 8]
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x30]
mov edx, dword [0x544f48]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fdiv qword [0x4032c0]
rep stosd dword es:[edi], eax
mov eax, dword [0x544b70]
lea ecx, [eax + eax*4]
shl ecx, 0xa
add ecx, eax
lea esi, [edx + ecx*8]
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fadd qword [0x4023f0]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea edx, [ecx + ecx*2]
movzx di, byte [esi + edx*8 + 0xdf7]
add word [esi + eax*2 + 0xa88], di
lea edx, [esi + edx*8]
lea eax, [edx + 0xdf4]
movzx dx, byte [edx + 0xdf4]
mov byte [esi + ecx + 0x424], bl
lea ecx, [ebp - 0x30]
push ecx
add edx, 0x64
push eax
push 0x41e474
movsx edi, dx
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
call fcn.004ad5c0
push edi
call fcn.004b2500
mov edx, dword [0x545614]
mov eax, dword [0x54564c]
mov ecx, dword [0x545630]
mov dword [edx + edi*4 + 0x30], ebx
mov dword [eax + edi*4 + 0x30], ebx
mov dword [ecx + edi*4 + 0x30], ebx
call fcn.004b2980
push 0xffffffffffffffff
call fcn.00490030
wait
push 0x4ad4ed
lea edx, [ebp - 0x30]
push edx
push 0x41e474
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
ret
Function at 0x520280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4048e0
push 0x11
lea eax, [ebp - 0x28]
xor esi, esi
push 0x42a200
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov ebx, eax
mov dword [ebp - 0x34], ebx
fild dword [ebp - 0x34]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
fdiv qword [0x401510]
fstp qword [ebp - 0x50]
fild dword [ebp - 0x34]
fstp qword [ebp - 0x58]
fld qword [ebp - 0x58]
fdiv qword [0x401510]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
and eax, 0x80000001
jns 0x520308
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x5c], eax
fild dword [ebp - 0x5c]
fstp qword [ebp - 0x64]
fld qword [ebp - 0x50]
fsub qword [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
push 4
mov dword [ebp - 0x3c], eax
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041faf4
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
xor dl, byte [eax + 2]
add ecx, ebx
mov al, byte [ecx]
xor al, dl
mov byte [ecx], al
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
sub ecx, esi
mov dl, byte [ecx + ebx - 1]
mov ecx, dword [ebp - 0x1c]
xor dl, byte [ecx + 3]
mov cl, byte [eax + esi + 1]
xor cl, dl
mov byte [eax + esi + 1], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov edx, eax
sub edx, esi
mov cl, byte [edx + ebx]
mov dl, byte [eax + esi]
xor cl, dl
mov edx, dword [ebp - 0x1c]
xor cl, byte [edx]
mov byte [eax + esi], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi + 1]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
add esi, 2
xor dl, byte [eax + 1]
mov al, byte [ecx + ebx - 1]
lea ecx, [ecx + ebx - 1]
xor al, dl
mov byte [ecx], al
mov eax, dword [ebp - 0x38]
cmp esi, eax
jne 0x52033f
wait
push 0x5203e9
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push edx
push 0
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x538e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x405050
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x54699c]
lea ecx, [ebp - 0x18]
push eax
push ecx
call ebx
mov ecx, dword [ebp - 0x18]
push 1
movsx eax, word [0x5469a0]
mov edx, dword [ecx + 0x14]
mov edi, dword [ecx + 0xc]
sub eax, edx
lea esi, [eax + eax*2]
shl esi, 5
add esi, edi
inc word [esi + 0x34]
mov ax, word [esi + 0x34]
movsx edx, ax
push edx
lea edi, [esi + 0x30]
push 1
push 0x41f608
push edi
push 0x10
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaRedimPreserve]
mov eax, dword [edi]
add esp, 0x1c
lea ecx, [ebp - 0x14]
push eax
push ecx
call ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
movsx edx, word [esi + 0x34]
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
sub edx, esi
push ecx
shl edx, 4
add edx, ebx
push edx
call fcn.00538bd0
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x14]
push eax
call esi
lea ecx, [ebp - 0x18]
push ecx
call esi
push 0x538ef1
jmp 0x538ee6
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
ret
Function at 0x4013d3
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
mov dword [esp + 8], 0x405070
movzx eax, bp
mov dword [esp + 4], eax
mov eax, dword [0x406008]
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceW
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x401418
mov dword [esp + 8], ebp
mov dword [esp + 4], str.FindResource__i__failed
mov dword [esp], 1
jmp 0x401481
mov dword [esp + 4], eax
mov eax, dword [0x406008]
mov dword [esp], eax
call sub.KERNEL32.dll_LoadResource
push esi
push esi
mov esi, eax
test eax, eax
jne 0x401446
mov dword [esp + 8], ebp
mov dword [esp + 4], str.LoadResource__i__failed
mov dword [esp], 2
jmp 0x401481
mov dword [esp + 4], ebx
mov eax, dword [0x406008]
mov dword [esp], eax
call sub.KERNEL32.dll_SizeofResource
push ecx
push ecx
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_LockResource
push edx
mov ebx, eax
test edi, edi
je 0x40146e
test eax, eax
jne 0x40148d
mov dword [esp + 8], ebp
mov dword [esp + 4], str.LoadResource__i__failed
mov dword [esp], 3
call fcn.00401330
mov ebx, eax
jmp 0x40155e
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileW
sub esp, 0x1c
mov esi, eax
lea eax, [eax - 1]
cmp eax, 0xfffffffd
jbe 0x4014ef
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 4], str.CreateFile__s__failed
mov dword [esp], 4
jmp 0x401481
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x401526
xor ebx, ebx
cmp dword [esp + 0x28], edi
je 0x401544
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteFile__s__failed
mov dword [esp], 5
call fcn.00401330
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
push esi
test ebx, ebx
je 0x40155e
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileW
push ecx
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401650
Capabilities:
Get token membership

Disassembly:
sub esp, 0x3c
xor eax, eax
cmp dword [0x404004], 5
jbe 0x401727
mov byte [esp + 0x2e], 0
mov byte [esp + 0x2f], 0
mov byte [esp + 0x30], 0
mov byte [esp + 0x31], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x33], 5
lea eax, [esp + 0x34]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
lea eax, [esp + 0x2e]
mov dword [esp], eax
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
sub esp, 0x2c
mov dword [esp + 0x38], eax
test eax, eax
je 0x40171f
lea eax, [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.ADVAPI32.DLL_CheckTokenMembership
sub esp, 0xc
test eax, eax
jne 0x401712
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_FreeSid
push eax
cmp dword [esp + 0x38], 0
setne al
add esp, 0x3c
ret
Function at 0x402c30
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00402c10
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x50]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x402cbb
movzx eax, byte [ebx]
cmp al, 0x20
je 0x402d26
cmp al, 9
je 0x402d26
cmp al, 0x22
je 0x402d00
cmp al, 0x20
mov edx, eax
je 0x402cad
cmp al, 9
je 0x402d1a
test al, al
jne 0x402ca2
nop
jmp 0x402cbb
cmp dl, 9
je 0x402d1a
test dl, dl
lea esi, [esi]
je 0x402cbb
add ebx, 1
movzx edx, byte [ebx]
cmp dl, 0x20
jne 0x402c92
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x402cad
cmp al, 9
je 0x402cad
test byte [ebp - 0x24], 1
mov esi, 0xa
je 0x402cca
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401aa6
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 1
movzx edx, byte [ebx]
cmp dl, 0x22
je 0x402d0f
test dl, dl
jne 0x402d00
cmp dl, 0x22
jne 0x402d1a
add ebx, 1
movzx edx, byte [ebx]
cmp dl, 0x20
je 0x402cad
cmp dl, 9
jne 0x402cbb
jmp 0x402cad
add ebx, 1
lea esi, [esi]
jmp 0x402c61
Function at 0x40b650
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1008
call fcn.004121f0
mov eax, dword [0x41c1e4]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
mov esi, dword [esp + 0x1018]
lea eax, [esp + 8]
push edi
mov edi, ecx
push 0x1000
push 0
push eax
mov byte [edi + 0x198], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push 0x800
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b6a6
sub eax, edx
sar eax, 1
mov eax, 0
setne al
push eax
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esp + 0x100c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00411ed7
add esp, 0x1008
ret 0x10