joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c15e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x45c1c1
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045b55c
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor eax, eax
mov dword [edx], eax
xor eax, eax
jmp 0x45c2a3
cmp esi, edi
jne 0x45c1cf
mov eax, 0x1001
jmp 0x45c2a3
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045b55c
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add edi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jb 0x45c27b
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov ecx, dword [edi]
xor ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [edi + 4]
xor eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
xor edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [edi + 0xc]
xor ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jae 0x45c236
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.0045b55c
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
sub dword [edx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c2aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x45c30d
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045b55c
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor eax, eax
mov dword [edx], eax
xor eax, eax
jmp 0x45c408
cmp esi, edi
jne 0x45c31b
mov eax, 0x1001
jmp 0x45c408
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045b55c
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add edi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jb 0x45c3df
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov eax, dword [edi]
xor dword [ebx + 0x18], eax
mov edx, dword [edi + 4]
xor dword [ebx + 0x1c], edx
mov ecx, dword [edi + 8]
xor dword [ebx + 0x20], ecx
mov eax, dword [edi + 0xc]
xor dword [ebx + 0x24], eax
mov edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jae 0x45c38e
push dword [ebp + 0x10]
push edi
lea edx, [ebx + 0x28]
push edx
call fcn.0045b55c
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp + 0x10]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c589
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], 0x10
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
lea edx, [ebx + 0x18]
push edx
push eax
call fcn.0045dc88
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x45c5ce
mov cl, byte [ebx + eax + 0x28]
xor cl, byte [ebx + eax + 0x18]
mov byte [edi + eax], cl
inc eax
cmp esi, eax
ja 0x45c5be
mov edi, dword [ebp + 0x10]
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45ca45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x45caa9
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045b55c
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dword [eax], edx
xor eax, eax
jmp 0x45cb97
cmp edi, esi
jne 0x45cab7
mov eax, 0x1001
jmp 0x45cb97
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
push ecx
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045b55c
add esp, 0xc
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
add edi, edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
sub dword [ebp + 0x10], ecx
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov edx, dword [ebx + 0x18]
xor edx, dword [ebx + 0x28]
mov dword [esi], edx
mov ecx, dword [ebx + 0x1c]
xor ecx, dword [ebx + 0x2c]
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0x20]
xor eax, dword [ebx + 0x30]
mov dword [esi + 8], eax
mov edx, dword [ebx + 0x24]
xor edx, dword [ebx + 0x34]
mov dword [esi + 0xc], edx
add esi, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jbe 0x45cb6e
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
ja 0x45cb29
push dword [ebp + 0x10]
push edi
lea edx, [ebx + 0x28]
push edx
call fcn.0045b55c
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp + 0x10]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cb9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x45cc02
push dword [ebp + 0x10]
push esi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.0045b55c
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dword [eax], edx
xor eax, eax
jmp 0x45cd1f
cmp esi, edi
jne 0x45cc10
mov eax, 0x1001
jmp 0x45cd1f
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
push ecx
push esi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.0045b55c
add esp, 0xc
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
add esi, edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
sub dword [ebp + 0x10], ecx
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov edx, dword [ebx + 0x18]
xor edx, dword [ebx + 0x28]
mov dword [edi], edx
mov ecx, dword [ebx + 0x1c]
xor ecx, dword [ebx + 0x2c]
mov dword [edi + 4], ecx
mov eax, dword [ebx + 0x20]
xor eax, dword [ebx + 0x30]
mov dword [edi + 8], eax
mov edx, dword [ebx + 0x24]
xor edx, dword [ebx + 0x34]
mov dword [edi + 0xc], edx
mov ecx, dword [ebx + 0x28]
mov dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
mov dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
mov dword [ebx + 0x24], ecx
add edi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x45ccf6
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.0045dc88
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
mov edx, dword [esi + 4]
mov dword [ebx + 0x1c], edx
mov ecx, dword [esi + 8]
mov dword [ebx + 0x20], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x24], eax
add esi, dword [ebp - 8]
add edi, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
ja 0x45cc9a
push dword [ebp + 0x10]
push esi
lea eax, [ebx + 0x28]
push eax
call fcn.0045b55c
add esp, 0xc
mov edx, dword [ebx + 0x38]
and edx, 0xf0000000
add edx, dword [ebp + 0x10]
mov dword [ebx + 0x38], edx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45cef6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
lea ecx, [ebx + 0x18]
push ecx
push eax
call fcn.0045dc88
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x45cf30
mov dl, byte [ebx + eax + 0x28]
xor dl, byte [ebx + eax + 0x18]
mov byte [edi + eax], dl
inc eax
cmp esi, eax
ja 0x45cf20
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4647a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x464836
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp byte [esi + 0x30], 0
jne 0x4647eb
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004089a8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404860
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x34]
call fcn.00408c7c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
call fcn.00404e20
mov esi, eax
push ebx
mov ecx, esi
sub ecx, 1
jno 0x46480f
call fcn.00403a14
mov eax, dword [ebx]
mov edx, 1
call fcn.00404d3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46483d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404830
ret
Function at 0x46a4dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.0040480c
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.0040322c
push 0
push edi
lea eax, [ebp - 0x105]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.004098f8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4331c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401e36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401668
xor esi, esi
mov edx, 0x40b210
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x54], esi
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.0042ce90
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
call fcn.0042bab0
mov edi, dword [0x461098]
mov ecx, 0xa
mov dword [ebp - 0x30], ecx
mov edx, 0x80020004
mov ebx, dword [edi]
lea edi, [ebp - 0x20]
push edi
mov eax, edx
sub esp, 0x10
mov dword [ebp - 0x28], edx
mov edi, esp
sub esp, 0x10
mov dword [edi], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [edi + 4], ecx
mov ecx, esp
sub esp, 0x10
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x44]
mov dword [edi + 0xc], eax
mov eax, 0xa
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 4], eax
mov eax, esp
push 0x40b240
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x34]
mov dword [ecx + 0xc], edx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov cx, word [eax]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrI2]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x18]
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, dword [0x461098]
push eax
push edx
call dword [ebx + 0xbc]
cmp eax, esi
fnclex
jge 0x4332e7
mov ecx, dword [0x461098]
push 0xbc
push 0x403a14
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x14]
push eax
push edx
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVBVM60.DLL___vbaObjSet]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push eax
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov edx, dword [eax]
push eax
call dword [edx + 0xcc]
cmp eax, esi
fnclex
jge 0x433332
mov ecx, dword [ebp - 0x14]
push 0xcc
push 0x403a24
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
call fcn.00440b40
push 0x433365
jmp 0x43335b
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xa0376b1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2ceb6ef1
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x762f3c01
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x79ff5909
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x43de6d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43de92
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 1
call fcn.0043dfc0
pop ecx
pop ecx
jmp 0x43dfbc
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43dfab
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43df84
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x43df1b
mov dword [ebp - 0xc], 1
jmp 0x43df1f
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jge 0x43df32
mov dword [ebp - 0x10], 1
jmp 0x43df36
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x43df53
mov dword [ebp - 0x14], 1
jmp 0x43df57
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jl 0x43df71
mov eax, 0xbfa32a17
test eax, eax
jne 0x43df71
mov dword [ebp - 0x18], 1
jmp 0x43df75
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [eax]
mov eax, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x43dfa9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x43dfa9
push 0x17bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x43dfbc
push 0x3041
push 0
push 0
call fcn.00434be4
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x483d61
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret