joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10874058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.108741a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1087407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087406a
add dl, dl
jne 0x10874089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108740dc
xor eax, eax
add dl, dl
jne 0x10874096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087417d
add dl, dl
jne 0x108740a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108740d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10874075
mov eax, 1
add dl, dl
jne 0x108740ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108740e1
sub eax, ebx
mov ebx, 1
jne 0x10874128
mov ecx, 1
add dl, dl
jne 0x1087410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10874119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10874105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10874075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1087413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10874136
cmp eax, 0x7d00
jae 0x1087416d
cmp eax, 0x500
jb 0x10874168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10874075
cmp eax, 0x7f
ja 0x10874170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10874075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1087419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10874075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x473138
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4731d2
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x47f0e4]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x47f0e4]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x47f0e4]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x47f0e4]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x473157
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4731e8
dec edx
je 0x47321d
jmp 0x47326e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x47f0e4]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x47f0e4]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x47326e
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x47f0e4]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x47f0e4]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x47f0e4]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x473f88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x473fa9
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x473f96
pop edi
pop esi
pop ebx
ret

Function at 0x478874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, eax
dec edx
test dl, dl
jb 0x47889f
inc edx
mov al, 0
movzx esi, al
movzx ecx, byte [edi + esi]
xor cl, byte [ebp - 1]
push ecx
mov ecx, dword [ebp + 8]
pop ebx
mov byte [ecx + esi], bl
inc eax
dec dl
jne 0x478888
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x479edc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword ss:[esp + 4]
push esi
mov esi, dword ss:[esp + 0xc]
xor eax, eax
sub esi, 1
js 0x479f0d
movzx edx, byte ds:[ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword ds:[edx*4 + 0x4802dc]
add ecx, 1
sub esi, 1
jns 0x479eee
pop esi
ret

Function at 0x479f1c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword ss:[esp + 8]
push ebp
mov ebp, dword ss:[esp + 8]
mov dword ds:[eax], 0xe4665400
mov dword ds:[eax + 4], 0x4363ffff
mov dword ds:[eax + 8], 0xd4613211
mov dword ds:[eax + 0xc], 0xc9130600
mov dword ds:[eax + 0x10], 0x9740002
mov dword ds:[eax + 0x14], 0xa66578f
mov dword ds:[eax + 0x18], 0x1bbca1ee
mov dword ds:[eax + 0x1c], 0x31207028
mov dl, byte ss:[ebp]
push esi
xor ecx, ecx
test dl, dl
push edi
mov esi, ebp
je 0x479f8c
movsx edx, dl
add dword ds:[eax + ecx*4], edx
mov dl, byte ds:[esi + 1]
add esi, 1
add ecx, 1
and ecx, 7
test dl, dl
jne 0x479f74
mov ecx, ebp
lea esi, ds:[ecx + 1]
mov dl, byte ds:[ecx]
add ecx, 1
test dl, dl
jne 0x479f92
sub ecx, esi
mov edi, ecx
xor ecx, ecx
sub edi, 1
mov esi, ebp
js 0x479fc8
movzx edx, byte ds:[esi]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword ds:[edx*4 + 0x4802dc]
add esi, 1
sub edi, 1
jns 0x479fa9
not ecx
shl ecx, 0x10
xor dword ds:[eax], ecx
xor dword ds:[eax + 4], ecx
xor dword ds:[eax + 8], ecx
xor dword ds:[eax + 0xc], ecx
xor dword ds:[eax + 0x10], ecx
xor dword ds:[eax + 0x14], ecx
xor dword ds:[eax + 0x18], ecx
xor dword ds:[eax + 0x1c], ecx
pop edi
pop esi
mov al, 1
pop ebp
ret
Function at 0x4d254b
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [ebp + 0xd2778f8], 0x8088405
inc edx
mov dword [ebp + 0xd2778f8], edx
mul edx
ret

Function at 0x4d292b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x100]
lodsb al, byte [esi]
or al, al
je 0x4d2954
inc ecx
test cl, 3
je 0x4d2951
shl eax, 8
jmp 0x4d2941
stosd dword es:[edi], eax
jmp 0x4d2941
mov al, 0x80
push ecx
inc ecx
test cl, 3
je 0x4d2962
shl eax, 8
jmp 0x4d2957
stosd dword es:[edi], eax
xor eax, eax
jmp 0x4d296b
stosd dword es:[edi], eax
add ecx, 4
cmp ecx, 0x3c
jb 0x4d2967
pop eax
shl eax, 3
stosd dword es:[edi], eax
sub ecx, 0xc
mov eax, dword [edi - 0x3c]
push ecx
mov ecx, eax
mov edx, eax
ror eax, 7
ror ecx, 0x12
shr edx, 3
xor eax, ecx
xor eax, edx
push eax
mov eax, dword [edi - 8]
mov ecx, eax
mov edx, eax
ror eax, 0x11
ror ecx, 0x13
shr edx, 0xa
xor eax, ecx
xor eax, edx
add dword [esp], eax
pop eax
add eax, dword [edi - 0x40]
pop ecx
add eax, dword [edi - 0x1c]
stosd dword es:[edi], eax
loop 0x4d2978
call int.004d29d5
out 9, al
push 0xffffffffffffff85
scasb al, byte es:[edi]
mov ebx, 0x3c6ef372
cmp dh, ch
dec edi
movsd dword es:[edi], dword [esi]
jg 0x4d2a19
push cs
push ecx
mov word [eax + 5], gs
wait
stosd dword es:[edi], eax
fld dword [ebx - 0x1f32e6e1]
pop ebx
invalid

Function at 0x4d69ec
Capabilities:
Encode data using xor

Disassembly:
sub eax, eax
dec eax
inc esi
mov ecx, 0xefb5
inc edi
not esi
imul ecx, edx
sub esi, 0xd407c827
xor byte [edi - 1], cl
inc edi
cmp esi, 0x3e
xor esi, 0x33
sub byte [edi - 2], dh
xchg ecx, edx
not ecx
sub eax, 0xfffffff8
xchg dh, dl
not cl
mov cl, ch
dec edi
cmp eax, 0x33017
nop
jbe 0x4d69f0
dec edx
setg dl
xor al, 0x3c
dec eax
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x16e2008], 0x8088405
inc edx
mov dword [ebx + 0x16e2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x16c658e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16c6595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x16c78f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x16e454c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x16e454c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x16e3378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16c78fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x5c6220
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x123000]
push edi
or ebp, 0xffffffff
jmp 0x5c6242
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c6249
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c6238
mov eax, 1
add ebx, ebx
jne 0x5c625b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c626c
jne 0x5c628b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c628b
dec eax
add ebx, ebx
jne 0x5c6278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c6250
add ebx, ebx
jne 0x5c6287
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c62dd
xor ecx, ecx
sub eax, 3
jb 0x5c62a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c6312
sar eax, 1
mov ebp, eax
jmp 0x5c62ae
add ebx, ebx
jne 0x5c62ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c627c
inc ecx
add ebx, ebx
jne 0x5c62bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c627c
add ebx, ebx
jne 0x5c62c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c62be
jne 0x5c62da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c62be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c62fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c62ee
jmp 0x5c623e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c62fc
add edi, ecx
jmp 0x5c623e
pop esi
mov edi, esi
mov ecx, 0x7278
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c631a
cmp byte [edi], 0x4c
jne 0x5c631a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c631f
lea edi, [esi + 0x1c3000]
mov eax, dword [edi]
or eax, eax
je 0x5c6397
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1eaa8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1eabe8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c634c
mov ecx, edi
jns 0x5c637b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1eabf0]
or eax, eax
je 0x5c6391
mov dword [ebx], eax
add ebx, 4
jmp 0x5c6369
call dword [esi + 0x1eabec]
mov ebp, dword [esi + 0x1eabf4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c63cb
sub esp, 0xffffff80
jmp 0x42f8ef
Function at 0x112bb771
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x11001d86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x4c
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x110011c0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x112bb898
cmp dword [ebp - 0x5c], 1
je 0x112bb7cf
cmp dword [ebp - 0x5c], 2
je 0x112bb827
cmp dword [ebp - 0x5c], 3
je 0x112bb861
jmp 0x112bb8dd
and dword [ebp - 0x50], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push 0x112df050
call sub.MSVBVM60.DLL_UserDllMain
test eax, eax
jne 0x112bb7f3
jmp 0x112bb8dd
call sub.KERNEL32.DLL_TlsAlloc
mov dword [0x112df048], eax
cmp dword [0x112df048], 0xffff
jne 0x112bb80e
jmp 0x112bb8dd
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.112bba4b
and ax, 1
movsx eax, ax
mov dword [ebp - 0x14], eax
jmp 0x112bb8dd
and dword [ebp - 0x50], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push 0x112df050
call sub.MSVBVM60.DLL_UserDllMain
test eax, eax
jne 0x112bb84b
jmp 0x112bb8dd
push 0
push dword [ebp + 8]
call fcn.112bba4b
and ax, 1
movsx eax, ax
mov dword [ebp - 0x14], eax
jmp 0x112bb8dd
and dword [ebp - 0x50], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push 0x112df050
call sub.MSVBVM60.DLL_UserDllMain
test eax, eax
jne 0x112bb882
jmp 0x112bb8dd
push dword [ebp + 8]
call fcn.112bb920
call fcn.112bb9b1
mov dword [ebp - 0x14], 1
jmp 0x112bb8dd
call fcn.112bbc52
and dword [ebp - 0x50], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push 0x112df050
call sub.MSVBVM60.DLL_UserDllMain
call fcn.112bb9b1
push dword [0x112df048]
call sub.KERNEL32.DLL_TlsFree
and dword [0x112df048], 0
and dword [0x112df04c], 0
mov dword [ebp - 0x14], 1
push 0x112bb90c
jmp 0x112bb90b
ret

Function at 0x112bbc52
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x11001d86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x44
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x11001200
push dword [0x112df048]
call sub.KERNEL32.DLL_TlsGetValue
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x112bbc95
jmp 0x112bbcc7
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x3c
push eax
call sub.MSVBVM60.DLL_GetMem1
movzx ax, byte [ebp - 0x14]
or al, 1
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
add eax, 0x3c
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVBVM60.DLL_GetMem1
push dword [ebp - 0x18]
call sub.MSVBVM60.DLL_VBDllCanUnloadNow
push 0x112bbcf6
jmp 0x112bbcf5
ret
Function at 0x112bbf1c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x11001d86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push 0x58
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x11001220
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x64
push dword [0x112df04c]
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [0x112df04c]
add eax, 0x2c
mov dword [ebp - 0x20], eax
and dword [ebp - 0x64], 0
push dword [ebp - 0x20]
lea eax, [ebp - 0x64]
push eax
call sub.MSVBVM60.DLL_GetMem4
and dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x18]
push 0x64
push dword [0x112df04c]
call sub.KERNEL32.DLL_VirtualProtect
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x112df04c]
add eax, 0x4c
push eax
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x112df04c]
add eax, 0x44
push eax
call sub.MSVBVM60.DLL_GetMem2
cmp dword [ebp - 0x1c], 0
jle 0x112bc02f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x20]
add eax, 0x28
push eax
call sub.MSVBVM60.DLL_GetMem4
mov eax, dword [ebp - 0x28]
and eax, 0x10
test eax, eax
je 0x112bc01d
mov eax, dword [ebp - 0x28]
and eax, 0xffffffef
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x20]
add eax, 0x28
push eax
lea eax, [ebp - 0x28]
push eax
call sub.MSVBVM60.DLL_GetMem4
and dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x18]
push 4
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jmp 0x112bbfb3
push 0x112bc05e
jmp 0x112bc05d
ret