joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fd64
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416a4c]
call fcn.00405678
xor eax, eax
push ebp
push 0x46fea8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47f080], 0
jne 0x46fdb7
mov ecx, dword [0x47f164]
mov dl, 1
mov eax, dword [0x4082e0]
call fcn.0040d590
call fcn.00404658
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403644
mov eax, ebx
call fcn.004054dc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46feb8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004068a4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004054ec
test eax, eax
jle 0x46fe4f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46fe48
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404edc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404ec4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004091d4
test eax, eax
jne 0x46fe48
mov ebx, 0x15
jmp 0x46fe54
mov ebx, 0x10
jmp 0x46fe54
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x47f080]
call fcn.0046fcbc
mov eax, dword [ebp - 8]
call fcn.0046fcbc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004068bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46feaf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404c68
lea eax, [ebp - 0x10]
mov edx, dword [0x416a4c]
call fcn.00405748
ret
Function at 0x401102
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x234], eax
xor ebx, ebx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x210], ebx
push eax
push 0x20119
push ebx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4012d9
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4012d9
xor esi, esi
mov dword [ebp - 0x230], ebx
test eax, eax
je 0x4012c9
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4012b6
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4012b6
push dword [ebp - 0x234]
push ecx
mov ecx, dword [ebp - 0x22c]
call fcn.0040226e
pop ecx
pop ecx
test eax, eax
jne 0x4012ac
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00401351
push 0x41735c
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00402967
mov ecx, eax
call fcn.004010b0
lea ecx, [ebp - 0x24c]
mov bl, al
call fcn.0040177e
test bl, bl
jne 0x4012ac
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00401351
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00402967
push eax
mov ecx, 0x41736c
call fcn.004010d9
lea ecx, [ebp - 0x24c]
mov bl, al
call fcn.0040177e
mov eax, dword [ebp - 0x230]
xor ecx, ecx
inc ecx
movzx eax, al
test bl, bl
cmove eax, ecx
mov dword [ebp - 0x230], eax
jmp 0x4012b2
mov eax, dword [ebp - 0x230]
test al, al
jne 0x4012c3
inc esi
cmp esi, dword [ebp - 0x210]
jb 0x40119c
mov ebx, dword [ebp - 0x230]
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x4012db
xor al, al
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b42
leave
ret

Function at 0x401783
Capabilities:
Terminate process

Disassembly:
push 0x64
mov eax, 0x40e817
call fcn.0040e198
mov esi, edx
push ecx
lea ecx, [ebp - 0x70]
call fcn.00401b34
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
mov edx, eax
mov dword [esp], 0x413d18
call fcn.00401b99
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00401c9a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
mov edx, eax
mov dword [esp], 0x413d14
call fcn.00401b99
pop ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00402425
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.0040177e
lea ecx, [ebp - 0x40]
call fcn.0040177e
lea ecx, [ebp - 0x58]
call fcn.0040177e
lea ecx, [ebp - 0x70]
call fcn.0040177e
test bl, bl
jne 0x40180c
call fcn.0040e183
ret
push 0
call fcn.004065f9
int3
Function at 0x40226e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
mov ebx, ecx
mov dword [ebp - 8], 1
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push str.JavaHome
push ebx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4022f3
mov eax, dword [ebp - 0xc]
xor ecx, ecx
push esi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402b91
pop ecx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push str.JavaHome
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4022f2
push esi
mov ecx, edi
call fcn.00402643
push esi
call fcn.00402b9a
pop ecx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00402b42
leave
ret

Function at 0x402390
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea ecx, [ebp - 0x18]
push ebx
push esi
push edi
mov ebx, 0x104
mov edi, edx
mov esi, ebx
call fcn.00401b23
push eax
mov ecx, edi
call fcn.0040264c
lea ecx, [ebp - 0x18]
call fcn.0040177e
push ecx
push ebx
mov ecx, edi
call fcn.0040261f
push ebx
push ecx
mov ecx, edi
call fcn.00402958
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
push str.JAVA_HOME
call ebx
cmp eax, esi
jne 0x402402
push ecx
add esi, 0x104
mov ecx, edi
push esi
call fcn.0040261f
push esi
push ecx
mov ecx, edi
call fcn.00402958
push eax
push str.JAVA_HOME
call ebx
cmp eax, esi
je 0x4023de
test eax, eax
jne 0x40240e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402420
add eax, 0xfffffefc
push ecx
add eax, esi
mov ecx, edi
push eax
call fcn.0040261f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402425
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
lea ecx, [ebp - 0x78]
call fcn.00402684
push 0x44
pop eax
push eax
mov dword [ebp - 0x60], eax
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00404790
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00404790
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push ecx
lea ecx, [ebp - 0x78]
call fcn.00402958
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
lea ecx, [ebp - 0x78]
setne bl
call fcn.0040177e
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b42
leave
ret
Function at 0x40253f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x416004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x10], edx
mov ebx, ecx
call fcn.00402262
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4025fa
push edi
call fcn.00402b91
pop ecx
mov esi, eax
mov ecx, ebx
push esi
push edi
push 0
call fcn.00402262
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4025f3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x414068
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4025f3
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + 0xa]
mov dword [ebp - 0x20], eax
movzx eax, word [ecx + 8]
mov dword [ebp - 0x1c], eax
movzx eax, word [ecx + 0xe]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040260b
lea ecx, [ebp - 0x38]
push dword [eax + 4]
push dword [eax]
call fcn.00402836
mov edi, dword [ebp - 0x10]
mov esi, eax
mov al, 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x4025fc
push esi
call fcn.00402b9a
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b42
leave
ret
Function at 0x436fc0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
xor edi, edi
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push esi
mov dword [0x54eb54], eax
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov ecx, dword [0x54eb54]
mov edx, dword [0x54ef54]
mov ebp, dword [esp + 0x20]
mov dword [0x54eb50], eax
lea ebx, [ecx - 1]
mov ecx, dword [0x54eb5c]
cmp ebx, edi
mov dword [esp + 0x14], ebx
jl 0x43706c
mov eax, dword [edx + 0x14]
mov esi, ebp
sub esi, eax
mov edi, dword [ecx + 0x14]
mov eax, esi
xor ebp, ebp
shl eax, 4
add eax, esi
shl edi, 1
lea esi, [eax + eax*2]
shl esi, 1
inc ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [ecx + 0xc]
mov eax, ebp
sub eax, edi
add ebp, 2
mov ax, word [eax + ebx]
mov ebx, dword [edx + 0xc]
sub ax, 0x20
movsx eax, ax
add eax, ebx
xor ebx, ebx
mov bl, byte [eax + esi + 6]
mov eax, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
dec eax
mov dword [esp + 0x24], eax
jne 0x43702f
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
sub esi, eax
xor edi, edi
test ebx, ebx
mov dword [esp + 0x28], esi
jl 0x437145
jmp 0x43708c
mov ecx, dword [0x54eb5c]
mov esi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
mov eax, edi
sub eax, esi
mov ax, word [ecx + eax*2]
mov ecx, ebp
sub ax, 0x20
lea ebp, [esp + 0x18]
movsx esi, ax
mov eax, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, eax
push ebp
mov eax, ecx
push 0x3f800000
shl eax, 4
add eax, ecx
lea ecx, [eax + eax*2]
movsx eax, word [edx + ecx*2]
movsx ebp, word [edx + ecx*2 + 2]
lea ecx, [edx + ecx*2]
push ebp
push eax
imul eax, esi
movsx ecx, word [ecx + 4]
mov edx, dword [0x54eb40]
push ecx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
mov ebx, dword [edx]
push eax
push ecx
push 5
push edx
call dword [ebx + 0x7c]
test eax, eax
fnclex
jge 0x437109
mov edx, dword [0x54eb40]
push 0x7c
push 0x420b44
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x54ef54]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
sub ecx, dword [edx + 0x14]
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*2]
xor ecx, ecx
mov cl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add esi, ecx
inc edi
mov dword [esp + 0x28], esi
cmp edi, eax
jle 0x437086
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x43a340
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov edx, dword [0x54ef54]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, ebp
push esi
mov eax, ecx
push edi
shl eax, 4
add eax, ecx
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
lea ebp, [eax + eax*2]
shl ebp, 1
lea eax, [edx + ebp]
mov edx, 1
mov ax, word [eax + 2]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
sub edi, eax
xor eax, eax
mov dword [esp + 0x28], ebx
mov al, byte [edi + edx]
mov ecx, edx
mov esi, eax
test esi, esi
je 0x43a3dd
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov al, byte [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
xor ebx, ebx
add eax, ebp
mov bl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add esi, ebx
cmp ecx, eax
mov dword [esp + 0x28], esi
je 0x43a3d9
inc ecx
xor eax, eax
mov al, byte [edi + ecx]
mov esi, eax
test esi, esi
jne 0x43a3af
mov ebx, dword [esp + 0x10]
movsx eax, word [esp + 0x30]
cmp dword [esp + 0x28], eax
jle 0x43a400
test ebx, ebx
jle 0x43a400
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add esi, eax
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
cmp edx, ecx
jg 0x43a422
xor eax, eax
mov al, byte [edi + edx]
mov esi, eax
mov eax, dword [esp + 0x18]
add esi, eax
xor eax, eax
mov al, byte [esi + ebp + 6]
add ebx, eax
inc edx
cmp edx, ecx
jle 0x43a404
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x2c]
lea edx, [ecx + 1]
xor ecx, ecx
mov cl, byte [eax + 4]
cmp edx, ecx
jle 0x43a391
mov ax, word [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x440e70
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401628
mov edx, dword [ebp + 0x10]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor edi, edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
call esi
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x24]
call esi
mov eax, dword [ebp + 0xc]
movzx cx, byte [eax]
cmp word [0x550214], cx
je 0x44387e
call fcn.0044d750
mov bx, word [0x55024c]
cmp bx, di
je 0x440f72
mov ecx, dword [0x550208]
xor bx, bx
mov word [0x55024c], bx
mov edx, 1
mov eax, 8
cmp edx, eax
jg 0x440f4e
mov esi, dword [ecx + 0x14]
mov eax, edx
sub eax, esi
mov esi, dword [ecx + 0xc]
lea eax, [eax + eax*2]
shl eax, 4
mov word [eax + esi + 0x1c], di
mov esi, dword [ecx + 0x14]
mov eax, edx
sub eax, esi
mov esi, dword [ecx + 0xc]
lea eax, [eax + eax*2]
shl eax, 4
cmp dword [eax + esi + 0xc], edi
jle 0x440f3f
or bx, 0xffff
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, 1
add edx, eax
jmp 0x440f07
cmp bx, di
mov word [0x55024c], bx
je 0x440f72
fld dword [0x550250]
fsub dword [0x550254]
fstp dword [0x550250]
jne 0x44387e
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x54eb2c]
mov dword [0x550250], 0x3f800000
mov dword [0x550254], 0x3dcccccd
mov bl, byte [ecx]
mov edx, dword [eax]
push ebx
push eax
mov word [0x550258], di
call dword [edx + 0x3c]
cmp eax, edi
fnclex
jge 0x440fb9
mov ecx, dword [0x54eb2c]
push 0x3c
push 0x421fa4
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
xor dx, dx
push edi
mov dl, bl
mov word [0x550214], dx
call fcn.0043ef60
mov edx, dword [ebp - 0x20]
mov ecx, 0x550218
call esi
mov edx, dword [ebp - 0x24]
mov ecx, 0x55021c
call esi
mov edi, dword [ebp + 8]
mov ecx, dword [0x550208]
mov esi, 1
Function at 0x47aa10
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x54eb74]
push esi
push edi
xor eax, eax
lea edx, [ecx + ecx*4]
shl edx, 0xa
add edx, ecx
mov ecx, dword [0x54ef68]
mov ecx, dword [ecx + edx*8 + 0x9ff8]
mov edx, dword [esp + 0xc]
mov esi, edx
mov edi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub esi, edi
pop edi
mov ecx, dword [ecx + esi*8 + 4]
pop esi
test ecx, ecx
jne 0x47aa5d
push ecx
push ecx
push 8
push 7
push 1
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a9a0
ret 8
cmp ecx, 4
je 0x47ac91
cmp ecx, 6
je 0x47ac91
cmp ecx, 9
je 0x47ac79
cmp ecx, 0xa
je 0x47ac79
cmp ecx, 0xd
je 0x47ac61
cmp ecx, 0xe
je 0x47ac61
cmp ecx, 0x12
je 0x47ac61
cmp ecx, 0x13
je 0x47ac61
cmp ecx, 0x17
je 0x47ac49
cmp ecx, 0x18
je 0x47ac49
cmp ecx, 0x1c
je 0x47ac31
cmp ecx, 0x1d
je 0x47ac31
cmp ecx, 0x1f
jne 0x47aae6
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0x28
push 2
push edx
push eax
call fcn.0047a9a0
ret 8
cmp ecx, 0x21
je 0x47ac19
cmp ecx, 0x22
je 0x47ac19
cmp ecx, 0x24
je 0x47ac01
cmp ecx, 0x25
je 0x47ac01
cmp ecx, 0x28
je 0x47abe9
cmp ecx, 0x29
je 0x47abe9
cmp ecx, 0x2c
je 0x47abe9
cmp ecx, 0x2d
je 0x47abe9
cmp ecx, 0x31
je 0x47abd1
cmp ecx, 0x32
je 0x47abd1
cmp ecx, 0x34
je 0x47abb9
cmp ecx, 0x35
je 0x47abb9
cmp ecx, 0x3a
jl 0x47ab6c
cmp ecx, 0x3c
jg 0x47ab6c
mov ecx, dword [esp + 8]
push 0x34
push 0x33
push 0x32
push 0x31
push 2
push edx
push ecx
call fcn.0047a9a0
ret 8
cmp ecx, 0x3f
je 0x47aba1
cmp ecx, 0x40
je 0x47aba1
cmp ecx, 0x44
je 0x47aba1
cmp ecx, 0x45
je 0x47aba1
cmp ecx, 0x47
jne 0x47aca6
push 0
push 0
push 0x12
push 0x11
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a9a0
ret 8
mov eax, dword [esp + 8]
push 0x39
push 0x38
push 0x37
push 0x36
push 2
push edx
push eax
call fcn.0047a9a0
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0x2d
push 2
push edx
push ecx
call fcn.0047a9a0
ret 8
push 0
push 0
push 0x3f
push 0x3e
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a9a0
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0x3d
push 0x3c
push 2
push edx
push eax
call fcn.0047a9a0
ret 8
mov ecx, dword [esp + 8]
push 0x42
push 0x41
push 0x40
push 0x3b
push 2
push edx
push ecx
call fcn.0047a9a0
ret 8
push 0
push 0x1a
push 0x19
push 0x18
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a9a0
ret 8
mov eax, dword [esp + 8]
push 0
push 0x21
push 0x20
push 0x1f
push 2
push edx
push eax
call fcn.0047a9a0
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0x15
push 0x14
push 2
push edx
push ecx
call fcn.0047a9a0
ret 8
push 0xf
push 0xe
push 0xd
push 0xc
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a9a0
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0xc
push 2
push edx
push eax
call fcn.0047a9a0
ret 8
mov ecx, dword [esp + 8]
push 5
push 4
push 3
push 2
push 2
push edx
push ecx
call fcn.0047a9a0
ret 8
Function at 0x4afee0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403318
fild dword [ebp + 8]
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x30]
mov edx, dword [0x54ef68]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fdiv qword [0x403310]
rep stosd dword es:[edi], eax
mov eax, dword [0x54eb74]
lea ecx, [eax + eax*4]
shl ecx, 0xa
add ecx, eax
lea esi, [edx + ecx*8]
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fadd qword [0x402400]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea edx, [ecx + ecx*2]
movzx di, byte [esi + edx*8 + 0xdf7]
add word [esi + eax*2 + 0xa88], di
lea edx, [esi + edx*8]
lea eax, [edx + 0xdf4]
movzx dx, byte [edx + 0xdf4]
mov byte [esi + ecx + 0x424], bl
lea ecx, [ebp - 0x30]
push ecx
add edx, 0x64
push eax
push 0x41e600
movsx edi, dx
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
call fcn.004b00b0
push edi
call fcn.004b5940
mov edx, dword [0x54f648]
mov eax, dword [0x54f680]
mov ecx, dword [0x54f664]
mov dword [edx + edi*4 + 0x30], ebx
mov dword [eax + edi*4 + 0x30], ebx
mov dword [ecx + edi*4 + 0x30], ebx
call fcn.004b5e00
push 0xffffffffffffffff
call fcn.004925c0
wait
push 0x4affdd
lea edx, [ebp - 0x30]
push edx
push 0x41e600
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
ret
Function at 0x5284f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4049b0
push 0x11
lea eax, [ebp - 0x28]
xor esi, esi
push 0x42ac1c
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov ebx, eax
mov dword [ebp - 0x34], ebx
fild dword [ebp - 0x34]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
fdiv qword [0x401518]
fstp qword [ebp - 0x50]
fild dword [ebp - 0x34]
fstp qword [ebp - 0x58]
fld qword [ebp - 0x58]
fdiv qword [0x401518]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
and eax, 0x80000001
jns 0x528578
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x5c], eax
fild dword [ebp - 0x5c]
fstp qword [ebp - 0x64]
fld qword [ebp - 0x50]
fsub qword [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
push 4
mov dword [ebp - 0x3c], eax
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041fb64
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
xor dl, byte [eax + 2]
add ecx, ebx
mov al, byte [ecx]
xor al, dl
mov byte [ecx], al
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
sub ecx, esi
mov dl, byte [ecx + ebx - 1]
mov ecx, dword [ebp - 0x1c]
xor dl, byte [ecx + 3]
mov cl, byte [eax + esi + 1]
xor cl, dl
mov byte [eax + esi + 1], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov edx, eax
sub edx, esi
mov cl, byte [edx + ebx]
mov dl, byte [eax + esi]
xor cl, dl
mov edx, dword [ebp - 0x1c]
xor cl, byte [edx]
mov byte [eax + esi], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi + 1]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
add esi, 2
xor dl, byte [eax + 1]
mov al, byte [ecx + ebx - 1]
lea ecx, [ecx + ebx - 1]
xor al, dl
mov byte [ecx], al
mov eax, dword [ebp - 0x38]
cmp esi, eax
jne 0x5285af
wait
push 0x528659
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push edx
push 0
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x541790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405556
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x405108
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x550c78]
lea ecx, [ebp - 0x18]
push eax
push ecx
call ebx
mov ecx, dword [ebp - 0x18]
push 1
movsx eax, word [0x550c7c]
mov edx, dword [ecx + 0x14]
mov edi, dword [ecx + 0xc]
sub eax, edx
lea esi, [eax + eax*2]
shl esi, 5
add esi, edi
inc word [esi + 0x34]
mov ax, word [esi + 0x34]
movsx edx, ax
push edx
lea edi, [esi + 0x30]
push 1
push 0x41f7e8
push edi
push 0x10
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaRedimPreserve]
mov eax, dword [edi]
add esp, 0x1c
lea ecx, [ebp - 0x14]
push eax
push ecx
call ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
movsx edx, word [esi + 0x34]
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
sub edx, esi
push ecx
shl edx, 4
add edx, ebx
push edx
call fcn.00541550
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x14]
push eax
call esi
lea ecx, [ebp - 0x18]
push ecx
call esi
push 0x541871
jmp 0x541866
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
ret