joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e88
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x35c
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x410a2c]
and ebx, 0x100
test edx, edx
je 0x403ed1
mov esi, dword [ebp + 8]
mov eax, 0x40d540
test ebx, ebx
mov ecx, 0x40d543
cmove eax, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s_bit_search:_t_s..._n
mov dword [esp], edx
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x334]
mov dword [esp + 0x10], eax
mov eax, ebx
or eax, 0x20019
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x404090
lea edi, [ebp - 0x324]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov dword [ebp - 0x330], 0x104
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edx, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x334]
lea esi, [ebp - 0x32c]
mov dword [ebp - 0x33c], edx
lea edi, [ebp - 0x220]
lea edx, [ebp - 0x330]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExA
sub esp, 0x20
test eax, eax
jne 0x404081
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x324]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004025e6
mov eax, dword [0x410a2c]
test eax, eax
je 0x403fd1
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x220]
lea edi, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004023b8
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00403dc7
test eax, eax
je 0x404049
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call fcn.0040293e
test eax, eax
je 0x404049
mov dword [esp + 4], edi
mov dword [esp], 0x418e5c
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [0x418c4c], eax
mov eax, dword [0x410a2c]
test eax, eax
je 0x404081
mov dword [esp + 8], edi
mov dword [esp + 4], str.Match:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x404081
mov eax, dword [0x410a2c]
test eax, eax
je 0x40406c
lea edx, [ebp - 0x11c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Ignore:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x330], 0x104
mov eax, dword [ebp - 0x33c]
jmp 0x403f37
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40425d
Capabilities:
Create pipe

Disassembly:
push ebp
mov eax, 0x824c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040b3d0
sub esp, eax
mov esi, dword [ebp + 8]
cmp dword [0x410024], 0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x8230], 0
mov dword [ebp - 0x822c], 0
je 0x4042bf
mov eax, dword [0x410a2c]
test eax, eax
je 0x4042bf
mov dword [esp + 0x10], 0x418ddc
mov dword [esp + 0xc], 0x418d5c
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check_Java_Version:__s_min_s_max_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x8228]
mov dword [esp + 8], eax
lea eax, [ebp - 0x822c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8230]
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [ebp - 0x8228], 0xc
mov dword [ebp - 0x8220], 1
mov dword [ebp - 0x8224], 0
call sub.kernel32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x40432e
mov eax, dword [0x410a2c]
test eax, eax
je 0x404327
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_create_pipe_n
call sub.msvcrt.dll_fputs
xor eax, eax
jmp 0x404497
mov eax, dword [ebp - 0x8230]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.kernel32.dll_SetHandleInformation
sub esp, 0xc
test eax, eax
jne 0x404386
mov eax, dword [0x410a2c]
test eax, eax
je 0x40436c
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_set_handle_information_n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x822c]
jmp 0x404410
xor eax, eax
mov ecx, 0x2000
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x811c]
mov cl, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 4], esi
lea esi, [ebp - 0x811c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call fcn.00402629
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x8018]
mov dword [esp + 8], str.__s___version
mov dword [esp + 4], 0x8000
mov dword [esp], esi
call fcn.00405f50
mov eax, dword [ebp - 0x822c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00403cc0
test eax, eax
jne 0x40441e
mov eax, dword [0x410a2c]
test eax, eax
je 0x40440a
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_run_java_w___version_n
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
jmp 0x404327
xor eax, eax
mov ecx, 0x20
lea edi, [ebp - 0x821c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x819c]
lea esi, [ebp - 0x821c]
mov cl, 0x20
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x8230]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00403b64
mov eax, dword [ebp - 0x8230]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x821c], 0
push edi
lea edi, [ebp - 0x819c]
je 0x404327
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004023b8
mov eax, dword [ebx]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00403dc7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404cc0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x404d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x404ddb
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x404d61
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x404d49
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x404d59
cmp ecx, 0x40
je 0x404d59
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00404cc0
lea esi, [esi]
lea edi, [edi]
Function at 0x40ba30
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00405060
call sub.kernel32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ba66
jmp 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba63
cmp al, 0x20
je 0x40ba63
cmp al, 0x22
jne 0x40ba89
jmp 0x40baf4
cmp al, 0x20
lea esi, [esi]
je 0x40ba90
test al, al
je 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x40ba77
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40bb0a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba97
cmp al, 0x20
je 0x40ba97
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40bab4
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401803
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40bafe
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x40baf0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x40ba90
cmp al, 9
je 0x40ba97
jmp 0x40baa5
Function at 0x479400
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x401f90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x479415

Function at 0x47a996
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x70107c]
jne 0x47a9a0
repz ret
jmp fcn.0047b2a4

Function at 0x47e186
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x70107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047bc6f
and dword [ebp - 0x14], 0
cmp dword [0x7029e0], 0
mov dword [ebp - 0x18], eax
jne 0x47e239
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x47e2e1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x47e2e1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x7029e0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x7029e4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x7029e8], eax
call edi
push eax
call esi
mov dword [0x7029f0], eax
test eax, eax
je 0x47e239
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x7029ec], eax
mov eax, dword [0x7029ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x47e292
cmp dword [0x7029f0], ecx
je 0x47e292
push eax
call esi
push dword [0x7029f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x47e292
test ebx, ebx
je 0x47e292
call edi
test eax, eax
je 0x47e289
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x47e289
test byte [ebp - 8], 1
jne 0x47e292
or dword [ebp + 0x10], 0x200000
jmp 0x47e2c5
mov eax, dword [0x7029e4]
cmp eax, dword [ebp - 0x18]
je 0x47e2c5
push eax
call esi
test eax, eax
je 0x47e2c5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x47e2c5
mov eax, dword [0x7029e8]
cmp eax, dword [ebp - 0x18]
je 0x47e2c5
push eax
call esi
test eax, eax
je 0x47e2c5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x7029e0]
call esi
test eax, eax
je 0x47e2e1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x47e2e3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047a996
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x60e939e2
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x71583c9d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x407004
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
push esi
push eax
mov dword [0x453a18], 0xe19
add dword [0x453a18], 0x37
push dword [0x453a18]
pop edi
push edi
pop dword [0x453a92]
mov dword [0x453937], 0xb5b
and dword [0x453937], 0xffff
mov ecx, dword [0x453937]
mov dword [0x453b97], ecx
mov ecx, 0xba9
sub ecx, dword [0x4524bb]
add ecx, dword [0x452506]
mov dword [ebp - 0x28], ecx
push 0x70
push 0x453b68
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x4537b6], eax
pop eax
pop esi
pop edi
leave
ret 0xc

Function at 0x407200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push edi
push esi
push eax
push 5
push 0x453bf8
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x453d7e], eax
push 0x41
push 0x453863
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x453a2d], eax
mov ecx, 0x152
add ecx, 0xab1
mov dword [ebp - 0x2c], ecx
mov dword [0x453a91], 0x16e
dec dword [0x453a91]
or dword [0x453a91], 0x51
mov ecx, dword [0x453a91]
mov dword [0x453965], ecx
mov dword [0x45399f], 0x80c
add dword [0x45399f], 4
mov ecx, dword [0x45399f]
mov dword [0x453b0d], ecx
mov dword [0x453d20], 0x1dd
add dword [0x453d20], 0x49
test dword [0x453d20], 0xc11
je 0x4072a2
or dword [0x453d20], 0xda
mov edx, dword [0x453d20]
mov dword [0x453d6a], edx
mov dword [0x453bcc], 0x8f4
inc dword [0x453bcc]
dec dword [0x453bcc]
mov esi, dword [0x453bcc]
mov dword [0x453ba4], esi
push 0x66
push 0x453c74
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x4539d1], eax
push 0xc
push dword [0x452068]
push dword [0x45238f]
push 0
push str.eeROZEJxWLKz
call dword [sym.imp.SHELL32.DLL_ExtractIconExA]
mov dword [0x453b05], eax
mov dword [0x453942], 0xc7e
and dword [0x453942], 0xff
mov eax, dword [0x453942]
mov dword [0x453e98], eax
mov esi, 0xfa
push esi
pop dword [0x453c22]
push esi
pop dword [0x453acf]
mov esi, 0x391
sub esi, dword [0x4525a0]
push esi
pop dword [0x453be4]
push 0x1d
push 0x453b0c
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x453cf1], eax
pop eax
pop esi
pop edi
leave
ret 4

Function at 0x4073d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push esi
push eax
push 0
push 0x453a20
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x453b82], eax
push 0x2d
push 0
push dword [0x452699]
push 0x1a
push str.zCHcZVIU
call dword [sym.imp.SHELL32.DLL_ExtractIconExA]
mov dword [0x453be9], eax
mov dword [0x453b5f], 0x262
dec dword [0x453b5f]
mov ebx, dword [0x453b5f]
mov dword [0x4537a1], ebx
mov dword [0x453d25], 0xec7
mov ecx, dword [0x453d25]
mov dword [0x453a70], ecx
mov dword [ebp - 0xc], ecx
mov ebx, 0x3a7
shr ebx, 1
sub ebx, 0x73e
push ebx
pop dword [0x453988]
mov ecx, 0x655
add ecx, dword [0x452364]
mov dword [0x453830], ecx
mov dword [0x453dfe], 0x9c2
or dword [0x453dfe], 0x88
dec dword [0x453dfe]
mov ecx, dword [0x453dfe]
mov dword [0x453e4a], ecx
pop eax
pop esi
pop edi
leave
ret 0x10
Function at 0x407db2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push esi
push 0x6d
push 0x453972
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x453853], eax
push 0x68
push dword [0x4522c8]
push dword [0x452385]
push 0x2e
push str.NttbtMrBS
call dword [sym.imp.SHELL32.DLL_ExtractIconExA]
mov dword [0x453bd5], eax
mov dword [0x4542c6], 0xf5e706c7
add dword [0x4542c6], 0xa597ccb
push 0xa
push 0
push 0
push 0x2f
push str.KhBhgLVSI
call dword [sym.imp.SHELL32.DLL_ExtractIconExA]
mov dword [0x453ac5], eax
push 0x6f
push 0x45378f
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x4538f2], eax
push 0x35
push 0
push 0
push 0x66
push str.rFVfhU
call dword [sym.imp.SHELL32.DLL_ExtractIconExA]
mov dword [0x453cb1], eax
push 0
push str.FfVMtFgBZe
call dword [sym.imp.advapi32.dll_CryptSetProviderA]
push dword [ebp - 4]
mov dword [0x453a37], 0x9a8
or dword [0x453a37], 0x14
dec dword [0x453a37]
mov ebx, dword [0x453a37]
mov dword [0x453e48], ebx
push edi
push 0x10
lea edx, [0x56]
push edx
call fcn.00407368
mov esi, 0xfcb
push esi
pop dword [0x453b35]
mov ebx, dword [0x453b35]
push ebx
pop dword [0x45399b]
mov edi, 0xab
sub edi, dword [0x4526d1]
add edi, dword [0x452604]
push edi
pop dword [0x453896]
mov ecx, 0x77f
sub ecx, dword [0x452604]
mov dword [0x453e82], ecx
mov edx, 0xaf1
sub edx, dword [0x452604]
push edx
pop dword [0x453d9f]
mov edi, 0x951
sub edi, dword [0x452604]
mov dword [ebp - 0x10], edi
push eax
push eax
call dword [sym.imp.urlmon.dll_HlinkNavigateMoniker]
mov dword [0x453c6f], 0x830
or dword [0x453c6f], 0xdfe
dec dword [0x453c6f]
mov esi, dword [0x453c6f]
mov dword [0x453e1d], esi
mov dword [0x453b2f], 0xdd
or dword [0x453b2f], 0x213
or dword [0x453b2f], 0xd1a
jne 0x407f3a
mov ecx, dword [0x453b2f]
mov dword [0x453934], ecx
push dword [0x45223c]
push str.ilbIpEoffb
call dword [sym.imp.advapi32.dll_CryptSetProviderA]
push dword [ebp - 8]
push esi
push dword [ebp - 8]
mov ecx, 0x57e
ror ecx, 0x19
shr ecx, 8
push ecx
pop dword [0x453df7]
push dword [ebp - 0x10]
call fcn.004073d0
push eax
push eax
call dword [sym.imp.urlmon.dll_HlinkNavigateMoniker]
mov ecx, 0x67e
sub ecx, dword [0x4520a9]
mov dword [0x453b09], ecx
mov dword [0x453a5a], 0xa01
and dword [0x453a5a], 0xffff
add dword [0x453a5a], 0x75
mov esi, dword [0x453a5a]
mov dword [0x453e6b], esi
mov edx, 0xc9a
add edx, dword [0x452502]
push edx
pop dword [0x453d72]
push 0x453dd0
mov dword [0x453a40], 0x49c
or dword [0x453a40], 0x15
dec dword [0x453a40]
mov ecx, dword [0x453a40]
mov dword [0x453e28], ecx
push ebp
mov edi, 0x5b9
sub edi, dword [0x45255e]
mov dword [0x453ace], edi
push 0x70
push dword [ebp - 0xc]
call fcn.004073d0
add eax, 0x80397fb8
push eax
ret
Function at 0x420140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x419015
lea edi, [esi - 0x18015]
push edi
jmp 0x42015a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420150
mov eax, 1
add ebx, ebx
jne 0x420173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x420168
jne 0x420184
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420168
xor ecx, ecx
sub eax, 3
jb 0x420198
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42020a
mov ebp, eax
add ebx, ebx
jne 0x4201a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4201b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4201d4
inc ecx
add ebx, ebx
jne 0x4201c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4201b5
jne 0x4201d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4201b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4201f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4201e5
jmp 0x420156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4201f4
add edi, ecx
jmp 0x420156
pop esi
mov edi, esi
mov ecx, 0x12e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x420212
cmp byte [edi], 2
jne 0x420212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x420217
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x420286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20058]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x200d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x420244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x200d4]
or eax, eax
je 0x420280
mov dword [ebx], eax
add ebx, 4
jmp 0x420261
call dword [esi + 0x200e4]
mov ebp, dword [esi + 0x200d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x202e1]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4202d2
sub esp, 0xffffff80
jmp 0x4012e0
Function at 0x419e50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x4024a8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.004061f8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004061ac
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x41a005
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x419f26
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.004062cc
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x41a005
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x405394
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.00406258
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x41a005
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x419fa3
mov dword [ebp - 0x8c], 0
jmp 0x419faf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x419fe6
mov dword [ebp - 0x90], 0
jmp 0x419ff2
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x419ef4
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405e58
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x41a02d
jmp 0x41a02c
ret