joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb5f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5836d0
mov esi, dword fs:[0]
mov dword [eax], esi
mov dword fs:[0], eax
movzx eax, byte [edx + 4]
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x40fba2
cmp eax, 1
jne 0x40fbab
xor eax, eax
jmp 0x40fbad
mov dword [ebp - 0x64], 0x80000000
jmp 0x40fbc1
mov al, 1
lea edx, [ebp - 0x35]
lea ecx, [ebp - 0x64]
mov dword [edx + 1], 0x2020201
mov byte [edx], al
call fcn.0040fd67
and dword [ebp - 0x10], 0
mov ecx, pe_nt_image_headers32
call fcn.0040651b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x64]
lea eax, [esi + 0x15c]
push 0x2c
push ecx
push eax
call fcn.0058a110
add esp, 0xc
lea eax, [esi + 0x30]
push 0x126
push 0
push eax
call fcn.0058a690
add esp, 0xc
mov edi, dword [ebp - 0x28]
lea ecx, [esi + 0x1ec]
mov bl, byte [edi + 6]
call fcn.0040f094
mov ecx, dword [ebp - 0x24]
mov al, 1
and dword [esi + 0x2f8], 0
and dword [esi + 0x2f4], 0
and dword [esi + 0x300], 0
and dword [esi + 0x2fc], 0
and dword [esi + 4], 0
and dword [esi], 0
and dword [esi + 0xc], 0
and dword [esi + 8], 0
and dword [esi + 0x14], 0
and dword [esi + 0x10], 0
and dword [esi + 0x1c], 0
and dword [esi + 0x18], 0
mov dword [esi + 0x20], 0x80000000
and dword [esi + 0x2c], 0
mov byte [esi + 0x156], bl
mov byte [esi + 0x157], al
and dword [esi + 0x158], 0
mov dword [esi + 0x188], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x18c], ecx
mov dword [esi + 0x190], pe_nt_image_headers32
and dword [esi + 0x194], 0
and word [esi + 0x198], 0
mov byte [esi + 0x19a], bl
mov byte [esi + 0x19c], bl
mov byte [esi + 0x19d], al
mov dword [esi + 0x1a0], edi
and dword [esi + 0x1a4], 0
push 4
pop eax
mov dword [esi + 0x1a8], eax
and dword [esi + 0x1ac], 0
and dword [esi + 0x1b0], 0
mov dword [esi + 0x1b4], 1
and dword [esi + 0x1b8], 0
and dword [esi + 0x1bc], 0
mov dword [esi + 0x1c0], eax
and dword [esi + 0x1c4], 0
and dword [esi + 0x1c8], 0
mov dword [esi + 0x1cc], eax
and dword [esi + 0x1d0], 0
and dword [esi + 0x1d4], 0
mov dword [esi + 0x1d8], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
and dword [esi + 0x1dc], 0
and dword [esi + 0x1e0], 0
or dword [esi + 0x2ec], 0xffffffff
and dword [esi + 0x2f0], 0
mov byte [esi + 0x304], al
mov dword fs:[0], ecx
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4727b7
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
lea eax, [ebp - 0x18]
mov ebx, ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x584620
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call fcn.0047060d
cmp eax, 2
jb 0x4727ff
cmp dword [eax + 4], 0
mov esi, eax
je 0x4727ff
add esi, 4
jmp 0x472968
call fcn.0047060d
cmp eax, 1
je 0x472966
mov esi, eax
test eax, eax
jne 0x47284e
and dword [ebp - 0x10], 0
mov dword [ebp - 0x34], ebx
push 8
pop ecx
push 4
pop edx
call fcn.0046ada7
mov dword [eax], 0x673040
and dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x673040]
test eax, eax
je 0x47297e
dec eax
mov ebx, dword [ebp - 0x34]
or dword [ebp - 0x10], 0xffffffff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test ebx, ebx
je 0x472866
mov edi, dword [ebx]
and dword [ebx], 0
test edi, edi
jne 0x472958
xor ecx, ecx
call fcn.004705f1
lea ecx, [ebp - 0x9c]
xorps xmm0, xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
call fcn.00472a91
test eax, eax
jne 0x472991
movdqu xmm1, xmmword [ebp - 0x9c]
movups xmm0, xmmword [ebp - 0x8c]
pshufd xmm3, xmm1, 0x55
pshufd xmm2, xmm1, 0xee
movdqu xmmword [ebp - 0x44], xmm1
pshufd xmm1, xmm1, 0xff
movups xmmword [ebp - 0x34], xmm0
movdqu xmmword [ebp - 0x74], xmm3
movdqu xmmword [ebp - 0x64], xmm2
movdqu xmmword [ebp - 0x54], xmm1
push 8
pop edx
mov ecx, 0x158
call fcn.0046ada7
mov edi, eax
xor eax, eax
inc eax
mov dword [edi], eax
mov dword [edi + 4], eax
lea eax, [edi + 8]
push pe_nt_image_headers32
push 0
push eax
call fcn.0058a690
add esp, 0xc
movups xmm0, xmmword [ebp - 0x44]
movups xmm2, xmmword [ebp - 0x54]
movups xmm1, xmmword [ebp - 0x64]
mov dword [edi + 0x108], 0x40
mov eax, 0x10000
movss dword [edi + 0x110], xmm0
movss dword [edi + 0x11c], xmm2
movss dword [edi + 0x118], xmm1
movups xmm2, xmmword [ebp - 0x74]
movups xmm1, xmmword [ebp - 0x34]
movss dword [edi + 0x114], xmm2
movups xmmword [edi + 0x120], xmm1
xorps xmm1, xmm1
movups xmmword [edi + 0x130], xmm1
mov dword [edi + 0x140], eax
and dword [edi + 0x144], 0
mov dword [edi + 0x148], eax
and dword [edi + 0x14c], 0
and dword [edi + 0x150], 0
add esi, 4
mov ecx, dword [esi]
mov dword [esi], edi
call fcn.004705f1
jmp 0x472968
xor esi, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
or dword [ebp - 0x10], 0xffffffff
mov ecx, 0x673040
call fcn.0059d5e0
jmp 0x47283f
xor edx, edx
lea ecx, [ebp - 0x24]
lea esi, [ebp - 0x7c]
mov dword [ecx], eax
mov dword [esi], ecx
mov dword [ecx + 4], 0x5ceccc
lea ecx, [ebp - 0x9c]
inc edx
mov dword [esi + 4], 0x472a4f
mov dword [ecx], 0x5ceca4
mov dword [ecx + 4], edx
and dword [ecx + 0x10], 0
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 0x10], edx
mov edx, 0x5cecac
call fcn.0059a150
ud2
Function at 0x43ad00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x42b015
lea edi, [esi - 0x2a015]
push edi
or ebp, 0xffffffff
jmp 0x43ad22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43ad29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43ad18
mov eax, 1
add ebx, ebx
jne 0x43ad3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43ad30
jne 0x43ad4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43ad30
xor ecx, ecx
sub eax, 3
jb 0x43ad60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43add2
mov ebp, eax
add ebx, ebx
jne 0x43ad6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43ad78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43ad9c
inc ecx
add ebx, ebx
jne 0x43ad88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43ad7d
jne 0x43ad99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43ad7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43adbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43adad
jmp 0x43ad1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43adbc
add edi, ecx
jmp 0x43ad1e
pop esi
mov edi, esi
mov ecx, 0xaca
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43adda
cmp byte [edi], 7
jne 0x43adda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43addf
lea edi, [esi + 0x38000]
mov eax, dword [edi]
or eax, eax
je 0x43ae57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41620]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x416c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43ae0c
mov ecx, edi
jns 0x43ae3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x416c4]
or eax, eax
je 0x43ae51
mov dword [ebx], eax
add ebx, 4
jmp 0x43ae29
call dword [esi + 0x416d4]
mov ebp, dword [esi + 0x416c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43ae8b
sub esp, 0xffffff80
jmp 0x412a92
Function at 0x40e3c7
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
movsb byte es:[edi], byte [esi]
popfd
lodsd eax, dword [esi]
cmp ah, byte [ebx]
push eax
mov bl, 0x28
pop ebp
push ebx
stosb byte es:[edi], al
aas
mov ecx, 0xc5147d5e
push ecx
test dword [edx + 0x320d5925], 0xf5cc30e2
sub al, 0x31
push edi
inc esi
dec edi
push 0xffffffffffffffd7
inc edx
stc
cmc
jecxz 0x40e399
pop ecx
invalid
std
lea ecx, [ebp + edx*4 + 0x11bae6cf]
fist word [ebx]
insb byte es:[edi], dx
xchg dword [ebx], ebp
nop
movsb byte es:[edi], byte [esi]
loope 0x40e39a
mov edi, 0x9e2b766a
cmpsb byte fs:[esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
pop ebp
mov dl, 0xea
adc dword [edx - 0x7221d56a], eax
sbb al, 0x5c
ljmp 0xe8a0
jecxz 0x40e34c
dec eax
leave
xor dword [edx + 0x45], 0x42de2006
pop eax
das
fcom qword [bx]
nop
loopne 0x40e407
push ebx
fnstsw word [esi + 0x2a]
xor ebx, dword [esi - 0x14274ffc]
loopne 0x40e383
invalid
xchg ebx, eax
aas
sbb eax, dword [ecx + edi*4]
and byte [edi - 0x7c], bh
invalid

Function at 0x417a10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call sub.MPR.dll_WNetCloseEnum
mov dword [esp + 8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [esp + 0xc]
mov edi, eax
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetACP]
test edi, edi
mov dword [0x4c5c9c], eax
je 0x417a7b
test esi, esi
je 0x417a6a
mov edx, dword [0x4c4a7c]
push 0x4c476c
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [0x4c5c9c]
pop edi
pop esi
add esp, 8
ret

Function at 0x424693
Capabilities:
Get number of processors

Disassembly:
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
aam 0x3f
mov eax, 0x648a9cb5
mov edx, 0xb45b752c
inc ebp
push ecx
push esi
fnstenv [ecx + 0x74b09716]
mov edx, 0xfe32ae7d
mov ah, 0xf0
sbb eax, 0xd1f7dcd0
fdivr st(7), st(0)
shl ecx, 1
inc ecx
mov edi, 0x3190b725
in eax, dx
and byte [esi - 0x29498235], ah
cmpsb byte [esi], byte es:[edi]
cdq
xchg cx, ax
retf 0x3b80

Function at 0x4246b3
Capabilities:
Get number of processors

Disassembly:
fdivr st(7), st(0)
shl ecx, 1
inc ecx
aam 0x64
or dword [ebx], esp
in al, dx
sal dword [ebx + 0x30], 0xf4
invalid

Function at 0x45223f
Capabilities:
Encode data using xor

Disassembly:
test dword [edi + ebp + 0x7fde2f10], ecx
aad 0x33
or al, 0x90
push ebp
mov dl, 0x36
scasd eax, dword es:[edi]
pop esi
lds esp, [edi + 0x78]
jge 0x45228f
leave
pop edx
push cs
xchg ebx, eax
dec ebx
push ss
stosb byte es:[edi], al
fnstcw word [ebx - 0x7a7821b]
and al, 0xd
and byte [edx - 0x4660f8ac], ch
neg dword [ecx - 0x678890a1]
pop ds
sahf
xor byte [eax - 0x14224f22], bl
cmp bl, cl
mov dh, 0xd4
invalid
push ebp
lodsb al, byte [esi]
xchg ebx, eax
cmp byte [esi + 0x4367a936], 0x87
invalid
Function at 0x496d53
Capabilities:
Encode data using xor

Disassembly:
arpl word [ebp + 0x7e802259], bp
ficom dword [ebx - 0x71848178]
cli
push ecx
or dword [edi], ecx
popal
xchg edi, eax
pop esi
fucompi st(5)
test al, 8
xor eax, dword [edx + 0x525c58d]
cmp ah, byte [ebp + 0x3eb9af4b]
out dx, al
mov edi, 0x6bc59b8b
leave
add eax, 0xff8bda9d
loope 0x496d61
popal
test al, 0x1b
inc ecx
lea ebx, [edi]
mov dword [edi], ebp
test ecx, esi
movsd dword es:[edi], dword [esi]
mov edi, 0x8909b161
or eax, 0xdbae44aa
iretd

Function at 0x4b93b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1338
cmp edx, dword [eax]
je 0x4b93d7
add eax, 8
inc ecx
cmp eax, 0x4c13c8
jl 0x4b93c8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1338]
jne 0x4b9505
mov eax, dword [0x4c5cbc]
cmp eax, 1
je 0x4b94df
test eax, eax
jne 0x4b9408
cmp dword [0x4c1264], 1
je 0x4b94df
cmp edx, 0xfc
je 0x4b9505
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b943f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9da0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba230
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b9482
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba230
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be914
push edi
call fcn.004bc100
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9da0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9db0
lea eax, [ebp - 0xa0]
push 0x4be8f4
push eax
call fcn.004b9db0
push dword [esi + 0x4c133c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9db0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc074
add esp, 0x2c
pop edi
jmp 0x4b9505
lea eax, [ebp + 8]
lea esi, [esi + 0x4c133c]
push 0
push eax
push dword [esi]
call fcn.004ba230
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40c135
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004090c4
and dword [ebp - 4], 0
cmp dword [0x41cd80], 0
mov ebx, eax
jne 0x40c1e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c297
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x416b94
push edi
call esi
test eax, eax
je 0x40c297
push eax
call fcn.00409052
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41cd80], eax
call esi
push eax
call fcn.00409052
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41cd84], eax
call esi
push eax
call fcn.00409052
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41cd88], eax
call esi
push eax
call fcn.00409052
pop ecx
mov dword [0x41cd90], eax
test eax, eax
je 0x40c1e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409052
pop ecx
mov dword [0x41cd8c], eax
mov eax, dword [0x41cd8c]
cmp eax, ebx
je 0x40c23e
cmp dword [0x41cd90], ebx
je 0x40c23e
push eax
call fcn.004090cd
push dword [0x41cd90]
mov esi, eax
call fcn.004090cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c23e
test edi, edi
je 0x40c23e
call esi
test eax, eax
je 0x40c235
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c235
test byte [ebp - 0xc], 1
jne 0x40c23e
or dword [ebp + 0x10], 0x200000
jmp 0x40c277
mov eax, dword [0x41cd84]
cmp eax, ebx
je 0x40c277
push eax
call fcn.004090cd
pop ecx
test eax, eax
je 0x40c277
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c277
mov eax, dword [0x41cd88]
cmp eax, ebx
je 0x40c277
push eax
call fcn.004090cd
pop ecx
test eax, eax
je 0x40c277
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41cd80]
call fcn.004090cd
pop ecx
test eax, eax
je 0x40c297
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c299
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410aea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ecx - 0x8b7b], cl
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x410b00
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00410812
add dh, byte [ebx + 0x458dba2c]
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x410ea9
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x410ec6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x410ec1
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x410eab
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x410eb3
cmp edx, ebx
jne 0x411001
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x410e82
add eax, dword [eax + 4]
jmp 0x410e6f
mov dword [ebp + 0xc], ebx
jmp 0x410ed1

Function at 0x410eeb
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x410ee9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x410f07
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
ror byte [ebp - 0x73747ffc], 0xc7
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x410f65
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x410f4c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x410f55
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x410f5f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x410f41
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x410ecb
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x410fb2
dec eax
je 0x410fa9
sub eax, 3
je 0x410fa0
mov dword [ebp - 4], 0x40
jmp 0x410fcf
mov dword [ebp - 4], 4
jmp 0x410fb5
mov dword [ebp - 4], 0x20
jmp 0x410fb5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x411001
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x410f81
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00410812
xchg esi, eax
or cl, byte [ebp - 0x27]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x41100d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1050e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1050e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1050e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1050e06a
add dl, dl
jne 0x1050e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1050e0dc
xor eax, eax
add dl, dl
jne 0x1050e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1050e17d
add dl, dl
jne 0x1050e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1050e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1050e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1050e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1050e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1050e075
mov eax, 1
add dl, dl
jne 0x1050e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1050e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1050e0e1
sub eax, ebx
mov ebx, 1
jne 0x1050e128
mov ecx, 1
add dl, dl
jne 0x1050e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1050e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1050e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1050e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1050e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1050e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1050e136
cmp eax, 0x7d00
jae 0x1050e16d
cmp eax, 0x500
jb 0x1050e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1050e075
cmp eax, 0x7f
ja 0x1050e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1050e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1050e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1050e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4bf7a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x405406
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x4031d8
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
push 3
call fcn.004bfb40
mov edx, eax
lea ecx, [ebp - 0x20]
mov edi, dword [fcn.00401310]
call edi
cmp dword [0x4e3010], esi
jne 0x4bf820
push 0x4e3010
push 0x408b04
call dword [sym.imp.MSVBVM60.DLL___vbaNew2]
mov ebx, dword [0x4e3010]
mov eax, dword [ebx]
lea ecx, [ebp - 0x40]
push ecx
push ebx
call dword [eax + 0x58]
fnclex
cmp eax, esi
jge 0x4bf845
push 0x58
push 0x40ba5c
push ebx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
call fcn.004c1170
mov edx, eax
lea ecx, [ebp - 0x3c]
call edi
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
push 1
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x38]
push eax
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
call esi
push eax
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edx, eax
lea ecx, [ebp - 0x30]
call edi
push eax
lea ecx, [ebp - 0x34]
push ecx
call esi
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call esi
push eax
mov edx, ebx
lea ecx, [ebp - 0x24]
call edi
push eax
lea edx, [ebp - 0x28]
push edx
call esi
push eax
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
call esi
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
push ecx
call esi
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
push 7
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x20
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x4bf93c
jmp 0x4bf932
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret