joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401350
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41208b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x404
lea ecx, [esp + 4]
push ebp
push esi
push edi
push eax
push 0x400
push ecx
push 0x4181a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x4181a4
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4013b9
test cl, cl
je 0x4013b5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4013b9
add eax, 2
add esi, 2
test cl, cl
jne 0x401395
xor eax, eax
jmp 0x4013be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401464
mov ebp, dword [esp + 0x424]
lea esi, [esp + 0x10]
push ebp
call fcn.004025b0
mov al, byte [esp + 0x14]
add esp, 4
test al, al
je 0x401438
push esi
call fcn.004025b0
add esp, 4
lea ecx, [esp + 0xc]
push eax
call fcn.0040aadb
push ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x41c], 0
call fcn.0040a47b
cmp eax, 0xffffffff
mov edi, esi
jne 0x40147c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x418], 0xffffffff
lea esi, [esi + ecx + 1]
lea ecx, [esp + 0xc]
call fcn.0040aab1
cmp byte [esi], 0
jne 0x4013e2
mov edi, str.Setup_Default
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x410
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x418], 0xffffffff
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
call fcn.0040aab1
jmp 0x40145f

Function at 0x4014c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
sub esp, 0x104
lea ecx, [esp]
push ebx
push esi
push eax
mov eax, dword [esp + 0x11c]
push 0x104
push ecx
push 0x4181a4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x4181a4
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401520
test cl, cl
je 0x40151c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401520
add eax, 2
add esi, 2
test cl, cl
jne 0x4014f8
xor eax, eax
jmp 0x401525
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401532
pop esi
pop ebx
add esp, 0x104
ret
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x120]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x401570
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
push 0x104
push eax
call fcn.00401640
add esp, 8
test eax, eax
je 0x40162b
push ebx
push esi
push edi
lea edi, [esp + 0x110]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x218]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0xc]
pop edi
pop esi
pop ebx
test al, al
je 0x40162b
mov ecx, dword [esp + 0x210]
lea eax, [esp + 0x104]
push 1
push eax
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jb 0x40162b
mov eax, 1
add esp, 0x208
ret
xor eax, eax
add esp, 0x208
ret

Function at 0x4016b0
Capabilities:
Get common file path
Read .ini file
Set environment variable

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x30c
lea ecx, [esp + 0x104]
push ebx
push esi
push eax
push 0x104
push ecx
push 0x4181a4
push str.setnt5xTEMP
push str.env_vars
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x4181a4
lea eax, [esp + 0x10c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401713
test cl, cl
je 0x40170f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401713
add eax, 2
add esi, 2
test cl, cl
jne 0x4016eb
xor eax, eax
jmp 0x401718
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40172a
pop esi
mov eax, 2
pop ebx
add esp, 0x30c
ret
lea eax, [esp + 0x10c]
push eax
call fcn.00402b72
add esp, 4
test eax, eax
je 0x401792
lea ecx, [esp + 0x210]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x210]
lea eax, [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 8]
push str.TEMP
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea edx, [esp + 8]
push edx
push 0x4181b0
call esi
lea eax, [esp + 8]
push eax
push 0x4181ac
call esi
pop esi
mov eax, 1
pop ebx
add esp, 0x30c
ret
Function at 0x4017a0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
lea ecx, [esp]
push ebx
push esi
push eax
push 0x104
push ecx
push 0x4181a4
push str.no_CDB_arhe_9x
push str.env_vars
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x4181a4
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4017fd
test cl, cl
je 0x4017f9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4017fd
add eax, 2
add esi, 2
test cl, cl
jne 0x4017d5
xor eax, eax
jmp 0x401802
sbb eax, eax
sbb eax, 0xffffffff
pop esi
pop ebx
test eax, eax
jne 0x40180f
add esp, 0x104
ret
lea eax, [esp]
push eax
call fcn.00402b72
add esp, 4
add esp, 0x104
ret

Function at 0x40be29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41222c
call fcn.00403204
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00410f7e
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x40be68
call fcn.00410f7e
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40be76
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40be84
or eax, 0xffffffff
jmp 0x40bf6c
mov ecx, esi
call fcn.0040bd9f
mov dword [ebp - 0x14], eax
call fcn.0040cc5c
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x40bebb
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40bebb
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0040cc10
push dword [ebp - 0x14]
call fcn.0040c75e
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0040bb37
cmp eax, edi
je 0x40bf2e
test byte [esi + 0x24], 0x10
je 0x40befc
push 4
mov ecx, esi
pop ebx
call fcn.0040ed06
test ah, 1
je 0x40bef4
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0040e76b
cmp dword [esi + 0x1c], edi
je 0x40bf2e
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0040eda2
jmp 0x40bf2e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x40bf42
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x40bf5b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x40bf5b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0040bdd9
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40e619
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x40e65b
call fcn.00410f7e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x40e65b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x40e652
xor eax, eax
jmp 0x40e663
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0040e669
pop edi
pop esi
pop ebx
ret 4

Function at 0x4116ca
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4116f8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x411716
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00411630
jmp 0x411716
mov eax, dword [esi + 0x14]
test eax, eax
je 0x411716
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00411630
test edi, edi
mov eax, edi
jne 0x411700
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x409710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40971f
pop dword [ebp - 0x2c]
mov eax, 0x79801582
sub eax, 0x793f7e63
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x4ee5c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4322
mov esi, eax
mov edx, 0x62507e1f
add edx, 0x9df80fe1
add edx, dword [ebp - 0x2c]
mov edi, 0x694b1614
add edi, 0x114d71b5
sub dword [ebp - 0x18], 0x38f6db32
mov ebx, dword [edx]
add dword [ebp - 4], edx
xor ebx, edi
xor dword [ebp - 0x10], ebx
mov dword [esi], ebx
xor dword [ebp - 4], 0xadb242d8
add esi, 0xe9150ad2
add esi, 0x16eaf532
add edx, 0x2c81722c
add edx, 0xd37e8dd8
loop 0x409773
add eax, 0xff5b
mov ebx, eax
add eax, 0x6b893b65
sub eax, 0x6b893b60
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x4033fc], eax
mov eax, dword [ebp + 4]
mov dword [0x40323a], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40323a]
mov dword [ebp - 0x48], eax
mov eax, 0x4016df
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40323a]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403448], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403448]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x40a65a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00408a47
mov dword [ebp - 0x14], eax
cmp dword [0x4198c4], edi
jne 0x40a74b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40a6d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40a82b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40a82b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a82b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4198c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4198c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4198cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4198d4], eax
test eax, eax
je 0x40a748
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4198d0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40a770
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40a763
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40a785
push 4
pop eax
jmp 0x40a82d
cmp dword [ebp - 0x14], edi
je 0x40a785
push dword [0x4198c4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40a76a
mov eax, dword [0x4198d0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40a7e3
cmp dword [0x4198d4], esi
je 0x40a7e3
push eax
call ebx
push dword [0x4198d4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40a7e3
test eax, eax
je 0x40a7e3
call ecx
test eax, eax
je 0x40a7d8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40a7d8
test byte [ebp - 8], 1
jne 0x40a7e3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40a813
mov eax, dword [0x4198c8]
cmp eax, esi
je 0x40a810
push eax
call ebx
test eax, eax
je 0x40a810
call eax
mov edi, eax
test edi, edi
je 0x40a810
mov eax, dword [0x4198cc]
cmp eax, esi
je 0x40a810
push eax
call ebx
test eax, eax
je 0x40a810
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4198c4]
call ebx
test eax, eax
je 0x40a82b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40a82d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a83c
leave
ret
Function at 0x1000f79e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000f7ad
pop dword [ebp - 0x4c]
mov eax, 0x623fe35c
add eax, 0xadc11451
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x41fcc
push 0
mov eax, 0x9537247b
add eax, 0x7acbcce1
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x6ef77bbb
sub ecx, 0x6ef72cb9
xor edi, edi
add edi, eax
mov edx, 0x720206b2
add edx, 0x9e02a54e
add edx, dword [ebp - 0x4c]
mov esi, 0x557a560c
sub esi, 0xc275723d
sub dword [ebp - 0x18], edx
mov ebx, dword [edx]
add dword [ebp - 0x3c], edi
xor ebx, esi
xor dword [ebp - 0x14], 0x7eab0c67
mov dword [edi], ebx
add dword [ebp - 0x48], edx
add edi, 4
add edx, 4
loop 0x1000f80e
add eax, 0xd76b266b
add eax, 0x28960870
mov ebx, eax
add eax, 0x14330a18
add eax, 0xebccf5ed
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000f79e
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000f79e
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000f79e
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1000f79e
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000f79e
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x10073404
Capabilities:
Encode data using xor

Disassembly:
call 0x1007337d
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100733ad
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x100733c9
xor edx, 0
jmp 0x100733d4
xor edx, edx
jmp 0x100733eb
jmp 0x100733f7
xor eax, eax
push 0x8427d7c0
call 0x10073404
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x10073440
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x10073419
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x10073457
add eax, 0
jno 0x1007345c
add esi, 0
ret 0x10

Function at 0x100741c5
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x100741e7
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x10074389
cmp edi, dword [ebp + 0x10]
jb 0x10074389
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10073cb1
inc edi
jmp 0x10074270
jmp 0x1007427d
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10073cb1
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10073cb1
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x100742d1
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x100742b5
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.100742ff
add dword [eax], 0x39
jle 0x100742db
sub al, 0xf5
mov ch, al
call fcn.10074314
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10