joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65147030
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x651523bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6516c6d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CSafeboxConfig.0
call fcn.6514a1d0
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
xor eax, eax
mov dword [esi + 0x14], eax
mov eax, 1
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x65147600
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x65147fb0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 8], 0
push edi
jne 0x65148119
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Wintrust.dll
call ebx
test eax, eax
mov dword [esi + 0xc], eax
je 0x65148121
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinVerifyTrust
push eax
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x65148121
push str.Crypt32.dll
call ebx
test eax, eax
mov dword [esi + 0x10], eax
je 0x65148121
push str.CryptQueryObject
push eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
push str.CryptMsgGetParam
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.CryptMsgClose
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x10]
push str.CertFindCertificateInStore
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x10]
push str.CertFreeCertificateContext
push eax
call edi
mov ecx, dword [esi + 0x10]
push str.CertCloseStore
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 0x10]
push str.CertGetNameStringA
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0xc]
push str.CryptCATAdminAcquireContext
push eax
call edi
mov ecx, dword [esi + 0xc]
push str.CryptCATAdminReleaseContext
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 0xc]
push str.CryptCATAdminCalcHashFromFileHandle
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0xc]
push str.CryptCATAdminEnumCatalogFromHash
push eax
call edi
mov ecx, dword [esi + 0xc]
push str.CryptCATAdminReleaseCatalogContext
push ecx
mov dword [esi + 0x40], eax
call edi
mov edx, dword [esi + 0xc]
push str.CryptCATCatalogInfoFromContext
push edx
mov dword [esi + 0x44], eax
call edi
cmp dword [esi + 0x18], 0
mov dword [esi + 0x48], eax
je 0x65148121
cmp dword [esi + 0x1c], 0
je 0x65148121
cmp dword [esi + 0x20], 0
je 0x65148121
cmp dword [esi + 0x24], 0
je 0x65148121
cmp dword [esi + 0x28], 0
je 0x65148121
cmp dword [esi + 0x2c], 0
je 0x65148121
cmp dword [esi + 0x30], 0
je 0x65148121
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x65148121
cmp dword [esi + 0x38], 0
je 0x65148121
cmp dword [esi + 0x3c], 0
je 0x65148121
cmp dword [esi + 0x40], 0
je 0x65148121
cmp dword [esi + 0x44], 0
je 0x65148121
test eax, eax
je 0x65148121
push 0
push 0
lea eax, [esi + 0x4c]
push eax
call ecx
test eax, eax
je 0x65148121
mov dword [esi + 8], 1
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov eax, dword [esi + 0x10]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x65148138
push eax
call edi
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x65148149
push eax
call edi
mov dword [esi + 0xc], 0
push 0x38
push 0
add esi, 0x14
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
pop edi
pop esi
mov eax, 0x80004005
pop ebx
ret 8
Function at 0x651488e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x214
push 0xfffffffffffffffe
push 0x65165208
push 0x6514af6d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6516c6d0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x210], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x21c]
xor ebx, ebx
mov byte [ebp + 0x108], bl
push 0x104
push ebx
lea eax, [ebp + 0x109]
push eax
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x1c], 1
mov dword [ebp + 0x104], ebx
push 0x104
push 0x6515e968
lea ecx, [ebp]
push ecx
call dword [sym.imp.MSVCR80.dll__mbsnbcpy]
add esp, 0x18
cmp dword [ebp + 0x104], ebx
jne 0x6514898b
lea edx, [ebp]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp + 0x104], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
push esi
lea eax, [ebp + 0x108]
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
push 0x30
push ebx
lea ecx, [ebp - 0x4c]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0x18
push 1
push ebx
lea edx, [ebp - 0x4c]
push edx
push ebx
lea eax, [ebp + 0x108]
push eax
call dword [sym.imp.imagehlp.dll_MapAndLoad]
cmp eax, ebx
je 0x65148a4b
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x2b], bl
jne 0x65148a26
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax + 0x18]
cmp cx, 0x10b
jne 0x651489e7
add eax, 0x98
jmp 0x651489f3
cmp cx, 0x20b
jne 0x65148a26
add eax, 0xa8
mov ecx, dword [eax + 4]
mov edx, dword [eax]
lea esi, [edx + ecx]
cmp esi, dword [ebp - 0x20]
ja 0x65148a23
cmp edx, ebx
je 0x65148a23
cmp ecx, ebx
je 0x65148a23
mov eax, edx
add eax, dword [ebp - 0x44]
lea edx, [ecx + eax]
cmp eax, edx
jae 0x65148a26
mov ecx, dword [eax]
cmp ecx, ebx
je 0x65148a23
lea eax, [ecx + eax + 7]
and eax, 0xfffffff8
jmp 0x65148a10
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x65148a41
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.imagehlp.dll_UnMapAndLoad]
mov eax, dword [ebp + 0x104]
cmp eax, ebx
je 0x65148a69
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp + 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x210]
xor ecx, ebp
call fcn.6514af96
add ebp, 0x214
mov esp, ebp
pop ebp
ret
Function at 0x65149020
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x208
mov eax, dword [0x6516c6d0]
xor eax, esp
mov dword [esp + 0x204], eax
mov ecx, dword [esp + 0x214]
push edi
mov edi, dword [esp + 0x210]
test edi, edi
mov dword [esp + 4], ecx
jne 0x65149064
or eax, 0xffffffff
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
push esi
mov esi, dword [esp + 0x218]
test esi, esi
jg 0x6514908c
pop esi
mov eax, 0xfffffffe
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
cmp dword [esp + 0x224], 0
jne 0x651490b2
pop esi
mov eax, 0xfffffffd
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
mov eax, dword [esp + 0x220]
test eax, eax
jg 0x651490d9
pop esi
mov eax, 0xfffffffc
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
test ecx, ecx
jne 0x651490f7
pop esi
lea eax, [ecx - 5]
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
push ebp
mov ebp, dword [esp + 0x22c]
test ebp, ebp
jg 0x65149120
pop ebp
pop esi
mov eax, 0xfffffffa
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
cmp eax, ebp
jge 0x65149141
pop ebp
pop esi
mov eax, 0xfffffff9
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
xor edx, edx
xor ecx, ecx
jmp 0x65149150
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x110], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0x10], cl
add ecx, 1
idiv esi
cmp ecx, 0x100
jl 0x65149150
xor ecx, ecx
xor eax, eax
push ebx
jmp 0x65149180
mov dl, byte [esp + eax + 0x14]
movzx esi, byte [esp + eax + 0x114]
movzx edi, dl
add esi, ecx
add edi, esi
mov ecx, edi
and ecx, 0x800000ff
jns 0x651491a5
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x14]
mov byte [esp + ecx + 0x14], dl
mov byte [esp + eax + 0x14], bl
add eax, 1
cmp eax, 0x100
jl 0x65149180
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x65149237
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x22c]
sub edi, eax
add ecx, 1
and ecx, 0x800000ff
jns 0x651491e3
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x14]
add esi, edx
and esi, 0x800000ff
jns 0x651491fa
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x14]
mov dl, byte [esp + esi + 0x14]
mov byte [esp + esi + 0x14], bl
mov byte [esp + ecx + 0x14], dl
movzx ebx, byte [esp + esi + 0x14]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x65149224
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x14]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x651491d0
mov ecx, dword [esp + 0x214]
pop ebx
pop ebp
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.6514af96
add esp, 0x208
ret
Function at 0x65149260
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x208
mov eax, dword [0x6516c6d0]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x214]
push edi
mov edi, dword [esp + 0x210]
test edi, edi
mov dword [esp + 4], eax
jne 0x651492a4
or eax, 0xffffffff
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
push esi
mov esi, dword [esp + 0x218]
test esi, esi
jg 0x651492cc
pop esi
mov eax, 0xfffffffe
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
test eax, eax
jne 0x651492ec
pop esi
mov eax, 0xfffffffd
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
mov eax, dword [esp + 0x220]
test eax, eax
jg 0x65149313
pop esi
mov eax, 0xfffffffc
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
cmp dword [esp + 0x224], 0
jne 0x65149339
pop esi
mov eax, 0xfffffffb
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
push ebp
mov ebp, dword [esp + 0x22c]
test ebp, ebp
jg 0x65149362
pop ebp
pop esi
mov eax, 0xfffffffa
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
cmp eax, ebp
jge 0x65149383
pop ebp
pop esi
mov eax, 0xfffffff9
pop edi
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.6514af96
add esp, 0x208
ret
xor edx, edx
xor ecx, ecx
jmp 0x65149390
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x110], al
lea eax, [edx + 1]
cdq
mov byte [esp + ecx + 0x10], cl
add ecx, 1
idiv esi
cmp ecx, 0x100
jl 0x65149390
xor ecx, ecx
xor eax, eax
push ebx
jmp 0x651493c0
mov dl, byte [esp + eax + 0x14]
movzx esi, byte [esp + eax + 0x114]
movzx edi, dl
add esi, ecx
add edi, esi
mov ecx, edi
and ecx, 0x800000ff
jns 0x651493e5
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x14]
mov byte [esp + ecx + 0x14], dl
mov byte [esp + eax + 0x14], bl
add eax, 1
cmp eax, 0x100
jl 0x651493c0
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x65149477
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x22c]
sub edi, eax
add ecx, 1
and ecx, 0x800000ff
jns 0x65149423
dec ecx
or ecx, 0xffffff00
inc ecx
movzx edx, byte [esp + ecx + 0x14]
add esi, edx
and esi, 0x800000ff
jns 0x6514943a
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + ecx + 0x14]
mov dl, byte [esp + esi + 0x14]
mov byte [esp + esi + 0x14], bl
mov byte [esp + ecx + 0x14], dl
movzx ebx, byte [esp + esi + 0x14]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x65149464
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x14]
xor dl, byte [edi + eax]
add eax, 1
sub ebp, 1
mov byte [eax - 1], dl
jne 0x65149410
mov ecx, dword [esp + 0x214]
pop ebx
pop ebp
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.6514af96
add esp, 0x208
ret
Function at 0x6514a360
Capabilities:
Check mutex on windows

Disassembly:
push ecx
mov eax, dword [0x6516c6d0]
xor eax, esp
mov dword [esp], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
test eax, eax
push edi
mov ebp, 0x80004005
je 0x6514a38d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
cmp byte [esi + 0x118], 0
mov ebx, dword [sym.imp.MSVCR80.dll__mbsnbcat]
lea edi, [esi + 0x118]
jne 0x6514a3b2
push 0x104
push str.GlobalC8CA5A2E_89F9_49e2_AA24_7868C090DDA4
push edi
call ebx
add esp, 0xc
push edi
push 0
call fcn.6514a260
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x6514a3d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x6514a410
cmp byte [esi + 0x14], 0
lea edi, [esi + 0x14]
jne 0x6514a3f2
push edi
call fcn.65146990
push 0x104
push str.QMConfig.dat
push edi
call ebx
add esp, 0x10
pop edi
mov dword [esi + 0x21c], 1
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp]
xor ecx, esp
call fcn.6514af96
pop ecx
ret 8
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.6514af96
pop ecx
ret 8

Function at 0x6514a440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
mov eax, 0x80004005
je 0x6514a4b1
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll__mbsnbcpy]
push edi
mov edi, dword [esp + 0x10]
push 0x103
lea eax, [edi + 0x14]
push esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
push 0x103
push ecx
lea edx, [edi + 0x118]
push edx
call ebx
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6514a4a2
push esi
call fcn.651494a0
mov esi, eax
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push 0
push edi
call ecx
pop edi
pop ebx
mov eax, esi
pop esi
ret 0xc
mov eax, dword [edi]
mov ecx, dword [eax + 8]
xor esi, esi
push esi
push edi
call ecx
pop edi
mov eax, esi
pop ebx
pop esi
ret 0xc

Function at 0x6514a4c0
Capabilities:
Delete file
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [edi + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
je 0x6514a4e7
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [edi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 0x80004005
pop esi
ret 4
Function at 0x6514a610
Capabilities:
Get file attributes

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 0x14]
push eax
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
mov ebp, dword [esp + 0x24]
jne 0x6514a637
xor esi, esi
test ebp, ebp
je 0x6514a637
mov dword [ebp], esi
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [edi + 0x21c], 0
je 0x6514a689
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push ecx
push ebx
push edx
push eax
lea eax, [edi + 0x14]
push eax
call fcn.65149520
mov esi, eax
test esi, esi
jl 0x6514a688
mov ebp, dword [ebp]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
push ebp
push ebx
push ebp
push ebx
push ecx
push edx
call fcn.65149260
add esp, 0x18
pop ebx
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x6514af07
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6516cc00], 0
push esi
jne 0x6514ae7a
call fcn.6514ada5
test eax, eax
je 0x6514aebd
mov eax, dword [0x6516cc00]
cmp eax, 1
jne 0x6514ae9b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x6514aebd
pop esi
ret
push eax
call dword [0x6516cc08]
test eax, eax
jne 0x6514af05
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6514aec1
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x6516cc00]
call dword [0x6516cc08]
mov edi, eax
test edi, edi
je 0x6514aee8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x6514af04
lea edi, [esi + 0xff0]
push esi
push dword [0x6516cc00]
call dword [0x6516cc04]
add esi, 0x10
cmp esi, edi
jb 0x6514aeee
mov eax, esi
pop edi
pop esi
ret
jmp 0x6514ae67

Function at 0x6514af96
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6516c6d0]
jne 0x6514afa0
repz ret
jmp fcn.6514b6b4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x3465191e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xfbc366a
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10028107
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10028107
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10028107
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10028107
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10028107
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10028107
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10028107
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.10028107
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10028107
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.10028107
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.10028107
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.10028107
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.10028107
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10028107
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10028107
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.10028107
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.10028107
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.10028107
push eax
lea ecx, [ebx + 0x10]
call fcn.10028107
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc