joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9749
Capabilities:
Parse pe header

Disassembly:
pop ebp
les esp, [esi + 0x39]
pushfd
push eax
add byte [eax], al
add dword [eax], eax
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov bx, word [ebp - 0x3c]
cmp word [eax + edx*2 + 0x10000], bx
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov bx, word [ebp - 0x3c]
cmp word [eax + edx*2 + 0x10000], bx
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov edi, 0x8b665314
pop ebp
les esp, [esi + 0x39]
pushfd
push eax
add byte [eax], al
add dword [eax], eax
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx edx, word [ebx + edx*2]
mov bx, word [ebp - 0x3c]
cmp word [eax + edx*2 + 0x10000], bx
je 0x4b97b0
mov ebx, dword [ebp - 0x98]
inc edi
mov edx, edi
sub edx, ecx
movsx ebx, word [ebx + edx*2]
mov edx, dword [ebp - 0x3c]
cmp word [eax + ebx*2 + 0x10000], dx
je 0x4b97b0
inc edi
mov ebx, edi
sub ebx, ecx
mov ecx, dword [ebp - 0x98]
movsx ecx, word [ecx + ebx*2]
cmp word [eax + ecx*2 + 0x10000], dx
jne 0x4b989d
cmp edi, dword [ebp - 0x4c]
jg 0x4b98ac
mov edx, dword [ebp - 0x54]
lea ecx, [edx - 1]
test ecx, ecx
mov dword [ebp - 0x20], ecx
je 0x4b9805
mov edx, dword [esi + 0x6c]
mov ebx, ecx
sub ebx, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
movsx edx, word [edx + ebx*2]
mov ebx, dword [ebp - 0x94]
sub ecx, ebx
mov ebx, dword [ebp - 0x98]
add ecx, edi
movsx ecx, word [ebx + ecx*2]
mov cx, word [eax + ecx*2 + 0x10000]
cmp cx, word [eax + edx*2 + 0x10000]
jne 0x4b989d
mov ecx, dword [ebp - 0x20]
dec ecx
jmp 0x4b97bf
mov ebx, dword [ebp - 0x34]
inc ebx
cmp word [ebp - 0x30], 0
mov dword [ebp - 0x34], ebx
je 0x4b9844
mov eax, dword [ebp - 0x50]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x88]
dec eax
mov ebx, eax
mov dword [ebp - 0x20], eax
sub ebx, dword [ecx + 0x14]
sub eax, dword [edx + 0x14]
mov ecx, dword [ecx + 0xc]
mov edx, dword [edx + 0xc]
add eax, edi
mov cx, word [ecx + ebx*2]
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4b9816
jmp 0x4b988b
mov eax, dword [esi + 0xa8]
cmp ebx, eax
jle 0x4b9877
add eax, 0x200
push 0
push eax
push 1
lea edx, [esi + 0xa4]
push 3
push edx
push 4
push 0x80
add byte [eax], 0
add byte [ecx + 0xa886], cl
add bh, bh
adc eax, sym.imp.MSVBVM60.DLL___vbaRedimPreserve
add esp, 0x1c
mov eax, dword [esi + 0xa4]
lea ecx, [edi + edi]
mov edx, dword [eax + 0x14]
sub ebx, edx
mov edx, dword [eax + 0xc]
mov dword [edx + ebx*4], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0x1c]
cmp eax, ecx
je 0x4b98ac
mov ecx, dword [ebp - 0x54]
lea eax, [ecx - 1]
add edi, eax
mov ecx, dword [ebp - 0x4c]
mov eax, 1
add edi, eax
jmp 0x572f4d
Function at 0x4cfb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40c136
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x404080
xor ebx, ebx
lea edx, [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcIsMissing]
test ax, ax
je 0x4cfc02
call fcn.0059f598
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push ecx
call fcn.0059f534
test ax, ax
je 0x4cfb6c
dec dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
lea eax, [edx - 2]
cdq
xor eax, edx
sub eax, edx
push eax
mov dword [ebp - 0x14], eax
call fcn.0059f560
test ax, ax
je 0x4cfb6c
mov ecx, dword [ebp - 0x14]
mov esi, 0x763d
mov eax, ecx
mov edi, 0x7663
cdq
idiv esi
mov eax, ecx
mov esi, edx
cdq
idiv edi
mov eax, ecx
mov ecx, 0x7673
mov dword [0x5aec34], esi
mov edi, edx
cdq
idiv ecx
cmp esi, ebx
mov dword [0x5aec38], edi
mov dword [0x5aec3c], edx
jne 0x4cfbca
mov dword [0x5aec34], 0xab
cmp edi, ebx
jne 0x4cfbd8
mov dword [0x5aec38], 0xac
cmp edx, ebx
jne 0x4cfbe6
mov dword [0x5aec3c], 0xaa
mov dword [0x5aebfc], 0
mov dword [0x5aec00], 0
wait
push 0x4cfc8a
jmp 0x4cfc80
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrErrVarCopy]
mov edx, eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea eax, [ebp - 0x28]
push eax
call fcn.005ad360
fabs
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fstp qword [0x5aec08]
sbb eax, 0x5aec08
Function at 0x4f496f
Capabilities:
Packed with generic packer

Disassembly:
jb 0x4f49b3
add byte [ebx - 0xe36b], cl
call dword [edx - 0x75]
test dword [eax], ebx
invalid
and al, 0x14
inc eax
add byte [eax - 0x73], dl
push ebp
mov eax, 0x5c15ff52
adc dword [eax], eax
Function at 0x556848
Capabilities:
Parse pe header

Disassembly:
push 0x40
push 0x4274f4
mov edx, dword [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x380], eax
jmp 0x556875
push 0
push 0xb
mov ecx, dword [ebp - 0x164]
push ecx
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaLateIdCallLd]
add esp, 0x10
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Var]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrI4]
mov edx, eax
lea ecx, [ebp - 0x100]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
mov eax, 6
sub eax, 1
mov ecx, dword [0x5ae4a8]
lea ecx, [ecx + eax*4]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x100]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x160]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
add esp, 0xc
lea ecx, [ebp - 0x178]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov dword [ebp - 4], 0x15
push 0
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSetAddref]
mov dword [ebp - 4], 0x16
movsx edx, word [0x5ae920]
test edx, edx
je 0x5569c0
mov dword [ebp - 4], 0x17
push 0
push 0
push 1
push 8
mov eax, dword [ebp + 8]
add eax, 0xb4
push eax
push 4
push 0x180
call dword [sym.imp.MSVBVM60.DLL___vbaRedim]
add esp, 0x1c
mov dword [ebp - 4], 0x18
mov ecx, dword [ebp + 8]
mov word [ecx + 0xb8], 0
mov dword [ebp - 4], 0x19
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0xba]
test eax, eax
je 0x5569ab
mov dword [ebp - 4], 0x1a
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xba]
not dx
mov eax, dword [ebp + 8]
mov word [eax + 0xba], dx
mov dword [ebp - 4], 0x1b
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov ax, word [edx + 0xba]
mov word [ecx + 0xb8], ax
mov dword [ebp - 4], 0x1d
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xb8]
mov word [ebp - 0x24], dx
mov dword [ebp - 4], 0x1f
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push edx
call dword [ecx + 0x70c]
mov dword [ebp - 4], 0x20
push 0x3e8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push edx
call dword [ecx + 0xb10]
mov dword [ebp - 4], 0x21
mov eax, 2
sub eax, 1
mov ecx, dword [0x5ae958]
xor edx, edx
cmp word [ecx + eax*2], 0
setne dl
Function at 0x556d03
Capabilities:
Parse pe header

Disassembly:
lea ecx, [ebp - 0x160]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov dword [ebp - 4], 0x2c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push eax
call dword [edx + 0x350]
push eax
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov dword [ebp - 0x22c], eax
xor edx, edx
cmp dword [0x5ae484], 2
sete dl
neg edx
mov ax, word [0x5aecca]
and ax, dx
push eax
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x22c]
push eax
call dword [edx + 0x74]
fnclex
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jge 0x556d97
push 0x74
push 0x427254
mov ecx, dword [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x394], eax
jmp 0x556da1
mov dword [ebp - 0x394], 0
lea ecx, [ebp - 0x160]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov dword [ebp - 4], 0x2d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push edx
call dword [ecx + 0x360]
push eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov dword [ebp - 0x22c], eax
mov cx, word [0x5aecca]
push ecx
mov edx, dword [ebp - 0x22c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [eax + 0x74]
fnclex
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jge 0x556e25
push 0x74
push 0x427254
mov edx, dword [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x398], eax
jmp 0x556e2f
mov dword [ebp - 0x398], 0
lea ecx, [ebp - 0x160]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov dword [ebp - 4], 0x2e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push eax
call dword [edx + 0x354]
push eax
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
mov dword [ebp - 0x22c], eax
xor edx, edx
cmp dword [0x5ae484], 2
sete dl
neg edx
mov ax, word [0x5aeccc]
and ax, dx
push eax
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x22c]
push eax
call dword [edx + 0x74]
fnclex
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jge 0x556ec3
push 0x74
invalid
push esp

Function at 0x556ea4
Capabilities:
Parse pe header

Disassembly:
jb 0x556ee8
add byte [ebx - 0x22b73], cl
call dword [ecx - 0x75]
xchg ebp, eax
sar ch, 1
invalid
add bh, al
inc ebp
cld
xor byte [eax], al
add byte [eax], al
Function at 0x5578f7
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebp - 0x248], 0
jge 0x557923
push 0x48
push 0x4255d0
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x3f8], eax
jmp 0x55792d
mov dword [ebp - 0x3f8], 0
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcGetPresentDate]
mov dword [ebp - 0x1d0], 0x42e0a4
mov dword [ebp - 0x1d8], 8
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x188]
call dword [sym.imp.MSVBVM60.DLL___vbaVarDup]
push 1
push 1
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromFormatVar]
mov edx, eax
lea ecx, [ebp - 0x124]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x334], edx
mov dword [ebp - 0x124], 0
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
push 0x422fc0
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x110]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov edx, dword [ebp - 0x334]
lea ecx, [ebp - 0x10c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
push 0x42e0d4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x114]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x11c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov edx, dword [ebp - 0x100]
push edx
mov eax, dword [ebp - 0x104]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp + 0x157a21e8]
add byte [sym.imp.MSVBVM60.DLL___vbaStrMove], dl
push eax
mov ecx, dword [0x5ae528]
push ecx
call 0x631f35
mov edx, dword [ebp - 0x120]
push edx
mov ax, word [ebp - 0x4c]
push eax
push 0xffffffffffffffff
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x114]
push edx
invalid
invalid
Function at 0x571935
Capabilities:
Parse pe header

Disassembly:
inc dword [ebx - 0x14f43]
inc dword [eax]
jge 0x571962
push 0x40
push 0x4274f4
mov ecx, dword [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x150]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x224], eax
jmp 0x57196c
mov dword [ebp - 0x224], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0xb4], 0
mov ecx, dword [ebp - 0x1d8]
push ecx
lea edx, [ebp - 0xb8]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0xb8]
push ecx
mov edx, dword [ebp + 8]
push edx
call 0x68aaed
mov ax, word [ebp - 0x13c]
mov word [ebp - 0x154], ax
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xb0]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObjList]
add esp, 0xc
movsx eax, word [ebp - 0x154]
test eax, eax
je 0x571ad2
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xd0], 0x80020004
mov dword [ebp - 0xd8], 0xa
invalid
Function at 0x572a15
Capabilities:
Parse pe header

Disassembly:
sub edx, dword [ecx + 0x14]
mov eax, dword [0x5aea60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + edx*4]
push edx
push 1
push 1
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromFormatVar]
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
inc eax
add byte [eax - 1], dl
adc eax, sym.imp.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x84]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]

Function at 0x572a45
Capabilities:
Parse pe header

Disassembly:
inc eax
add byte [eax - 1], dl
adc eax, sym.imp.MSVBVM60.DLL___vbaStrCat

Function at 0x572a5c
Capabilities:
Parse pe header

Disassembly:
mov edx, eax
mov ecx, dword [ebp + 8]
add ecx, 0x1b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x80]
push eax
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xc8]
push edx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVarList]
add esp, 0xc
mov dword [ebp - 4], 0x37
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1b4]
push edx
mov eax, dword [0x5ae528]
push eax
call 0x64d5bc
mov edx, dword [ebp - 0x7c]
mov ecx, dword [ebp + 8]
add ecx, 0x1b4
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov dword [ebp - 4], 0x38
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
push ecx
call dword [eax + 0x58]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jge 0x572b22
push 0x58
push 0x425fa0
mov al, byte [0x8b00425f]
push ebp
or byte [edx - 0x75], dl
test dword [esi + edi*8 - 0xaf0001], esi
adc eax, sym.imp.MSVBVM60.DLL___vbaHresultCheckObj
mov dword [ebp - 0x274], eax
jmp 0x572b2c
mov dword [ebp - 0x274], 0
push 0
mov ecx, dword [0x5aea60]
mov edx, 0x15c
sub edx, dword [ecx + 0x14]
mov eax, dword [0x5aea60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + edx*4]
push edx
mov eax, dword [0x5aea60]
mov ecx, 0x15d
sub ecx, dword [eax + 0x14]
mov edx, dword [0x5aea60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + ecx*4]
push ecx
mov edx, dword [0x5aea60]
mov eax, 0x15e
sub eax, dword [edx + 0x14]
mov ecx, dword [0x5aea60]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + eax*4]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov ecx, dword [0x5aea60]
mov edx, 0x15f
sub edx, dword [ecx + 0x14]
mov eax, dword [0x5aea60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + edx*4]

Function at 0x572b05
Capabilities:
Parse pe header

Disassembly:
mov al, byte [0x8b00425f]
push ebp
or byte [edx - 0x75], dl
test dword [esi + edi*8 - 0xaf0001], esi
adc eax, sym.imp.MSVBVM60.DLL___vbaHresultCheckObj
Function at 0x572bba
Capabilities:
Parse pe header

Disassembly:
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x84]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov ax, word [0x5aedcc]
push eax
call 0x716d6c
mov edx, eax
lea ecx, [ebp - 0x9c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov dword [ebp - 0xc0], 0x80020004
mov dword [ebp - 0xc8], 0xa
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcCurrentDirBstr]
mov edx, eax
lea ecx, [ebp - 0xa0]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, dword [ebp - 0xa0]
invalid
xchg ebp, eax
invalid

Function at 0x572f83
Capabilities:
Parse pe header

Disassembly:
mov dword [edx + 0xc], ecx
mov eax, 0x10
call fcn.0057f0c0
mov edx, esp
mov eax, dword [ebp - 0x108]
mov dword [edx], eax
mov ecx, dword [ebp - 0x104]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x100]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xfc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x16c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x16c]
push ecx
call dword [eax + 0x2b0]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jge 0x573001
push 0x2b0
push 0x427694
mov edx, dword [ebp - 0x16c]
call dword [edx - 0x75]
test dword [esi + edi*8 - 0xaf0001], esi
adc eax, sym.imp.MSVBVM60.DLL___vbaHresultCheckObj
mov dword [ebp - 0x280], eax
jmp 0x57300b
mov dword [ebp - 0x280], 0
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x16c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x16c]
push ecx
call dword [eax + 0x1b8]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0

Function at 0x57303d
Capabilities:
Parse pe header

Disassembly:
jge 0x573065
push 0x1b8
push 0x427694
mov edx, dword [ebp - 0x16c]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x284], eax
jmp 0x57306f
mov dword [ebp - 0x284], 0
movsx ecx, word [ebp - 0x13c]
test ecx, ecx
je 0x57314a
mov dword [ebp - 4], 0x41
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x16c]
push edx
call dword [ecx + 0x90]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jge 0x5730d8
push 0x90
push 0x427694
mov eax, dword [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x288], 0
Function at 0x5730d0
Capabilities:
Parse pe header

Disassembly:
mov dword [ebp - 0x288], eax
jmp 0x5730e2
movsx edx, word [ebp - 0x13c]
test edx, edx
je 0x57314a
mov dword [ebp - 4], 0x42
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x16c]
push edx
call dword [ecx + 0x2a8]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
inc dword [eax]
jge 0x573140
push 0x2a8
push 0x427694
mov eax, dword [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x28c], eax
jmp 0x57314a
mov dword [ebp - 0x28c], 0
mov dword [ebp - 4], 0x45
mov dword [ebp - 0x144], 0x68
lea edx, [ebp - 0x144]
mov esp, 0x52fffffe
mov eax, dword [ebp - 0x16c]
push eax
call 0x64c7de
mov dword [ebp - 4], 0x46
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x16c]
push eax
call dword [edx + 0x2a0]
fnclex
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jge 0x5731c1
push 0x2a0
push 0x427694
mov ecx, dword [ebp - 0x16c]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov dword [ebp - 0x290], eax
jmp 0x5731cb
mov dword [ebp - 0x290], 0
mov dword [ebp - 4], 0x47
push 0
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSetAddref]
mov dword [ebp - 4], 0x49
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1b4
push edx
mov eax, dword [0x5ae528]
push eax
call 0x64e011
mov ecx, dword [0x5aea60]
mov edx, 0x12
sub edx, dword [ecx + 0x14]
mov eax, dword [0x5aea60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + edx*4]
push edx
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push eax
call dword [edx + 0x54]
fnclex
mov dword [ebp - 0x14c], eax
invalid
invalid
Function at 0x40128e
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [esp + 0x14]
lea eax, [esi + 0x105]
mov ebp, 0x403090
mov ebx, str.autorun
push 0x104
push eax
push ebp
push str.RegPath
push ebx
call edi
cmp eax, 1
jae 0x4012c8
xor eax, eax
jmp 0x401302
push dword [esp + 0x14]
lea eax, [esi + 0x20a]
push 0x104
push eax
push ebp
push str.OnlineInsPackage
push ebx
call edi
cmp eax, 1
jb 0x4012c4
push dword [esp + 0x14]
add esi, 0x30f
push 0x20
push esi
push ebp
push str.Version
push ebx
call edi
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x401307
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push edi
push 0x41
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
rep stosd dword es:[edi], eax
push 0x41
lea edi, [ebp - 0x10b]
pop ecx
mov byte [ebp - 0x10c], bl
push dword [ebp + 8]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10c]
push str.Software_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp + 8], 0x104
push eax
push 1
lea eax, [ebp - 0x10c]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40139f
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
push str.Version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
je 0x4013a3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4013bc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop eax
pop edi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6a505da9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6a805964
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219