joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e80
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
sub esp, 0xd4
mov eax, dword [0x41713c]
xor eax, esp
mov dword [esp + 0xcc], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str.ExampleSlot
push ebp
push ebp
push ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, ebp
je 0x401fc0
mov edx, dword [0x418f14]
push ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
push edx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x401fb9
cmp dword [esp + 0x14], 0xffffffff
je 0x401fb9
cmp dword [esp + 0x18], ebp
je 0x401f8a
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x38]
push eax
call ebx
mov ecx, dword [esp + 0x14]
lea edx, [ecx + eax*2]
push edx
push 0x40
call edi
mov esi, eax
cmp esi, ebp
je 0x401fb5
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [0x418f14]
lea edx, [esp + 0x24]
push edx
mov word [esi], ax
mov eax, dword [esp + 0x1c]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x401faf
call fcn.00401a10
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x418f14]
push ebp
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x401fb5
cmp dword [esp + 0x18], ebp
jne 0x401f10
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040360f
add esp, 0xd4
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401f96

Function at 0x401ff0
Capabilities:
Create mailslot

Disassembly:
sub esp, 0x20
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [esp]
push eax
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x18]
push str..mailslotAE7FA593_96B0_4eae_8E2B_4295A3650A96
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [0x418f14], eax
mov eax, ecx
add esp, 0x20
ret
Function at 0x402aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402ab7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402ae8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402ae4
cmp esi, eax
jae 0x402ae8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x402ad4
cmp esi, eax
jb 0x402aee
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x402b20
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41713c]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
push 0x104
lea eax, [esp + 8]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402b76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.00403a98
add esp, 8
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040360f
add esp, 0x20c
ret
push ebx
push esi
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x402ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00403a98
add esp, 8
jmp 0x402c01
push 0
push 0
push 0x41524c
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 1
push 2
push 0x110
push 4
push 0x414d40
push str.9eMobileService
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x402bea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.00403a98
add esp, 8
jmp 0x402c01
push str.9eMobileService
push str._s_is_installed._n
call fcn.00403a98
add esp, 8
call fcn.00402d80
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x402c0e
push esi
call ebx
test edi, edi
je 0x402c15
push edi
call ebx
mov ecx, dword [esp + 0x214]
pop esi
pop ebx
pop edi
xor ecx, esp
call fcn.0040360f
add esp, 0x20c
ret
Function at 0x402c30
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub esp, 0x1c
xor eax, eax
push ebp
push 1
push eax
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
jne 0x402c7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00403a98
add esp, 8
pop ebp
add esp, 0x1c
ret
push esi
push edi
push 0x10024
push str.9eMobileService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x402ca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x402d5b
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402d38
push ebx
push str.9eMobileService
push str.Stopping__s.
call fcn.00403a98
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
je 0x402d17
lea ecx, [ecx]
cmp dword [esp + 0x14], 3
jne 0x402d17
push 0x4153b8
call fcn.00403a98
add esp, 4
push 0x3e8
call edi
lea edx, [esp + 0x10]
push edx
push esi
call ebx
test eax, eax
jne 0x402cf0
cmp dword [esp + 0x14], 1
pop ebx
push str.9eMobileService
jne 0x402d2b
push 0x4153bc
jmp 0x402d30
push str._n_s_failed_to_stop._n
call fcn.00403a98
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402d51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed_w_err_0x_08lx_n
jmp 0x402d5b
push str.9eMobileService
push str._s_is_removed._n
call fcn.00403a98
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push ebp
call edi
test esi, esi
je 0x402d73
push esi
call edi
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x40360f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41713c]
jne 0x403619
repz ret
jmp fcn.00405730

Function at 0x40ada2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405094
and dword [ebp - 4], 0
cmp dword [0x418dac], 0
mov ebx, eax
jne 0x40ae53
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40af04
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40af04
push eax
call fcn.00405022
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418dac], eax
call esi
push eax
call fcn.00405022
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x418db0], eax
call esi
push eax
call fcn.00405022
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x418db4], eax
call esi
push eax
call fcn.00405022
pop ecx
mov dword [0x418dbc], eax
test eax, eax
je 0x40ae53
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405022
pop ecx
mov dword [0x418db8], eax
mov eax, dword [0x418db8]
cmp eax, ebx
je 0x40aeab
cmp dword [0x418dbc], ebx
je 0x40aeab
push eax
call fcn.0040509d
push dword [0x418dbc]
mov esi, eax
call fcn.0040509d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40aeab
test edi, edi
je 0x40aeab
call esi
test eax, eax
je 0x40aea2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40aea2
test byte [ebp - 0xc], 1
jne 0x40aeab
or dword [ebp + 0x10], 0x200000
jmp 0x40aee4
mov eax, dword [0x418db0]
cmp eax, ebx
je 0x40aee4
push eax
call fcn.0040509d
pop ecx
test eax, eax
je 0x40aee4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40aee4
mov eax, dword [0x418db4]
cmp eax, ebx
je 0x40aee4
push eax
call fcn.0040509d
pop ecx
test eax, eax
je 0x40aee4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418dac]
call fcn.0040509d
pop ecx
test eax, eax
je 0x40af04
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40af06
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b93a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x40c136
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x403600
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov eax, dword [esi]
mov dword [ebp - 0x44], edi
cmp eax, 0x5b9a2c
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x60], edi
je 0x4b93f2
call dword [sym.imp.MSVBVM60.DLL___vbaFailedFriend]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
mov ebx, dword [ecx]
mov dword [eax], 0
push ebx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
inc eax
add byte [ebx + 0x45891455], cl
ror byte [ebx - 0x7a76affe], 0x74
invalid
invalid
invalid
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x90], eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push ebx
mov ebx, dword [sym.imp.MSVBVM60.DLL_VarPtr_1]
mov dword [ebp - 0x54], eax
call ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4b9b8c
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x4b9478
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
lea edx, [ecx + ecx]
push edx
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
adc al, 0x10
inc eax
add byte [ebx - 0x43b27230], cl
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push 0x4b9bb6
jmp 0x57302d
mov eax, dword [ebp + 0x18]
test eax, eax
jle 0x4b9482
lea edi, [eax - 1]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x24]
push edx
mov dword [esi + 0x44], ecx
call ebx
mov dword [esi + 0x7c], eax
mov eax, dword [ebp - 0x8c]
push eax
call ebx
mov ecx, dword [ebp - 0x54]
mov dword [esi + 0x60], eax
cmp ecx, dword [ebp - 0x50]
jne 0x4b94d7
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], 0xffffffff
lea eax, [edx + edx]
push eax
push ecx
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
adc eax, sym.imp.OLEAUT32.DLL_SysAllocStringByteLen
mov edx, eax
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0x44]
push edx
call ebx
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x54]
mov edx, dword [eax]
mov eax, dword [esi + 0x6c]
sub ecx, ebx
test edx, edx
mov dword [ebp - 0x4c], ecx
jne 0x4b9682
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
shl ecx, 1
sub edx, ecx
mov bx, word [edx]
mov dword [ebp - 0x3c], ebx
cmp edi, dword [ebp - 0x4c]
jg 0x4b98ac
mov eax, dword [esi + 0x34]
mov edx, edi
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
mov dword [ebp - 0x94], ecx
invalid
test dword [eax - 1], ebp
invalid
Function at 0x4b9405
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x40c136
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x403600
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov eax, dword [esi]
mov dword [ebp - 0x44], edi
cmp eax, 0x5b9a2c
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x60], edi
je 0x4b93f2
call dword [sym.imp.MSVBVM60.DLL___vbaFailedFriend]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
mov ebx, dword [ecx]
mov dword [eax], 0
push ebx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
inc eax
add byte [ebx + 0x45891455], cl
ror byte [ebx - 0x7a76affe], 0x74
invalid
invalid
invalid
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x90], eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push ebx
mov ebx, dword [sym.imp.MSVBVM60.DLL_VarPtr_1]
mov dword [ebp - 0x54], eax
call ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4b9b8c
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x4b9478
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
lea edx, [ecx + ecx]
push edx
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
adc al, 0x10
inc eax
add byte [ebx - 0x43b27230], cl
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push 0x4b9bb6
jmp 0x57302d
mov eax, dword [ebp + 0x18]
test eax, eax
jle 0x4b9482
lea edi, [eax - 1]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x24]
push edx
mov dword [esi + 0x44], ecx
call ebx
mov dword [esi + 0x7c], eax
mov eax, dword [ebp - 0x8c]
push eax
call ebx
mov ecx, dword [ebp - 0x54]
mov dword [esi + 0x60], eax
cmp ecx, dword [ebp - 0x50]
jne 0x4b94d7
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], 0xffffffff
lea eax, [edx + edx]
push eax
push ecx
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
adc eax, sym.imp.OLEAUT32.DLL_SysAllocStringByteLen
mov edx, eax
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0x44]
push edx
call ebx
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x54]
mov edx, dword [eax]
mov eax, dword [esi + 0x6c]
sub ecx, ebx
test edx, edx
mov dword [ebp - 0x4c], ecx
jne 0x4b9682
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
shl ecx, 1
sub edx, ecx
mov bx, word [edx]
mov dword [ebp - 0x3c], ebx
cmp edi, dword [ebp - 0x4c]
jg 0x4b98ac
mov eax, dword [esi + 0x34]
mov edx, edi
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
mov dword [ebp - 0x94], ecx
invalid
test dword [eax - 1], ebp
invalid
Function at 0x4b94bb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x40c136
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x403600
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov eax, dword [esi]
mov dword [ebp - 0x44], edi
cmp eax, 0x5b9a2c
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x60], edi
je 0x4b93f2
call dword [sym.imp.MSVBVM60.DLL___vbaFailedFriend]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
mov ebx, dword [ecx]
mov dword [eax], 0
push ebx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
inc eax
add byte [ebx + 0x45891455], cl
ror byte [ebx - 0x7a76affe], 0x74
invalid
invalid
invalid
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x90], eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push ebx
mov ebx, dword [sym.imp.MSVBVM60.DLL_VarPtr_1]
mov dword [ebp - 0x54], eax
call ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4b9b8c
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x4b9478
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
lea edx, [ecx + ecx]
push edx
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
adc al, 0x10
inc eax
add byte [ebx - 0x43b27230], cl
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push 0x4b9bb6
jmp 0x57302d
mov eax, dword [ebp + 0x18]
test eax, eax
jle 0x4b9482
lea edi, [eax - 1]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x24]
push edx
mov dword [esi + 0x44], ecx
call ebx
mov dword [esi + 0x7c], eax
mov eax, dword [ebp - 0x8c]
push eax
call ebx
mov ecx, dword [ebp - 0x54]
mov dword [esi + 0x60], eax
cmp ecx, dword [ebp - 0x50]
jne 0x4b94d7
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], 0xffffffff
lea eax, [edx + edx]
push eax
push ecx
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
adc eax, sym.imp.OLEAUT32.DLL_SysAllocStringByteLen
mov edx, eax
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0x44]
push edx
call ebx
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x54]
mov edx, dword [eax]
mov eax, dword [esi + 0x6c]
sub ecx, ebx
test edx, edx
mov dword [ebp - 0x4c], ecx
jne 0x4b9682
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0xc]
shl ecx, 1
sub edx, ecx
mov bx, word [edx]
mov dword [ebp - 0x3c], ebx
cmp edi, dword [ebp - 0x4c]
jg 0x4b98ac
mov eax, dword [esi + 0x34]
mov edx, edi
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
sub edx, ecx
mov dword [ebp - 0x94], ecx
invalid
test dword [eax - 1], ebp
invalid
Function at 0x4b958b
Capabilities:
Parse pe header

Disassembly:
test eax, eax
je 0x4b95c4
mov edx, dword [esi + 0x6c]
mov ebx, eax
sub eax, ecx
mov ecx, dword [ebp - 0x98]
sub ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
add eax, edi
mov ax, word [ecx + eax*2]
cmp ax, word [edx + ebx*2]
jne 0x4b9673
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x20], eax
jmp fcn.004b958b
mov ecx, dword [ebp - 0x34]
inc ecx
cmp word [ebp - 0x30], 0
mov dword [ebp - 0x34], ecx
je 0x4b9606
mov eax, dword [ebp - 0x50]
mov eax, dword [esi + 0xa8]
mov ecx, dword [ebp - 0x34]
cmp ecx, eax
jle 0x4b963c
add eax, 0x200
push 0
push eax
push 1
lea edx, [esi + 0xa4]
push 3
push edx
push 4
push 0x80
mov dword [esi + 0xa8], eax
call dword [sym.imp.MSVBVM60.DLL___vbaRedimPreserve]
add esp, 0x1c
mov eax, dword [esi + 0xa4]
mov edx, dword [ebp - 0x34]
lea ecx, [edi + edi]
sub edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4], ecx
mov ebx, dword [ebp - 0x3c]
mov eax, 1
add edi, eax
jmp 0x572b84
ror byte [ebp + 0x15ff844d], 1
and byte [eax + eax*2], dl
add byte [eax - 1], dl
adc eax, sym.imp.MSVBVM60.DLL___vbaStrCat

Function at 0x4b95f0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x88]
dec eax
mov ebx, eax
mov dword [ebp - 0x20], eax
sub ebx, dword [ecx + 0x14]
sub eax, dword [edx + 0x14]
mov ecx, dword [ecx + 0xc]
mov edx, dword [edx + 0xc]
add eax, edi
mov cx, word [ecx + ebx*2]
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4b95d5
mov ebx, dword [ebp - 0x3c]
jmp 0x4b9651
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp + 0x1c]
cmp ecx, eax
je 0x4b98ac
mov edx, dword [ebp - 0x54]
lea eax, [edx - 1]
add edi, eax
mov eax, 1
add edi, eax
jmp 0x572b75
cmp word [ebp - 0x30], 0
jne 0x4b9b8c
mov ebx, dword [ebp - 0x34]
test ebx, ebx
jne 0x4b98ce
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
lea eax, [edx + edx]
push eax
push ecx
jmp 0x572d2b
mov edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
mov edx, edi
mov eax, dword [ebp - 0x40]
sub edx, ecx
imul edx, ebx
add edx, eax
mov eax, dword [ebp - 0x44]
shl edx, 1
push edx
push eax
call dword [sym.imp.OLEAUT32.DLL_SysAllocStringByteLen]
mov edx, eax
lea ecx, [ebp - 0x44]
add byte [ebx + 0x48b0c51], cl
adc byte [eax - 1], 0x15
aam 0x10
inc eax
add byte [ebx - 0x7bb27230], cl
Function at 0x4b96ef
Capabilities:
Parse pe header

Disassembly:
pop ebp
les esp, [esi + 0x39]
pushfd
push eax
add byte [eax], al
add dword [eax], eax
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov bx, word [ebp - 0x3c]
cmp word [eax + edx*2 + 0x10000], bx
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov bx, word [ebp - 0x3c]
cmp word [eax + edx*2 + 0x10000], bx
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov edi, 0x8b665314
pop ebp
les esp, [esi + 0x39]
pushfd
push eax
add byte [eax], al
add dword [eax], eax
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov bx, word [ebp - 0x3c]
cmp word [eax + edx*2 + 0x10000], bx
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx ebx, word [ebx + edx*2]
mov edx, dword [ebp - 0x3c]
cmp word [eax + ebx*2 + 0x10000], dx
je 0x4b97b0
inc edi
mov ebx, edi
sub ebx, ecx
mov ecx, dword [ebp - 0x98]
movsx ecx, word [ecx + ebx*2]
cmp word [eax + ecx*2 + 0x10000], dx
jne 0x4b989d
cmp edi, dword [ebp - 0x4c]
jg 0x4b98ac
mov edx, dword [ebp - 0x54]
lea ecx, [edx - 1]
test ecx, ecx
mov dword [ebp - 0x20], ecx
je 0x4b9805
mov edx, dword [esi + 0x6c]
mov ebx, ecx
sub ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
movsx edx, word [edx + ebx*2]
mov ebx, dword [ebp - 0x94]
sub ecx, ebx
mov ebx, dword [ebp - 0x98]
add ecx, edi
movsx ecx, word [ebx + ecx*2]
mov cx, word [eax + ecx*2 + 0x10000]
cmp cx, word [eax + edx*2 + 0x10000]
jne 0x4b989d
mov ecx, dword [ebp - 0x20]
dec ecx
jmp 0x4b97bf
mov ebx, dword [ebp - 0x34]
inc ebx
cmp word [ebp - 0x30], 0
mov dword [ebp - 0x34], ebx
je 0x4b9844
mov eax, dword [ebp - 0x50]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x88]
dec eax
mov ebx, eax
mov dword [ebp - 0x20], eax
sub ebx, dword [ecx + 0x14]
sub eax, dword [edx + 0x14]
mov ecx, dword [ecx + 0xc]
mov edx, dword [edx + 0xc]
add eax, edi
mov cx, word [ecx + ebx*2]
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4b9816
jmp 0x4b988b
mov eax, dword [esi + 0xa8]
cmp ebx, eax
jle 0x4b9877
add eax, 0x200
push 0
push eax
push 1
lea edx, [esi + 0xa4]
push 3
push edx
push 4
push 0x80
add byte [eax], 0
add byte [ecx + 0xa886], cl
add bh, bh
adc eax, sym.imp.MSVBVM60.DLL___vbaRedimPreserve
add esp, 0x1c
mov eax, dword [esi + 0xa4]
lea ecx, [edi + edi]
mov edx, dword [eax + 0x14]
sub ebx, edx
mov edx, dword [eax + 0xc]
mov dword [edx + ebx*4], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0x1c]
cmp eax, ecx
je 0x4b98ac
mov ecx, dword [ebp - 0x54]
lea eax, [ecx - 1]
add edi, eax
mov ecx, dword [ebp - 0x4c]
mov eax, 1
add edi, eax
jmp 0x572f4d