joyce8/EMBER2024-capa huggingface dataset:
Function at 0x633554
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
lea edi, [ebp - 0x14]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x633774
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00639d70
mov ebx, eax
mov al, byte [0x633784]
cmp al, bl
je 0x6335a4
cmp word [ebp - 0x10], 0xc
jne 0x6335a4
mov word [ebp - 0x10], 0x65
cmp byte [esi + 0x138], 0
jne 0x633738
mov ax, word [ebp - 0x10]
add eax, 0xfffffff0
sub ax, 3
jae 0x63361e
cmp dword [esi + 0x13c], 0
je 0x6335cf
xor eax, eax
mov dword [esi + 0x13c], eax
lea edx, [ebp - 0x118]
mov eax, ebx
call fcn.00633400
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.0063fd6c
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.0063fce0
mov eax, dword [ebp - 0x118]
call fcn.0040351c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x84]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x80]
jmp 0x63375b
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
push 0
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
movzx eax, word [ebp - 0x10]
push eax
call sub.user32.dll_ToAscii
mov edi, eax
dec edi
jne 0x63366b
cmp byte [ebp - 1], 0x20
jb 0x63366b
test bl, 2
jne 0x63366b
cmp word [ebp - 0x10], 0x20
jne 0x63375b
mov al, byte [0x633788]
cmp al, bl
jne 0x63375b
mov byte [esi + 0x13c], bl
mov al, byte [ebp - 0x10]
mov byte [esi + 0x13d], al
mov byte [esi + 0x13e], 0
call fcn.00450040
mov edx, dword [esi + 0x13c]
call fcn.00450bc8
test al, al
je 0x633729
cmp byte [esi + 0x140], 0
je 0x633712
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.0063347c
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.0063fce0
lea eax, [ebp - 0x118]
mov edx, 0x633794
call fcn.00403524
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.0063fd6c
mov byte [esi + 0x138], 1
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.0063fce0
mov eax, dword [ebp - 0x118]
call fcn.0040351c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x84]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x80]
jmp 0x63375b
xor eax, eax
mov dword [esi + 0x13c], eax
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.0063347c
jmp 0x63375b
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.0063347c
jmp 0x63375b
mov ax, word [ebp - 0x10]
add eax, 0xfffffff0
sub ax, 3
jb 0x63375b
mov al, byte [ebp - 0x10]
mov byte [esi + 0x13e], al
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.0063347c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63377b
lea eax, [ebp - 0x118]
call fcn.00403274
ret
Function at 0x636a34
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x636ccb
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [edx + 6]
cmp eax, 0xa
ja case.0x636a58.0
jmp dword [eax*4 + 0x636a5f]
mov eax, esi
mov bx, 0xfff9
call fcn.00403254
jmp case.0x636a58.0
mov eax, esi
mov bx, 0xffe9
call fcn.00403254
jmp case.0x636a58.0
mov byte [esi + 0x135], 0
mov eax, esi
mov bx, 0xffe8
call fcn.00403254
mov eax, dword [esi + 0x120]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x130]
cmp ebx, eax
jle 0x636ad6
mov ebx, eax
cmp ebx, 1
jge 0x636ae0
mov ebx, 1
mov eax, dword [0x6697c8]
cmp byte [eax], 0
je 0x636b01
push 0
push ebx
push 0x1701
mov eax, esi
call fcn.00643a28
push eax
call sub.user32.dll_SendMessageW
jmp 0x636b46
push 0x9e
mov eax, esi
call fcn.006363dc
imul ebx
add eax, dword [esi + 0x34]
add eax, 2
push eax
mov eax, dword [esi + 0x30]
push eax
push 0
push 0
push 0
mov eax, esi
call fcn.00643a28
push eax
call sub.user32.dll_SetWindowPos
push 0x5f
push 0
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00643a28
push eax
call sub.user32.dll_SetWindowPos
cmp byte [esi + 0x135], 0
je 0x636b81
push 0
push 0
push 0x1f
mov eax, esi
call fcn.00643a28
push eax
call sub.user32.dll_PostMessageW
cmp byte [esi + 0x134], 0
jne 0x636b81
push 0
push 0
push 0x14f
mov eax, esi
call fcn.00643a28
push eax
call sub.user32.dll_PostMessageW
mov byte [esi + 0x136], 0
jmp case.0x636a58.0
cmp byte [0x66fc98], 0
jne case.0x636a58.0
mov eax, esi
call fcn.00636288
test eax, eax
jl case.0x636a58.0
lea edx, [ebp - 4]
mov eax, esi
call fcn.006361c4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0063fd6c
mov eax, esi
mov bx, 0xfffa
call fcn.00403254
mov eax, esi
mov bx, 0xffe9
call fcn.00403254
jmp case.0x636a58.0
mov eax, esi
call fcn.00636240
test al, al
je case.0x636a58.0
push 0x28
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636c33
push 0x26
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636c33
push 0x24
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636c33
push 0x23
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636c33
push 0x21
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636c33
push 0x22
call sub.user32.dll_GetKeyState
test ax, ax
jge case.0x636a58.0
mov byte [esi + 0x136], 1
mov eax, esi
call fcn.00636288
mov dword [esi + 0x13c], eax
jmp case.0x636a58.0
cmp byte [esi + 0x136], 0
je case.0x636a58.0
mov eax, esi
call fcn.00636240
test al, al
je case.0x636a58.0
mov byte [esi + 0x136], 0
mov byte [0x66fc98], 1
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006362a4
mov eax, esi
mov bx, 0xfffa
call fcn.00403254
mov eax, esi
mov bx, 0xffe9
call fcn.00403254
mov byte [0x66fc98], 0
jmp case.0x636a58.0
mov byte [esi + 0x134], 1
mov byte [esi + 0x135], 1
jmp case.0x636a58.0
mov byte [esi + 0x134], 0
mov byte [esi + 0x135], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636cd2
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x639b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x66fcc4
cmp dword [edi], 0
jne 0x639bec
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x66fcc0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x668648
mov ecx, 2
call fcn.004023c8
mov edx, 0x639b48
lea eax, [esi + 5]
call fcn.00639b68
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00639b68
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x639bc1
mov dword [0x66fcc0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x639d1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x639d6c]
test si, 4
je 0x639d30
or bl, 1
test si, 8
je 0x639d3a
or bl, 4
test si, 1
je 0x639d44
or bl, 8
test si, 2
je 0x639d4e
or bl, 0x10
test si, 0x10
je 0x639d58
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x639d67
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x639d70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x639da8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x639d89
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x639d98
or bl, 4
test esi, 0x20000000
je 0x639da3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x63ce60
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x150]
test eax, eax
je 0x63ceeb
cmp dword [ebx + 0x28], 0
jne 0x63cee8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x63cdd8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x18], 0
je 0x63cee8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x63ceb8
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x24]
mov esi, dword [eax + 0x18]
dec esi
cmp esi, 0
jl 0x63cee8
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*4]
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x63cec4
inc dword [ebx + 0x28]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x63dab0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x20], 0
je 0x63daef
mov eax, dword [ebx + 0x20]
call fcn.00643b70
test al, al
je 0x63dae7
mov eax, dword [ebx + 0x20]
call fcn.00643a28
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x63dae7
push 0
mov eax, dword [ebx + 0x20]
call fcn.00643a28
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x20]
xor edx, edx
mov dword [eax + 0x18], edx
pop ebx
ret
Function at 0x644968
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor ecx, ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x644a73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403274
mov eax, dword [0x66fd20]
push eax
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyExA
shl eax, 0x10
test eax, eax
je 0x644a0c
push 0xff
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
cmp word [ebp - 0x200], 0
jne 0x6449db
cmp word [ebp - 0x202], 0
jne 0x6449e7
cmp byte [ebp - 2], 0x60
jb 0x6449e7
cmp byte [ebp - 2], 0x6f
jbe 0x644a4f
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00403a18
mov eax, dword [ebp - 0x208]
mov edx, ebx
call fcn.006542f4
jmp 0x644a4f
cmp byte [ebp - 2], 0
je 0x644a4f
mov eax, dword [0x66fd20]
and eax, 0xffff
call fcn.00652e98
push eax
lea eax, [ebp - 0x20c]
mov dl, byte [ebp - 2]
call fcn.00403418
mov eax, dword [ebp - 0x20c]
lea ecx, [ebp - 0x208]
pop edx
call fcn.00654218
mov eax, dword [ebp - 0x208]
mov edx, ebx
call fcn.006542f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644a7a
lea eax, [ebp - 0x20c]
call fcn.00403274
lea eax, [ebp - 0x208]
call fcn.00403880
ret

Function at 0x647528
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x64752e
ret

Function at 0x652288
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0x21], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x652298
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
dec eax
jne 0x6522ab
mov byte [ebx + 0x21], 0
pop ebx
ret

Function at 0x652e98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x652f20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
shr eax, 0xa
jne 0x652ebd
add ebx, 0x400
push 0
push 0
push 0x1004
mov edi, ebx
and edi, 0xffff
push edi
call sub.kernel32.dll_GetLocaleInfoA
mov esi, eax
test esi, esi
jle 0x652f05
lea eax, [ebp - 4]
mov edx, esi
call fcn.00403804
push esi
mov eax, dword [ebp - 4]
push eax
push 0x1004
push edi
call sub.kernel32.dll_GetLocaleInfoA
mov edx, 0x4e4
mov eax, dword [ebp - 4]
call fcn.006553dc
mov ebx, eax
jmp 0x652f0a
mov ebx, 0x4e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x652f27
lea eax, [ebp - 4]
call fcn.00403274
ret

Function at 0x65606c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, ecx
push pe_nt_image_headers32
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x656096
mov ecx, eax
dec ecx
mov edx, esp
mov eax, ebx
call fcn.00403964
add esp, 0x200
pop ebx
ret
Function at 0x6560a0
Capabilities:
Get geographical location

Disassembly:
push ecx
push 2
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
mov al, byte [esp]
pop edx
ret
Function at 0x4043a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401250
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, 3
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
ja case.default.0x4043e9
jmp dword [eax*4 + 0x40453c]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], esi
mov esi, dword [ebp + 8]
push eax
push 1
lea ecx, [ebp - 0x28]
push esi
push ecx
push 0x407084
call dword [sym.imp.MSVBVM60.DLL_UserDllMain]
test eax, eax
je case.default.0x4043e9
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffff
mov dword [0x40707c], eax
je case.default.0x4043e9
push 0xffffffffffffffff
push esi
call fcn.00404690
and eax, 1
push 0x404526
mov dword [ebp - 0x14], eax
jmp 0x404525
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push edx
push 2
lea eax, [ebp - 0x28]
push edi
push eax
push 0x407084
mov dword [ebp - 0x28], esi
call dword [sym.imp.MSVBVM60.DLL_UserDllMain]
test eax, eax
je case.default.0x4043e9
push esi
push edi
call fcn.00404690
and eax, 1
push 0x404526
mov dword [ebp - 0x14], eax
jmp 0x404525
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], esi
mov esi, dword [ebp + 8]
push ecx
push 3
lea edx, [ebp - 0x28]
push esi
push edx
push 0x407084
call dword [sym.imp.MSVBVM60.DLL_UserDllMain]
test eax, eax
je case.default.0x4043e9
push esi
call fcn.00404550
call fcn.004045f0
mov dword [ebp - 0x14], 1
push 0x404526
jmp 0x404525
call fcn.00404840
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push eax
push esi
lea edx, [ebp - 0x28]
push ecx
push edx
push 0x407084
mov dword [ebp - 0x28], esi
call dword [sym.imp.MSVBVM60.DLL_UserDllMain]
call fcn.004045f0
mov eax, dword [0x40707c]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsFree]
mov dword [0x40707c], esi
mov dword [0x407080], esi
mov dword [ebp - 0x14], 1
push 0x404526
jmp 0x404525
ret

Function at 0x404550
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401260
mov eax, dword [0x40707c]
xor esi, esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
cmp eax, esi
je 0x4045a7
call dword [sym.imp.OLE32.DLL_CoUninitialize]
mov dword [ebp - 0x14], reloc.OLE32.DLL_CoUninitialize
push 0x4045d3
jmp 0x4045d2
ret
Function at 0x4045f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401270
mov eax, dword [0x40707c]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
cmp esi, edi
je 0x40464b
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x404677
jmp 0x404676
ret

Function at 0x404690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401280
mov edx, dword [0x40707c]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], ecx
xor edi, edi
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
cmp eax, edi
jne 0x4047e7
push edi
call dword [sym.imp.OLE32.DLL_CoInitialize]
cmp dword [0x407080], edi
jne 0x40472b
mov eax, dword [ebp + 8]
push eax
call fcn.00404910
cmp eax, edi
mov dword [0x407080], eax
je 0x4047ee
call fcn.00404bc0
call fcn.00404d50
mov ecx, dword [0x40707c]
mov esi, eax
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
cmp esi, edi
je 0x4047ee
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x24]
push eax
push ecx
push esi
lea edx, [ebp + 8]
push edi
push edx
mov dword [ebp - 0x2c], 0xc0
mov dword [ebp - 0x28], 0x46000000
mov dword [ebp - 0x50], edi
call dword [sym.imp.MSVBVM60.DLL_VBDllGetClassObject]
cmp word [ebp + 0xc], di
je 0x4047e7
cmp dword [0x4076a0], edi
jne 0x40478f
push 0x4076a0
push 0x402dbc
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov esi, dword [0x4076a0]
lea ecx, [ebp - 0x48]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0x14]
cmp eax, edi
fnclex
jge 0x4047b4
push 0x14
push 0x402dac
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov edx, dword [eax]
mov esi, eax
call dword [edx + 0x128]
cmp eax, edi
fnclex
jge 0x4047de
push 0x128
push 0x402dcc
push esi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov dword [ebp - 0x38], reloc.OLE32.DLL_CoUninitialize
push 0x40481a
jmp 0x404819
ret
Function at 0x404840
Capabilities:
Execute shellcode via indirect call
Get number of processors
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401290
mov eax, dword [0x40707c]
xor ebx, ebx
push eax
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4048c8
mov edi, dword [sym.imp.MSVBVM60.DLL_GetMem1]
mov edx, esi
lea ecx, [ebp - 0x14]
add edx, 0x3c
push ecx
jo 0x404905
push edx
call edi
mov al, byte [ebp - 0x14]
xor cx, cx
or al, 1
mov cl, al
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
mov ecx, esi
lea edx, [ebp - 0x14]
add ecx, 0x3c
mov byte [ebp - 0x14], al
jo 0x404905
push ecx
push edx
call edi
push esi
call dword [sym.imp.MSVBVM60.DLL_VBDllCanUnloadNow]
push 0x4048f4
jmp 0x4048f3
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
Function at 0x404bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401396
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4012b0
mov ecx, dword [0x407080]
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea eax, [ebp - 0x18]
xor edi, edi
push eax
push 0x40
push 0x64
push ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
call ebx
mov eax, dword [0x407080]
mov esi, dword [sym.imp.MSVBVM60.DLL_GetMem4]
add eax, 0x2c
lea edx, [ebp - 0x3c]
jo 0x404d40
push eax
push edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], edi
call esi
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x407080]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ecx
push 0x64
push edx
call ebx
mov ecx, dword [0x407080]
lea eax, [ebp - 0x20]
add ecx, 0x4c
push eax
jo 0x404d40
push ecx
call esi
mov eax, dword [0x407080]
lea edx, [ebp - 0x1c]
add eax, 0x44
push edx
jo 0x404d40
push eax
call dword [sym.imp.MSVBVM60.DLL_GetMem2]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, edi
jle 0x404d03
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x28]
add eax, 0x28
push edx
jo 0x404d40
push eax
call esi
test byte [ebp - 0x28], 0x10
je 0x404ce9
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
and ecx, 0xffffffef
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x18]
push ecx
push 0x40
push 4
push edx
call ebx
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
add eax, 0x28
jo 0x404d40
push eax
push ecx
call esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push edx
push eax
push 4
push ecx
call ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub ecx, 1
jo 0x404d40
add eax, edx
mov dword [ebp - 0x1c], ecx
jo 0x404d40
mov dword [ebp - 0x20], eax
jmp 0x404c8c
push 0x404d2f
jmp 0x404d2e
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xd725566
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x42406296
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40106e
Capabilities:
Inspect load icon resource

Disassembly:
jmp 0x402070
push 0xffffffffffffffff
push 0x439ae2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
mov esi, ecx
push 0x66
mov dword [esp + 0x10], esi
call fcn.0041dd07
mov dword [esp + 0x14], 0
mov dword [esi], method.CDialog.virtual_0
call fcn.00435362
call fcn.00435362
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esi + 0x60], eax
call edi
push 1
mov dword [esi + 0x8c], eax
call edi
push 0x14
mov dword [esi + 0x90], eax
call fcn.00422397
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 1
je 0x402100
push 0
mov ecx, eax
call fcn.0042a6db
jmp 0x402102
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x94], eax
mov dword [esi + 0x6c], 1
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4