joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [ebp - 0x10], esp
push str.HeapFree
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x20], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov al, 0x45
mov cl, 0x72
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x38], al
mov al, 0x6c
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], al
mov byte [ebp - 0x26], al
mov al, 0x65
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], al
mov byte [ebp - 0x24], cl
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
xor ebx, ebx
push eax
push ecx
mov byte [ebp - 0x3c], 0x4b
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x37], 0x4c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2c], 0x56
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x25], 0x46
mov byte [ebp - 0x21], bl
call esi
push eax
call edi
push str.GetProcessHeap
push str.KERNEL32.dll
mov dword [ebp - 0x18], eax
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x14]
push 0x42b038
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov esi, dword [ebp + 8]
test esi, esi
je 0x40a2a1
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40a23c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [eax + 0x28]
add ecx, ebx
inc eax
dec ebx
dec eax
inc ebx
mov edx, dword [esi + 4]
push 0
push 0
push edx
call ecx
mov dword [esi + 0x10], 0
nop
nop
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x40a27b
mov eax, dword [esi + 0xc]
xor edi, edi
test eax, eax
jle 0x40a26b
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 8]
mov eax, dword [eax + edi*4]
cmp eax, 0xffffffff
je 0x40a263
push eax
call ebx
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jl 0x40a255
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [esi + 8]
push ecx
call fcn.00401203
add esp, 4
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [esi + 4]
test eax, eax
je 0x40a291
push 0x8000
push 0
push eax
call dword [ebp - 0x18]
nop
nop
nop
nop
nop
nop
push esi
push 0
call dword [ebp - 0x1c]
push eax
call dword [ebp - 0x20]
mov eax, 0x40a2a7
ret
Function at 0x6cec6b50
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x6cec6b87

Function at 0x6cec6d00
Capabilities:
Enumerate pe sections

Disassembly:
cmp eax, ebx
je 0x6cec7305
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.6cec6b0c
cwde
lodsd eax, dword [esi]
push esp
push ds
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi

Function at 0x6cec6dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.6cec6ad1
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x6cec6dfa
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
invalid
inc ebp
invalid

Function at 0x6cec6ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.6cec6b1c
push eax
push esi
push dword [ebp + 8]
call fcn.6cec6ad1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
inc esp

Function at 0x6cec6f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
invalid
stosb byte es:[edi], al
sti
Function at 0x6cec71b0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x6cec71c0
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x6cec71bb
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x6cec71a5
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x6cec71ad
cmp edx, ebx
jne 0x6cec72fb
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x6cec717c
add eax, dword [eax + 4]
jmp 0x6cec7169
mov dword [ebp + 0xc], ebx
jmp 0x6cec71cb
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x6cec71e3
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x6cec7201
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x6cec725f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x6cec7246
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x6cec724f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x6cec7259
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x6cec723b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x6cec71c5
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x6cec72ac
dec eax
je 0x6cec72a3
sub eax, 3
je 0x6cec729a
mov dword [ebp - 4], 0x40
jmp 0x6cec72c9
mov dword [ebp - 4], 4
jmp 0x6cec72af
mov dword [ebp - 4], 0x20
jmp 0x6cec72af
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x6cec72fb
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x6cec727b
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.6cec6b0c
sbb esp, eax
xchg ecx, eax
std
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x6cec7307
Function at 0x6cec7350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.6cec6b1c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6cec6ad1
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
invalid
Function at 0x6cece8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x40
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
test edx, edx
je 0x6cece9b3
mov edi, edx
mov ecx, edx
shr edi, 0x1f
neg ecx
mov ebx, edi
test bl, bl
cmovne edx, ecx
bsr ebx, edx
xor ebx, 0x1f
lea esi, [ebx + 0x70]
mov dword [esp + 4], 0x401e
sub dword [esp + 4], ebx
add ebx, 0x51
mov ecx, ebx
cmovns esi, ebx
sar ecx, 0x1f
shr ecx, 0x1b
add ebx, ecx
and ebx, 0x1f
sar esi, 5
sub ebx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], esi
mov dword [esp], ebx
jne 0x6cecea06
cmp esi, 3
jg 0x6cecea74
mov ecx, esi
neg ecx
lea edx, [esp + 0x30]
lea ebx, [esp + esi*4 + 0x20]
shl ecx, 2
mov edi, dword [edx + ecx]
sub edx, 4
mov dword [edx + 4], edi
cmp edx, ebx
jne 0x6cece969
sub esi, 1
test esi, esi
js 0x6cece98e
lea ebp, [esp + 0x24]
mov dword [ebp + esi*4], 0
sub esi, 1
jns 0x6cece981
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
movzx esi, word [esp + 0x30]
mov dword [esp], edi
movzx edi, word [esp + 4]
movzx ebp, byte [esp + 0x10]
and di, 0x7fff
jmp 0x6cece9c4
xor ebp, ebp
xor edi, edi
xor esi, esi
xor ecx, ecx
mov dword [esp], 0
xor ebx, ebx
mov word [esp + 0x20], si
movzx esi, word [esp + 0x22]
shl ebp, 7
and si, 0x8000
or esi, edi
mov edi, dword [esp]
mov word [esp + 0x22], si
shr si, 8
and esi, 0x7f
or esi, ebp
mov edx, esi
mov byte [esp + 0x23], dl
mov edx, dword [esp + 0x20]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0xc], edx
add esp, 0x40
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 2
jg 0x6cecea65
mov edx, 3
mov edi, dword [esp]
lea ebp, [esp + 0x24]
sub edx, esi
mov dword [esp + 8], 0x20
lea edx, [ebp + edx*4]
sub dword [esp + 8], edi
mov edi, eax
mov eax, dword [edx - 4]
movzx ecx, byte [esp + 8]
mov ebx, dword [edx]
shr eax, cl
movzx ecx, byte [esp]
shl ebx, cl
or eax, ebx
mov dword [edx + esi*4], eax
sub edx, 4
cmp edx, ebp
jne 0x6cecea2b
mov edx, dword [esp + 0x24]
mov eax, edi
sub esi, 1
movzx ecx, byte [esp]
mov edi, dword [esp + 0xc]
shl edx, cl
mov dword [esp + edi*4 + 0x24], edx
jmp 0x6cece979
mov esi, 2
mov dword [esp + 0xc], 3
jmp 0x6cecea52
mov esi, 3
jmp 0x6cece97d
Function at 0x6cecea80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
test edx, edx
je 0x6ceceb47
bsr ecx, edx
xor ecx, 0x1f
lea esi, [ecx + 0x70]
mov dword [esp + 4], 0x401e
sub dword [esp + 4], ecx
add ecx, 0x51
mov ebx, ecx
cmovns esi, ecx
sar ebx, 0x1f
shr ebx, 0x1b
add ecx, ebx
and ecx, 0x1f
sar esi, 5
sub ecx, ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], esi
mov dword [esp], ecx
jne 0x6ceceb90
cmp esi, 3
jg 0x6cecec00
mov ebx, esi
neg ebx
lea edx, [esp + 0x2c]
lea edi, [esp + esi*4 + 0x1c]
shl ebx, 2
mov ecx, dword [edx + ebx]
sub edx, 4
mov dword [edx + 4], ecx
cmp edx, edi
jne 0x6ceceb05
sub esi, 1
test esi, esi
js 0x6ceceb2a
lea ebp, [esp + 0x20]
mov dword [ebp + esi*4], 0
sub esi, 1
jns 0x6ceceb1d
movzx edi, word [esp + 4]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
movzx edx, word [esp + 0x2c]
and di, 0x7fff
jmp 0x6ceceb51
xor edi, edi
xor edx, edx
xor ecx, ecx
xor ebx, ebx
xor esi, esi
mov word [esp + 0x1c], dx
movzx edx, word [esp + 0x1e]
and dx, 0x8000
or edx, edi
mov word [esp + 0x1e], dx
shr dx, 8
and edx, 0x7f
mov byte [esp + 0x1f], dl
mov edx, dword [esp + 0x1c]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 2
jg 0x6cecebf0
mov edx, 3
mov edi, dword [esp]
lea ebp, [esp + 0x20]
sub edx, esi
mov dword [esp + 8], 0x20
lea edx, [ebp + edx*4]
sub dword [esp + 8], edi
mov edi, eax
mov eax, dword [edx - 4]
movzx ecx, byte [esp + 8]
mov ebx, dword [edx]
shr eax, cl
movzx ecx, byte [esp]
shl ebx, cl
or eax, ebx
mov dword [edx + esi*4], eax
sub edx, 4
cmp edx, ebp
jne 0x6cecebb5
mov edx, dword [esp + 0x20]
mov eax, edi
sub esi, 1
movzx ecx, byte [esp]
mov edi, dword [esp + 0xc]
shl edx, cl
mov dword [esp + edi*4 + 0x20], edx
jmp 0x6ceceb15
mov esi, 2
mov dword [esp + 0xc], 3
jmp 0x6cecebdc
mov esi, 3
jmp 0x6ceceb19
Function at 0x6ced0b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6ced0b9f
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
leave
ret
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x6ced2d50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x6ced5424
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym.___write_memory.part.0
Function at 0x6ced3400
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6ced63a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6ced63bc]
sub esp, 4
test ebx, ebx
je 0x6ced3455
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6ced344e
test esi, esi
je 0x6ced344e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ced3430
mov dword [esp], 0x6ced63a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6ced3640
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x6ced3650
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x6ced364d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000a7c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002a134
call fcn.100162ec
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000a844
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000a844
call fcn.10004432
mov esi, eax
jmp 0x1000a91b
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000a867
call fcn.10004432
jmp 0x1000a90e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1000a85d
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000a897
mov esi, 0x8007000e
jmp 0x1000a910
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000b141
jmp 0x1000a8bd
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000a890
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000a85d
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000b141
mov esi, eax
test edi, edi
je 0x1000a91b
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000a934
lea ecx, [ebp - 0x418]
call fcn.10009f30
mov eax, esi
call fcn.1001623e
ret 0x10
Function at 0x1000f7c9
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002a5ef
call fcn.1001624d
mov ebx, ecx
mov eax, dword [ebx]
xor esi, esi
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000b141
and dword [ebp - 4], esi
cmp dword [ebx + 0x44], esi
je 0x1000f873
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000b141
test al, al
je 0x1000f849
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push dword [ebx + 0x44]
movsd dword es:[edi], dword [esi]
push eax
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000b141
add esp, 0x28
mov byte [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1000f862
push 0
push str.Close
push dword [ebx + 0x44]
push 0
push 1
push ebx
call fcn.1000b141
add esp, 0x18
mov esi, eax
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x1000f873
and dword [ebx + 0x44], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebx + 0x24], 0
je 0x1000f893
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000b141
test al, al
je 0x1000f893
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.1001621b
ret
Function at 0x100106e6
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x210
mov eax, 0x1002a68f
call fcn.10016280
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 8], edi
je 0x1001070c
mov eax, reloc.OLEAUT32.dll_VariantCopyInd
jmp 0x1001087d
lea ecx, [esi - 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x10010725
mov eax, 0x80004005
jmp 0x1001087d
mov edx, dword [ebp + 0x10]
mov eax, edx
and eax, reloc.OLEAUT32.dll_SysReAllocString
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
push ebx
sete al
mov byte [ecx + 0x31], al
mov ecx, reloc.OLEAUT32.dll_SysReAllocStringLen
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x32], cl
mov eax, reloc.OLEAUT32.dll_VariantClear
and edx, eax
cmp edx, eax
mov eax, dword [esi + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [esi + 0x14]
add ecx, 0x28
call fcn.1000b141
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000b141
push str.Excel.Application
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.1000b141
test al, al
je 0x1001085a
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.10016100
push 0x5c
push ebx
call fcn.1000b141
add esp, 0x14
test eax, eax
jne 0x100107d3
push 0x2f
push ebx
call fcn.1000b141
pop ecx
pop ecx
test eax, eax
je 0x100107f3
add eax, 2
push 0x2e
push eax
call fcn.1000b141
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1000b141
add esp, 0x14
cmp word [ebp - 0x218], 0
je 0x10010853
push edi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1000b141
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10010845
lea eax, [ebp - 0x218]
push eax
call fcn.1000b141
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001084b
push ebx
call fcn.1000b141
mov eax, dword [esi + 0x14]
add eax, 0x24
jmp 0x10010866
mov edi, 0x80004005
jmp 0x1001086f
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x24
call fcn.1000b141
push eax
lea ecx, [esi + 0x10]
call fcn.1000b141
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.1001622f
ret 0xc