joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a21c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
pushal
mov ecx, 0x5de660d3
xor ecx, 0x213e0bb
push ecx
push 0xd03006c
mov eax, 0x52b65184
pop ecx
xor eax, ecx
pop ebx
xor eax, ebx
xor ebx, ebx
add ebx, eax
mov ecx, 1
sub ebx, ecx
mov edi, dword [ebx + 1]
mov edx, edi
add edx, 0xffffffff
mov eax, dword [edx + 1]
mov edx, 0x254edcbd
add edx, 0x4af80aaf
xor eax, edx
mov ecx, 4
sub esp, ecx
push esp
pop ebx
mov dword [ebx], eax
mov eax, esp
add eax, 6
dec eax
mov edi, dword [eax - 5]
mov edx, 4
add esp, edx
mov esi, 0
xor esi, edi
mov eax, esi
add esp, 0xfffffffc
mov dword [esp], eax
mov esi, 0x17cd45f9
add esi, 0xe345d2ee
xor edi, esi
sub ecx, ecx
add ecx, edi
or ecx, ecx
jne 0x40a2b8
mov ecx, 0
mov edi, 0
xor ecx, edi
push ecx
mov edi, esp
sub edi, 0xffffffe8
mov eax, dword [edi - 0x18]
mov edi, 0xfffffffc
sub esp, edi
mov ecx, eax
mov ebx, ecx
mov edx, 4
sub esp, edx
mov dword [esp], ebx
mov ebx, 0x39605019
add ebx, 0xda7d5f24
xor eax, ebx
mov esi, eax
xor esi, 0xffffffff
and esi, 0x639b6dae
and eax, 0x9c649251
or eax, esi
and eax, 0xffff
cmp eax, 0
jne 0x40a313
mov ecx, 0xffffffb9
add ecx, 0x47
push ecx
pop edx
mov edi, edx
mov ebx, edi
mov ecx, 0xfffffffc
add esp, ecx
mov dword [esp], ebx
push 0xef2b54bf
mov ebx, 0x5e6af5b7
pop esi
xor ebx, esi
xor edx, ebx
mov esi, 0x4156a44c
xor edx, esi
xor edx, 0x3bd697d
xor edi, edi
add edi, edx
add edi, 0
jne 0x40a35a
mov edx, 0x7c391032
xor edx, 0x7c391032
push edx
mov esi, esp
add esi, 0xffffffd1
mov edx, dword [esi + 0x2f]
mov esi, 4
add esp, esi
mov ecx, 0
xor ecx, edx
xchg ecx, ebx
and ebx, edx
jne 0x40a392
pop ebx
mov esi, 0x2c414319
mov ecx, 0x42868420
xor esi, ecx
mov ebx, 0x91786437
add esi, ebx
call esi
popal
pop ebp
jmp fcn.00405258
Function at 0x401100
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x80550c]
sub esp, 0x11c
test eax, eax
jne 0x4011fe
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00404400
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x401150
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x401160
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41e104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x401195
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403f20
pop edi
pop esi
pop ebx
test eax, eax
je 0x4011f9
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4011f9
mov dword [0x80550c], eax
add esp, 0x11c
ret
mov eax, dword [0x80550c]
add esp, 0x11c
ret
Function at 0x402300
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x804808]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4024ad
cmp dword [0x80480c], 0
jne 0x402499
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00404400
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x402350
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41e0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x402360
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41e0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x402395
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00404400
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4023f4
sub edx, esi
sar edx, 1
je 0x4024ad
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402410
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4024ad
xor eax, eax
push ebx
test edx, edx
je 0x402448
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402448
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402431
xor eax, eax
test edx, edx
je 0x402462
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x402462
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402450
xor eax, eax
test edx, edx
je 0x40247f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x40247f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402470
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x804808]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x4025d0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x804948
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4026f9
cmp dword fs:[0xc0], eax
je 0x4025fb
mov dword [0x804944], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x80482c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x804830], eax
movzx edx, word [esi + 0xac]
mov dword [0x804834], edx
mov eax, dword [esi + 0xb0]
mov dword [0x804838], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40265b
push 0x7f
push eax
push 0x80483c
call fcn.004043a0
mov edx, dword [0x804834]
add esp, 0xc
jmp 0x402663
xor eax, eax
mov word [0x80483c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x80493c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x80493e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x804940], ax
mov ecx, eax
mov byte [0x804942], 0
cmp byte [0x7ffe0268], 0
je 0x4026aa
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x804942], bl
cmp ebx, 1
pop ebx
jne 0x4026c4
and ecx, 0xffef
mov word [0x804940], cx
test edx, edx
jne 0x4026f9
call fcn.004025d0
cmp dword [0x80482c], 6
ja 0x4026f9
jb 0x4026e1
cmp dword [0x804830], 4
jae 0x4026f9
call fcn.004025d0
cmp dword [0x80482c], 0xa
jae 0x4026f9
mov dword [0x804834], 1
ret
Function at 0x402840
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40288b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40287b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x402861
jmp 0x402880
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4028db
mov edi, edx
lea ecx, [edi + 2]
jmp 0x4028a0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4028a0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4028bc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004043a0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4028fd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402970
mov esi, dword [ebx]
cmp esi, ebx
je 0x402970
test esi, esi
je 0x402970
cmp word [esi + 0x24], 2
jbe 0x40296a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40296a
cmp dword [esi + 0x18], 0
je 0x40296a
test ebp, ebp
je 0x402925
cmp ebp, eax
jne 0x40296a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004043a0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40294a
cmp eax, dword [esi + 0x18]
jne 0x40296a
cmp dword [esp + 0x10], 0
je 0x40297d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401ab0
add esp, 8
test eax, eax
je 0x40297d
mov esi, dword [esi]
cmp esi, ebx
jne 0x402903
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x403040
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403068
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403076
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40308f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40309d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x4030b6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4030c4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4030dd
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4030eb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403132
add dword [esp], 5
retf
Function at 0x403f20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x403f7b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403f40
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x403f5c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004043a0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x403f9d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40400f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40400f
test esi, esi
je 0x40400f
cmp word [esi + 0x24], 2
jbe 0x404009
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x404009
cmp dword [esi + 0x18], 0
je 0x404009
test ebp, ebp
je 0x403fc5
cmp ebp, eax
jne 0x404009
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004043a0
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x403fea
cmp edx, dword [esi + 0x18]
jne 0x404009
cmp dword [esp + 0x14], eax
je 0x40401c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401ab0
add esp, 8
test eax, eax
je 0x40401c
mov esi, dword [esi]
cmp esi, ebx
jne 0x403fa3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x41d3e2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x404409
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x405068]
test eax, eax
je 0x404448
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404448
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404448
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404448
cmp dword [ecx + 0x74], 0xe
jbe 0x404448
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40f22e
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f2cb
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f2cb
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f2cb
push 4
push 0xffffffffffffffff
push esi
push 0x40f9e5
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f2cb
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f296
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f2cb
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f2d1
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f2cd

Function at 0x413ca1
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413cb1
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x413cb7
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x413cdf
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x413cc6
mov esi, ecx
jmp 0x413ce2
movzx esi, si
pop edi
cmp cx, si
je 0x413cff
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x413ce3
mov eax, 0x437338
jmp 0x413d07
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x419d21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x419d30
pop dword [ebp - 0x20]
mov eax, 0x1b2814e3
add eax, 0xe519884d
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x40ed1
push 0
mov eax, 0x691ce0e9
add eax, 0x9725e213
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xab76a3d2
add ecx, 0x54899cb2
mov edx, eax
mov ebx, 0x2569cc59
sub ebx, 0x25254459
add ebx, dword [ebp - 0x20]
mov esi, 0xeeec13db
add dword [ebp - 0x1c], 0x19b3f014
mov edi, dword [ebx]
add dword [ebp - 0x10], edx
xor edi, esi
xor dword [ebp - 0x14], 0xfc6ed45b
mov dword [edx], edi
sub dword [ebp - 0xc], 0x783a7b06
add edx, 0x309322
sub edx, 0x30931e
add ebx, 4
loop 0x419d89
add eax, 0xc01bfe97
sub eax, 0xc01b09b4
mov ebx, eax
add eax, 5
mov ecx, 0xb9365d04
add ecx, 0x4709a2fc
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x41b770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x41b78a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41b791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41b780
mov eax, 1
add ebx, ebx
jne 0x41b7a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41b798
jne 0x41b7b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b798
xor ecx, ecx
sub eax, 3
jb 0x41b7c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41b83a
mov ebp, eax
add ebx, ebx
jne 0x41b7d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41b7e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41b804
inc ecx
add ebx, ebx
jne 0x41b7f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41b7e5
jne 0x41b801
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b7e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41b824
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41b815
jmp 0x41b786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41b824
add edi, ecx
jmp 0x41b786
pop esi
mov edi, esi
mov ecx, 0xad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41b842
cmp byte [edi], 1
jne 0x41b842
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41b847
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41b8bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b394]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b4ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41b874
mov ecx, edi
jns 0x41b8a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b4f4]
or eax, eax
je 0x41b8b9
mov dword [ebx], eax
add ebx, 4
jmp 0x41b891
call dword [esi + 0x1b4f0]
mov ebp, dword [esi + 0x1b4f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41b8f3
sub esp, 0xffffff80
jmp 0x402354
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x402793
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4027a2
pop dword [ebp - 0x38]
mov eax, 0xfb86e67
sub eax, 0xf7846c5
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x37b5e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xae1b10a9
add ecx, 0x51e52ee3
mov esi, eax
mov edi, 0x837f0818
sub edi, 0x833dcc54
add edi, dword [ebp - 0x38]
mov edx, 0x4345b5b9
add edx, 0x8ee066b0
add dword [ebp - 0x24], edx
mov ebx, dword [edi]
sub dword [ebp - 0x18], eax
xor ebx, edx
mov dword [esi], ebx
add esi, 4
add edi, 0x9b0fec95
add edi, 0x64f0136f
loop 0x4027fc
add eax, 0xf103
mov ebx, eax
add eax, 0xe0297fb0
add eax, 0x1fd68055
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x10008b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10008b5f
pop dword [ebp - 0x50]
mov eax, 0x74db7561
sub eax, 0x64daea02
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xc6b31380
add dword [ebp - 0x60], 0x879f31cb
mov dword [ebp - 0x5c], 0x1d7f0efe
add dword [ebp - 0x5c], 0x14b43d47
mov dword [ebp - 0x58], 0x2b136315
add dword [ebp - 0x58], 0x2138e119
mov dword [ebp - 0x54], 0xe6431a78
add dword [ebp - 0x54], 0x19bce588
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x42c1c21c
sub dword [ebp - 0x60], 0xce4f58c6
mov dword [ebp - 0x5c], 0x53c3ecf7
sub dword [ebp - 0x5c], 0x12578b82
mov dword [ebp - 0x58], 0xfc37d66
sub dword [ebp - 0x58], 0xac5410fa
mov dword [ebp - 0x54], 0x1d154919
sub dword [ebp - 0x54], 0x1d154919
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x6653de6d
add eax, 0xa9add1a7
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3e33e
push 0
call eax
mov ecx, 0x7020f768
add ecx, 0x8fdf4fc2
mov edi, eax
mov edx, 0x1002b000
add edx, dword [ebp - 0x50]
mov esi, 0x7505c09b
add esi, 0x7ee00e6d
xor dword [ebp - 0xc], 0x1f7aecf6
mov ebx, dword [edx]
mov dword [ebp - 0x18], 0x9d5bf4f7
sub ebx, esi
mov dword [ebp - 0x24], 0xe29dfa6d
mov dword [edi], ebx
add edi, 0x5f68eb4b
sub edi, 0x5f68eb47
add edx, 0xd7f6e83b
add edx, 0x280917c9
loop 0x10008c76
add eax, 0x10f7b
mov ebx, eax
add eax, 5
mov ecx, 0xc0745ce4
add ecx, 0x4f8ba31c
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x408fa0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4016e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401220
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor eax, eax
mov edx, 0x407a14
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call esi
mov edx, 0x4079fc
lea ecx, [ebp - 0x18]
call esi
mov edx, 0x40799c
lea ecx, [ebp - 0x14]
call esi
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x20]
push edx
push eax
mov dword [ebp - 0x20], 0x80000002
call fcn.00409cd0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
push 3
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0x10
push 0x40904e
jmp 0x40904d
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40345b
pop dword [ebp - 4]
mov eax, 0x40345b
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xf5e6516e
sub dword [ebp - 0x14], 0xa7940c23
mov dword [ebp - 0x10], 0x74123b0c
add dword [ebp - 0x10], 0xbe211139
mov dword [ebp - 0xc], 0x21d94ed8
add dword [ebp - 0xc], 0x2a72f556
mov dword [ebp - 8], 0xa65e3095
sub dword [ebp - 8], 0xa65e3095
lea eax, [ebp - 0x14]
push eax
mov eax, 0x3765990f
sub eax, 0x372558bb
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xfd7c56eb
add dword [ebp - 0x14], 0x76f6126b
mov dword [ebp - 0x10], 0xc93875cd
sub dword [ebp - 0x10], 0x87cc1458
mov dword [ebp - 0xc], 0xf59fc5c7
add dword [ebp - 0xc], 0x6dcfa6a5
mov dword [ebp - 8], 0xe3310cf9
add dword [ebp - 8], 0x1ccef307
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xb2ee3be2
add eax, 0x4d52046e
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x383c3
push 0
call eax
mov ecx, 0x4d7b
xor edi, edi
add edi, eax
mov edx, 0x408400
add edx, dword [ebp - 4]
mov esi, 0x4eda5e33
mov ebx, dword [edx]
xor ebx, esi
mov dword [edi], ebx
add edi, 0x3751ce73
sub edi, 0x3751ce6f
add edx, 4
loop 0x403568
add eax, 0xde7c4e74
sub eax, 0xde7b25b5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xdc2497f0
sub ecx, 0xdbe497f0
add ecx, dword [ebp - 4]
call ebx
leave
ret