joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29a307e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ebx, edx
inc ebp
push ebp
push dword [esp + 0x64]
push dword [esp + 0x64]
push dword [esp + 0x64]
push ebp
push ebx
push ecx
call fcn.029a561e
mov dword [esp + 0x60], 0x3786e1
xor esi, esi
mov dword [esp + 0x64], 0x6954ba
add esp, 0x1c
mov dword [esp + 0x4c], esi
xor edx, edx
mov dword [esp + 0x10], 0x359
mov ecx, 0x2574357e
shl dword [esp + 0x10], 8
add dword [esp + 0x10], 0xffff7d74
imul eax, dword [esp + 0x10], 0xa
push 0x1f
pop edi
mov dword [esp + 0x10], eax
xor dword [esp + 0x10], 0x1c1d99
mov dword [esp + 0x38], 0xd0de
mov eax, dword [esp + 0x38]
div edi
mov dword [esp + 0x38], eax
xor dword [esp + 0x38], 0x794
mov dword [esp + 0x1c], 0xce9
add dword [esp + 0x1c], 0xad1
add dword [esp + 0x1c], 0xffff935a
xor dword [esp + 0x1c], 0xffffb322
mov dword [esp + 0x34], 0x79d
xor dword [esp + 0x34], 0x20cc0fb6
xor dword [esp + 0x34], 0x20cc22a6
mov dword [esp + 0x30], 0x698c
add dword [esp + 0x30], 0xe9d4
xor dword [esp + 0x30], 0x13dbc
mov dword [esp + 0x14], 0xc6a
shr dword [esp + 0x14], 0xa
add dword [esp + 0x14], 0xffffe6be
shl dword [esp + 0x14], 2
xor dword [esp + 0x14], 0xffffa310
mov dword [esp + 0x3c], 0x2350
add dword [esp + 0x3c], 0xa4db
xor dword [esp + 0x3c], 0xc2d5
mov dword [esp + 0x24], 0xfe5
add dword [esp + 0x24], 0xffff72d2
add dword [esp + 0x24], 0xfffff704
xor dword [esp + 0x24], 0xffff6d21
mov dword [esp + 0x20], 0x11b5
shl dword [esp + 0x20], 2
add dword [esp + 0x20], 0xfffff1b3
xor dword [esp + 0x20], 0x3b7a
mov dword [esp + 0x2c], 0xeb07
shr dword [esp + 0x2c], 0xb
or dword [esp + 0x2c], 0x3be8e7a4
xor dword [esp + 0x2c], 0x3be88f92
mov dword [esp + 0x18], 0x1f1a
add dword [esp + 0x18], 0xffff032f
shr dword [esp + 0x18], 6
or dword [esp + 0x18], 0x64ca0553
xor dword [esp + 0x18], 0x67ffa598
mov dword [esp + 0x28], 0x9bd9
shr dword [esp + 0x28], 8
add dword [esp + 0x28], 0xffff3091
xor dword [esp + 0x28], 0xffff45ba
mov edi, dword [esp + 0x40]
cmp ecx, 0x9e98051
je 0x29a32cf
cmp ecx, 0x2574357e
je 0x29a32c5
cmp ecx, 0x282704b2
je 0x29a32ab
cmp ecx, 0x32e98f77
je 0x29a3281
cmp ecx, 0x3aa6c900
jne 0x29a32fd
push dword [esp + 0x28]
push dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x48]
call fcn.029ab028
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
lea eax, [esp + 0x40]
mov ecx, edi
push eax
push dword [esp + 0x34]
push dword [esp + 0x3c]
push dword [esp + 0x28]
mov edx, dword [esp + 0x48]
call fcn.029a2333
add esp, 0x10
test eax, eax
je 0x29a3277
mov ecx, 0x9e98051
jmp 0x29a322c
mov eax, dword [esp + 0x10]
call fcn.029b1c1f
mov edi, eax
cmp edi, 0xffffffff
je 0x29a3277
mov ecx, 0x32e98f77
jmp 0x29a322c
mov ecx, 0x282704b2
jmp 0x29a322c
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebp
push ecx
push ebx
push ebp
push dword [esp + 0x54]
mov edx, dword [esp + 0x30]
push dword [esp + 0x78]
mov ecx, dword [esp + 0x60]
call fcn.029babb5
add esp, 0x20
mov ecx, 0x3aa6c900
test eax, eax
cmovne esi, ebp
cmp ecx, 0x7f8d9d0
jne 0x29a322c
jmp 0x29a3277
Function at 0x29aaea5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, edx
push dword [ebp + 8]
push esi
push ecx
call fcn.029a561e
add esp, 0x10
mov dword [ebp - 4], 0x700d
mov eax, dword [ebp - 4]
xor edx, edx
push 0x72
pop edi
div edi
mov dword [ebp - 4], eax
or dword [ebp - 4], 0xa80ec46e
xor dword [ebp - 4], 0xa80ec5f4
cmp esi, 0x40
jae 0x29aaee8
xor eax, eax
jmp 0x29aaf0d
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x29aaee4
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x29aaee4
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp - 4]
cmp edx, ecx
cmovne eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x29ab16c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x30]
push edx
push ecx
call fcn.029a561e
and dword [esp + 0x34], 0
lea edi, [edx + 4]
mov dword [esp + 0x30], 0x4b249a
mov dword [esp + 0x24], 0xa1c4
imul eax, dword [esp + 0x24], 0x61
mov dword [esp + 0x24], eax
xor dword [esp + 0x24], 0x3d4a5d
mov dword [esp + 0x1c], 0x4c53
shr dword [esp + 0x1c], 5
shl dword [esp + 0x1c], 9
or dword [esp + 0x1c], 0x4d949612
xor dword [esp + 0x1c], 0x4d94e734
mov dword [esp + 0x20], 0x7830
add dword [esp + 0x20], 0x5485
shl dword [esp + 0x20], 9
xor dword [esp + 0x20], 0x1997311
mov eax, dword [edx]
mov ebp, dword [edi]
add edi, 4
xor ebp, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
lea esi, [ebp + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 4
mov eax, dword [esp + 0x20]
lea edx, [esi + esi]
call fcn.029a7107
mov ebx, eax
mov dword [esp + 0x20], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x29ab293
shr esi, 2
xor eax, eax
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x29ab28d
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [edx], ax
mov eax, ecx
shr eax, 8
lea edx, [edx + 8]
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [edx - 4], ax
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, esi
jb 0x29ab250
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
xor eax, eax
mov word [ebx + ebp*2], ax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x29ae6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
mov eax, ecx
push ebp
push esi
push edi
push dword [esp + 0x34]
mov dword [esp + 0x18], eax
push ebx
push dword [esp + 0x34]
push edx
push eax
call fcn.029a561e
mov dword [esp + 0x24], 0x8807
xor esi, esi
xor dword [esp + 0x24], 0xfe1edb5d
add esp, 0x14
xor dword [esp + 0x10], 0xfe1e7fa0
mov ebp, esi
mov dword [esp + 0x30], 0x6a5d
shl dword [esp + 0x30], 7
xor dword [esp + 0x30], 0x352715
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x24], eax
mov edi, dword [eax + ebx + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [esp + 0x20], eax
add ecx, ebx
mov eax, dword [edi + 0x24]
add eax, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
cmp dword [edi + 0x18], esi
jbe 0x29ae7a8
mov ecx, dword [ecx + ebp*4]
push dword [esp + 0x30]
mov edx, dword [esp + 0x14]
add ecx, ebx
call fcn.029b169f
xor eax, 0x69d5b12d
pop ecx
cmp eax, dword [esp + 0x14]
je 0x29ae77c
mov ecx, dword [esp + 0x18]
inc ebp
cmp ebp, dword [edi + 0x18]
jb 0x29ae752
jmp 0x29ae7a8
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
movzx eax, word [eax + ebp*2]
mov esi, dword [esi + eax*4]
add esi, ebx
cmp esi, edi
jb 0x29ae7a8
mov eax, dword [esp + 0x24]
mov eax, dword [eax + ebx + 0x7c]
add eax, edi
cmp esi, eax
jae 0x29ae7a8
mov ecx, esi
call fcn.029ae500
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x29aeae3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, dword [esp + 0x30]
push edi
push dword [esp + 0x38]
push esi
push dword [esp + 0x38]
push edx
push ecx
call fcn.029a561e
and dword [esp + 0x38], 0
lea edi, [esi + 4]
and dword [esp + 0x3c], 0
mov dword [esp + 0x30], 0xd93c3
mov dword [esp + 0x34], 0x13c82c
mov dword [esp + 0x24], 0xee50
add dword [esp + 0x24], 0xffff0ba5
xor dword [esp + 0x24], 0xffff8b7d
mov dword [esp + 0x20], 0x5bd0
shr dword [esp + 0x20], 1
xor dword [esp + 0x20], 0x2430
mov dword [esp + 0x48], 0xd644
imul eax, dword [esp + 0x48], 0x53
mov dword [esp + 0x48], eax
imul eax, dword [esp + 0x48], 0xb
mov dword [esp + 0x48], eax
shr dword [esp + 0x48], 1
xor dword [esp + 0x48], 0x17e62b4
mov ecx, dword [esi]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [esp + 0x18]
mov edx, esi
call fcn.029a7107
mov ebx, eax
mov dword [esp + 0x3c], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x29aec08
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x29aebff
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x29aebd6
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x29b169f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push dword [ebp + 8]
mov ebx, ecx
push edx
push ebx
call fcn.029a561e
mov dword [ebp - 8], 0xac17
add esp, 0xc
mov eax, dword [ebp - 8]
xor edx, edx
push 0x65
pop ecx
div ecx
push 0x7c
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 8]
pop ecx
div ecx
mov dword [ebp - 8], eax
xor dword [ebp - 8], 3
mov dword [ebp - 4], 0xa6f3
xor dword [ebp - 4], 0xbd23bc8d
shr dword [ebp - 4], 2
shr dword [ebp - 4], 0xe
xor dword [ebp - 4], 0xbd25
mov dword [ebp - 4], 0xb556
add dword [ebp - 4], 0x35ee
or dword [ebp - 4], 0xa8ace9e5
shl dword [ebp - 4], 0xa
xor dword [ebp - 4], 0xb3af9410
cmp byte [ebx], 0
je 0x29b1784
push esi
push edi
mov edi, dword [ebp - 8]
mov dword [ebp - 4], 0xa6f3
xor dword [ebp - 4], 0xbd23bc8d
shr dword [ebp - 4], 2
shr dword [ebp - 4], 0xe
xor dword [ebp - 4], 0xbd25
mov cl, byte [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0xb556
add dword [ebp - 4], 0x35ee
or dword [ebp - 4], 0xa8ace9e5
shl dword [ebp - 4], 0xa
xor dword [ebp - 4], 0xb3af9410
shl esi, cl
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
movsx eax, byte [ebx]
mov dword [ebp - 8], eax
add dword [ebp - 8], esi
shl edx, cl
add dword [ebp - 8], edx
sub dword [ebp - 8], edi
inc ebx
cmp byte [ebx], 0
jne 0x29b171d
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x29b3882
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
push ebp
push dword [esp + 0x40]
push dword [esp + 0x40]
push edx
push ecx
call fcn.029a561e
mov dword [esp + 0x38], 0x616f8
xor esi, esi
mov dword [esp + 0x3c], 0x50675c
add esp, 0x14
mov dword [esp + 0x2c], 0x38b791
mov ebx, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x10], 0x3470
shr dword [esp + 0x10], 0xd
xor dword [esp + 0x10], 0x5b4013f4
xor dword [esp + 0x10], 0x5b407481
mov dword [esp + 0x40], 0x9def
add dword [esp + 0x40], 0x2299
shr dword [esp + 0x40], 0xb
xor dword [esp + 0x40], 0x7aef
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x20], eax
mov edi, dword [eax + ebp + 0x78]
add edi, ebp
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebp
mov dword [esp + 0x1c], eax
add ecx, ebp
mov eax, dword [edi + 0x24]
add eax, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [edi + 0x18], esi
jbe 0x29b3975
push dword [esp + 0x3c]
mov ecx, dword [ecx + ebx*4]
push dword [esp + 0x44]
mov edx, dword [esp + 0x18]
add ecx, ebp
call 0x29a0648
pop ecx
pop ecx
test eax, eax
je 0x29b394f
mov ecx, dword [esp + 0x14]
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x29b3927
jmp 0x29b3975
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, word [eax + ebx*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, edi
jb 0x29b3975
mov ecx, dword [esp + 0x20]
xor eax, eax
mov ecx, dword [ecx + ebp + 0x7c]
add ecx, edi
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x406bed
Capabilities:
Resume thread
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4011e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], sym.imp.MSVBVM60.DLL___vbaNew
mov edx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaOnError]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x68], esi
call edi
mov ecx, dword [ebp + 0xc]
mov edx, 0x401b20
call edi
mov ecx, dword [ebp + 0x10]
mov edx, 0x401b20
call edi
mov ecx, dword [ebp + 0x14]
mov edx, 0x401b20
call edi
mov ecx, dword [ebp + 0x18]
mov edx, 0x401b20
call edi
mov ecx, dword [ebp + 0x1c]
mov edx, 0x401b20
call edi
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaErase]
mov edx, eax
lea ecx, [ebp - 0x18]
call ebx
mov ecx, dword [ebp - 0x18]
push ecx
push 0x401b20
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
test eax, eax
je 0x407051
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x54], 0x401b28
mov dword [ebp - 0x5c], 8
call dword [sym.imp.MSVBVM60.DLL_rtcDoEvents]
mov eax, dword [ebp - 0x18]
push esi
lea edx, [ebp - 0x3c]
push 2
push edx
lea ecx, [ebp - 0x4c]
push eax
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
lea edx, [ebp - 0x4c]
push edx
push 0x2008
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x402656
jmp 0x40707c
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaI2I4]
lea ecx, [ebp - 0x68]
call esi
lea ecx, [ebp - 0x18]
call esi
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
lea ecx, [ebp - 0x20]
call esi
lea ecx, [ebp - 0x24]
call esi
ret
Function at 0x4070bd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4011e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], sym.imp.MSVBVM60.DLL_EVENT_SINK_QueryInterface
mov edx, dword [ebp + 8]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaOnError]
xor edi, edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edi
call esi
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
call esi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x34]
call esi
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x3c]
call esi
push 3
push edi
push edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.DLL_AllocateAndInitializeSid]
mov ebx, eax
cmp ebx, edi
je 0x4071db
mov eax, dword [ebp - 0x3c]
push eax
push edi
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaErase]
mov edx, eax
lea ecx, [ebp - 0x40]
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId]
mov edx, eax
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaI2I4]
mov ecx, dword [ebp - 0x18]
push edi
mov edx, dword [ebp - 0x30]
push edi
mov eax, dword [ebp - 0x24]
push edi
push edi
push edi
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
mov esi, eax
call dword [sym.imp.WTSAPI32.DLL_WTSQueryUserToken]
cmp eax, 0x431
jne 0x4071a8
cmp esi, edi
jne 0x4071ac
mov dword [ebp - 0x2c], 0xffffffff
jmp 0x4071d4
cmp esi, edi
je 0x4071d4
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], 0xffffffff
push ecx
call dword [sym.imp.MSVBVM60.DLL__adj_fdiv_m32]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.DLL_StartServiceCtrlDispatcherW]
push esi
call dword [sym.imp.ADVAPI32.DLL_SetServiceStatus]
push ebx
call dword [sym.imp.ADVAPI32.DLL_SetServiceStatus]
mov eax, dword [ebp - 0x2c]
push 0x4027c5
mov dword [ebp - 0x28], eax
jmp 0x4071f2
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaI2I4]
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x24]
call esi
lea ecx, [ebp - 0x30]
call esi
lea ecx, [ebp - 0x34]
call esi
lea ecx, [ebp - 0x3c]
call esi
ret
Function at 0x4075ed
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
xor esi, esi
mov dword [esp + 0xc], eax
mov ecx, 5
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov word [esp + 0x10], ax
call dword [sym.imp.MSVBVM60.DLL__adj_fprem1]
lea ecx, [esp + 4]
mov byte [esp + 0x11], al
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
mov ecx, 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
lea edx, [esp + 0x30]
push eax
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test eax, eax
je 0x407671
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.DLL_CheckTokenMembership]
test eax, eax
je 0x407666
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, esi
setne dl
neg edx
mov esi, edx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
mov ax, si
pop esi
add esp, 0x10
ret
Function at 0x40be13
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x170
push esi
xor esi, esi
push edi
lea eax, [esp + 0x28]
push esi
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x38], 0xc
mov dword [esp + 0x40], 1
mov dword [esp + 0x3c], esi
call dword [fcn.00405030]
test eax, eax
jne 0x40be5e
pop edi
pop esi
add esp, 0x170
ret 4
mov eax, dword [esp + 8]
push esi
push 1
push eax
call dword [fcn.0040502c]
test eax, eax
jne 0x40be7b
pop edi
pop esi
add esp, 0x170
ret 4
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x34]
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], ecx
push edx
mov dword [esp + 0x28], ecx
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x2c]
or eax, 0x101
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x184]
push esi
push esi
push esi
push 1
push ecx
push edx
push eax
push esi
mov word [esp + 0x8c], si
call dword [fcn.00405028]
test eax, eax
jne 0x40bf10
mov ecx, dword [esp + 0xc]
mov esi, dword [fcn.0040501c]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x170
ret 4
mov eax, dword [esp + 0x18]
push ebx
push ebp
push 0x64
push eax
call dword [fcn.004050e8]
mov ecx, dword [esp + 0x14]
push ecx
call dword [fcn.0040501c]
mov edi, dword [0x4064d4]
mov ebx, dword [0x405024]
mov ecx, 0x80000
xor eax, eax
rep stosd dword es:[edi], eax
xor ebp, ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x80]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
push esi
push edx
lea eax, [esp + 0x88]
push 0xff
push eax
push ecx
mov dword [esp + 0x2c], esi
call ebx
mov edx, eax
mov eax, dword [esp + 0x18]
cmp eax, esi
jbe 0x40bfbd
add ebp, eax
cmp ebp, 0x200000
mov dword [esp + 0x1c], ebp
jae 0x40bfbd
lea edi, [esp + 0x80]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x4064d4]
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp edx, esi
jne 0x40bf41
mov edx, dword [0x4064d4]
push edx
call fcn.0040bd83
mov edi, dword [fcn.0040501c]
mov esi, eax
mov eax, dword [esp + 0x20]
push eax
call edi
mov ecx, dword [esp + 0x24]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x170
ret 4
Function at 0x417500
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push 0x4033f8
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x417559
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push eax
push 0x40346c
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
add esp, 8
ret