joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10108450
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes

Disassembly:
sub esp, 0xc04
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0xc00], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc10]
push esi
push edi
xor ebx, ebx
push 0x3fe
lea eax, [esp + 0x416]
push ebx
push eax
mov word [esp + 0x41c], bx
call sub.MSVCR80.dll_memset
push 0x3fe
lea ecx, [esp + 0x822]
push ebx
push ecx
mov word [esp + 0x828], bx
call sub.MSVCR80.dll_memset
push 0x3fe
lea edx, [esp + 0x2e]
push ebx
push edx
mov word [esp + 0x34], bx
call sub.MSVCR80.dll_memset
lea esi, [ebp + 0x1c]
mov eax, esi
add esp, 0x24
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x101084c7
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp ecx, eax
sbb edi, edi
neg edi
jne 0x1010851a
push 0x16a
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push ebx
push str._tcslen_m_tszRoot__0
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
jmp 0x1010864e
lea edx, [esp + 0x410]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x10108525
cmp dword [ebp + 4], ebx
mov ebp, dword [sym.imp.MSVCR80.dll__swprintf]
je 0x10108556
lea ecx, [esp + 0x410]
push ecx
push str._sdriverLoadDrv_x64.exe
lea edx, [esp + 0x818]
push edx
jmp 0x1010856b
lea eax, [esp + 0x410]
push eax
push str._sdriverLoadDrv_Win32.exe
lea ecx, [esp + 0x818]
push ecx
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
lea edx, [esp + 0x810]
push edx
call esi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov edi, ecx
cmp edi, ebx
jne 0x101085c8
push 0x176
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push ebx
push str.GetFileAttributes_tszSrc__INVALID_FILE_ATTRIBUTES
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
jmp 0x1010864e
lea ecx, [esp + 0x410]
push ecx
lea edx, [esp + 0x14]
push str._sLoadDrv.exe
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x10]
call fcn.101090c0
lea eax, [esp + 0x10]
push eax
call esi
cmp eax, 0xffffffff
je 0x101085ff
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp edi, ebx
jne 0x10108651
push 0x17f
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push ebx
push str.CopyFile_tszSrc__tszDes__FALSE_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
mov ecx, dword [esp + 0xc10]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0xc04
ret 4
Function at 0x101090c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov edi, ecx
test edi, edi
jne 0x10109118
push 0x2a2
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push ebx
push str.dwFileAttrib_INVALID_FILE_ATTRIBUTES
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
ret
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
test edi, edi
jne 0x10109163
push 0x2a5
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push ebx
push str.SetFileAttributes_pFile__dwFileAttrib_
push str._s_return_code:_0x_08X___s.
push eax
call edx
mov eax, edi
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x101095a0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x61c
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x229]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x230], bl
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x2e]
push ebx
push ecx
mov word [esp + 0x34], bx
call sub.MSVCR80.dll_memset
movzx edx, word [esi + 0x1c]
push edx
lea eax, [esp + 0x38]
push str.._C:
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x24
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10109665
push 0x321
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push edi
push str.hHandle_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
jmp 0x101096ef
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x400
xor eax, eax
lea edx, [esp + 0x230]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push 0xc
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x101096e1
push ebp
push 0x32f
mov esi, str..green.cpp
call fcn.10107420
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push ebp
push str.bResult
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
pop ebp
jmp 0x101096e8
mov ebx, dword [esp + 0x240]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x624]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x61c
ret
Function at 0x10109b50
Capabilities:
Get hostname
Impersonate user

Disassembly:
sub esp, 0xd0
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0xcc], eax
push esi
push 0xc6
lea eax, [esp + 0xe]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x64
mov word [esp + 0x14], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10109bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
mov ecx, dword [esp + 0xcc]
xor ecx, esp
call fcn.1010dc50
add esp, 0xd0
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebp
xor ecx, ecx
mov ch, al
shr eax, 8
or ecx, eax
cmp ecx, 0x500
je 0x10109be1
call fcn.1007a750
push esi
push 0
push 2
push ebx
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
xor ecx, ecx
mov ch, al
shr eax, 8
pop ebp
or ecx, eax
cmp ecx, 0x500
je 0x10109c14
call fcn.1007a830
mov ecx, dword [esp + 0xd0]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1010dc50
add esp, 0xd0
ret
Function at 0x1010a6a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x1013b024]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
push 0x228
lea eax, [esp + 0x18]
push 0
push eax
or ebx, 0xffffffff
mov dword [esp + 0x1c], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, ebx
jne 0x1010a71e
push 0x23a
call fcn.10109820
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push edi
push str.hProcessSnap_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
jmp 0x1010a7e9
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1010a76a
push 0x23d
call fcn.10109820
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push edi
push str.Process32First_hProcessSnap__pe32_
push str._s_return_code:_0x_08X___s.
push eax
call edx
add esp, 0x14
jmp 0x1010a7e2
mov esi, dword [sym.imp.MSVCR80.dll__wcsicmp]
lea eax, [esp + 0x34]
push str.Abspawnhlp.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x1010a794
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1010a770
jmp 0x1010a79d
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
jne 0x1010a7d2
push 0x248
call fcn.10109820
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push edi
push str.ProcessID__1
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
jmp 0x1010a7e2
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1010dc50
add esp, 0x230
ret
Function at 0x1010dc50
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1013b024]
jne 0x1010dc5a
repz ret
jmp fcn.1010e1df

Function at 0x1010ebeb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1013b024]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1010eb80
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1010ec3a
cmp dword [ebp - 0x1c], 5
jb 0x1010ec52
jmp 0x1010ec4e
cmp dword [ebp - 0x10], 1
jne 0x1010ec52
cmp dword [ebp - 0x1c], 4
ja 0x1010ec4e
jne 0x1010ec52
cmp dword [ebp - 0x18], 0
jbe 0x1010ec52
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10119ac4
call fcn.1010ea54
test eax, eax
jge 0x1010ec73
mov byte [0x101517dc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1010dc50
add ebp, 0x78
leave
ret
Function at 0x439350
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
xor edi, edi
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push esi
mov dword [0x562ab4], eax
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov ecx, dword [0x562ab4]
mov edx, dword [0x562eb4]
mov ebp, dword [esp + 0x20]
mov dword [0x562ab0], eax
lea ebx, [ecx - 1]
mov ecx, dword [0x562abc]
cmp ebx, edi
mov dword [esp + 0x14], ebx
jl 0x4393fc
mov eax, dword [edx + 0x14]
mov esi, ebp
sub esi, eax
mov edi, dword [ecx + 0x14]
mov eax, esi
xor ebp, ebp
shl eax, 4
add eax, esi
shl edi, 1
lea esi, [eax + eax*2]
shl esi, 1
inc ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [ecx + 0xc]
mov eax, ebp
sub eax, edi
add ebp, 2
mov ax, word [eax + ebx]
mov ebx, dword [edx + 0xc]
sub ax, 0x20
movsx eax, ax
add eax, ebx
xor ebx, ebx
mov bl, byte [eax + esi + 6]
mov eax, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
dec eax
mov dword [esp + 0x24], eax
jne 0x4393bf
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
sub esi, eax
xor edi, edi
test ebx, ebx
mov dword [esp + 0x28], esi
jl 0x4394d5
jmp 0x43941c
mov ecx, dword [0x562abc]
mov esi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
mov eax, edi
sub eax, esi
mov ax, word [ecx + eax*2]
mov ecx, ebp
sub ax, 0x20
lea ebp, [esp + 0x18]
movsx esi, ax
mov eax, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, eax
push ebp
mov eax, ecx
push 0x3f800000
shl eax, 4
add eax, ecx
lea ecx, [eax + eax*2]
movsx eax, word [edx + ecx*2]
movsx ebp, word [edx + ecx*2 + 2]
lea ecx, [edx + ecx*2]
push ebp
push eax
imul eax, esi
movsx ecx, word [ecx + 4]
mov edx, dword [0x562aa0]
push ecx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
mov ebx, dword [edx]
push eax
push ecx
push 5
push edx
call dword [ebx + 0x7c]
test eax, eax
fnclex
jge 0x439499
mov edx, dword [0x562aa0]
push 0x7c
push 0x420714
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x562eb4]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
sub ecx, dword [edx + 0x14]
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*2]
xor ecx, ecx
mov cl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add esi, ecx
inc edi
mov dword [esp + 0x28], esi
cmp edi, eax
jle 0x439416
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x43d220
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov edx, dword [0x562eb4]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, ebp
push esi
mov eax, ecx
push edi
shl eax, 4
add eax, ecx
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
lea ebp, [eax + eax*2]
shl ebp, 1
lea eax, [edx + ebp]
mov edx, 1
mov ax, word [eax + 2]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
sub edi, eax
xor eax, eax
mov dword [esp + 0x28], ebx
mov al, byte [edi + edx]
mov ecx, edx
mov esi, eax
test esi, esi
je 0x43d2bd
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov al, byte [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
xor ebx, ebx
add eax, ebp
mov bl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add esi, ebx
cmp ecx, eax
mov dword [esp + 0x28], esi
je 0x43d2b9
inc ecx
xor eax, eax
mov al, byte [edi + ecx]
mov esi, eax
test esi, esi
jne 0x43d28f
mov ebx, dword [esp + 0x10]
movsx eax, word [esp + 0x30]
cmp dword [esp + 0x28], eax
jle 0x43d2e0
test ebx, ebx
jle 0x43d2e0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add esi, eax
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
cmp edx, ecx
jg 0x43d302
xor eax, eax
mov al, byte [edi + edx]
mov esi, eax
mov eax, dword [esp + 0x18]
add esi, eax
xor eax, eax
mov al, byte [esi + ebp + 6]
add ebx, eax
inc edx
cmp edx, ecx
jle 0x43d2e4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x2c]
lea edx, [ecx + 1]
xor ecx, ecx
mov cl, byte [eax + 4]
cmp edx, ecx
jle 0x43d271
mov ax, word [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x481320
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x562ad4]
push esi
push edi
xor eax, eax
lea edx, [ecx + ecx*4]
shl edx, 0xa
add edx, ecx
mov ecx, dword [0x562ec8]
mov ecx, dword [ecx + edx*8 + 0x9ff8]
mov edx, dword [esp + 0xc]
mov esi, edx
mov edi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub esi, edi
pop edi
mov ecx, dword [ecx + esi*8 + 4]
pop esi
test ecx, ecx
jne 0x48136d
push ecx
push ecx
push 8
push 7
push 1
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.004812b0
ret 8
cmp ecx, 4
je 0x4815a1
cmp ecx, 6
je 0x4815a1
cmp ecx, 9
je 0x481589
cmp ecx, 0xa
je 0x481589
cmp ecx, 0xd
je 0x481571
cmp ecx, 0xe
je 0x481571
cmp ecx, 0x12
je 0x481571
cmp ecx, 0x13
je 0x481571
cmp ecx, 0x17
je 0x481559
cmp ecx, 0x18
je 0x481559
cmp ecx, 0x1c
je 0x481541
cmp ecx, 0x1d
je 0x481541
cmp ecx, 0x1f
jne 0x4813f6
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0x28
push 2
push edx
push eax
call fcn.004812b0
ret 8
cmp ecx, 0x21
je 0x481529
cmp ecx, 0x22
je 0x481529
cmp ecx, 0x24
je 0x481511
cmp ecx, 0x25
je 0x481511
cmp ecx, 0x28
je 0x4814f9
cmp ecx, 0x29
je 0x4814f9
cmp ecx, 0x2c
je 0x4814f9
cmp ecx, 0x2d
je 0x4814f9
cmp ecx, 0x31
je 0x4814e1
cmp ecx, 0x32
je 0x4814e1
cmp ecx, 0x34
je 0x4814c9
cmp ecx, 0x35
je 0x4814c9
cmp ecx, 0x3a
jl 0x48147c
cmp ecx, 0x3c
jg 0x48147c
mov ecx, dword [esp + 8]
push 0x34
push 0x33
push 0x32
push 0x31
push 2
push edx
push ecx
call fcn.004812b0
ret 8
cmp ecx, 0x3f
je 0x4814b1
cmp ecx, 0x40
je 0x4814b1
cmp ecx, 0x44
je 0x4814b1
cmp ecx, 0x45
je 0x4814b1
cmp ecx, 0x47
jne 0x4815b6
push 0
push 0
push 0x12
push 0x11
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.004812b0
ret 8
mov eax, dword [esp + 8]
push 0x39
push 0x38
push 0x37
push 0x36
push 2
push edx
push eax
call fcn.004812b0
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0x2d
push 2
push edx
push ecx
call fcn.004812b0
ret 8
push 0
push 0
push 0x3f
push 0x3e
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.004812b0
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0x3d
push 0x3c
push 2
push edx
push eax
call fcn.004812b0
ret 8
mov ecx, dword [esp + 8]
push 0x42
push 0x41
push 0x40
push 0x3b
push 2
push edx
push ecx
call fcn.004812b0
ret 8
push 0
push 0x1a
push 0x19
push 0x18
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.004812b0
ret 8
mov eax, dword [esp + 8]
push 0
push 0x21
push 0x20
push 0x1f
push 2
push edx
push eax
call fcn.004812b0
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0x15
push 0x14
push 2
push edx
push ecx
call fcn.004812b0
ret 8
push 0xf
push 0xe
push 0xd
push 0xc
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.004812b0
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0xc
push 2
push edx
push eax
call fcn.004812b0
ret 8
mov ecx, dword [esp + 8]
push 5
push 4
push 3
push 2
push 2
push edx
push ecx
call fcn.004812b0
ret 8
Function at 0x4b0d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405996
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403228
mov eax, dword [0x563668]
lea ecx, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
sub eax, dword [ecx + 0x14]
mov edx, eax
shl edx, 6
add edx, eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0xc]
lea esi, [eax + edx*4 + 8]
mov eax, dword [0x56366c]
mov edx, ecx
sub edx, dword [eax + 0x14]
lea edi, [edx*8]
sub edi, edx
lea edx, [edx + edi*4]
mov edi, dword [eax + 0xc]
mov word [edi + edx*4 + 0x60], 0xffff
mov edi, dword [eax + 0x14]
mov edx, ecx
mov ebx, dword [esi + 0x20]
sub edx, edi
lea edi, [edx*8]
sub edi, edx
lea edx, [edx + edi*4]
mov edi, dword [eax + 0xc]
mov dword [edi + edx*4 + 0x64], ebx
mov edi, dword [eax + 0x14]
mov edx, ecx
mov ebx, dword [esi + 0x30]
sub edx, edi
lea edi, [edx*8]
sub edi, edx
lea edx, [edx + edi*4]
mov edi, dword [eax + 0xc]
mov dword [edi + edx*4 + 0x68], ebx
mov ebx, dword [eax + 0x14]
sub ecx, ebx
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [ecx + edx*4]
mov edx, dword [eax + 0xc]
mov eax, dword [esi + 0x2c]
mov dword [edx + ecx*4 + 0x70], eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
wait
push 0x4b0e7a
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
ret

Function at 0x4b80e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405996
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403438
fild dword [ebp + 8]
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x30]
mov edx, dword [0x562ec8]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fdiv qword [0x403430]
rep stosd dword es:[edi], eax
mov eax, dword [0x562ad4]
lea ecx, [eax + eax*4]
shl ecx, 0xa
add ecx, eax
lea esi, [edx + ecx*8]
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fadd qword [0x402498]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea edx, [ecx + ecx*2]
movzx di, byte [esi + edx*8 + 0xdf7]
add word [esi + eax*2 + 0xa88], di
lea edx, [esi + edx*8]
lea eax, [edx + 0xdf4]
movzx dx, byte [edx + 0xdf4]
mov byte [esi + ecx + 0x424], bl
lea ecx, [ebp - 0x30]
push ecx
add edx, 0x64
push eax
push 0x41ec1c
movsx edi, dx
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
call fcn.004b82b0
push edi
call fcn.004bdb80
mov edx, dword [0x5635a8]
mov eax, dword [0x5635e0]
mov ecx, dword [0x5635c4]
mov dword [edx + edi*4 + 0x30], ebx
mov dword [eax + edi*4 + 0x30], ebx
mov dword [ecx + edi*4 + 0x30], ebx
call fcn.004be040
push 0xffffffffffffffff
call fcn.00499850
wait
push 0x4b81dd
lea edx, [ebp - 0x30]
push edx
push 0x41ec1c
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
ret
Function at 0x536900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x405996
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x404cc0
push 0x11
lea eax, [ebp - 0x28]
xor esi, esi
push 0x42c394
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov ebx, eax
mov dword [ebp - 0x34], ebx
fild dword [ebp - 0x34]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
fdiv qword [0x401538]
fstp qword [ebp - 0x50]
fild dword [ebp - 0x34]
fstp qword [ebp - 0x58]
fld qword [ebp - 0x58]
fdiv qword [0x401538]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
and eax, 0x80000001
jns 0x536988
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x5c], eax
fild dword [ebp - 0x5c]
fstp qword [ebp - 0x64]
fld qword [ebp - 0x50]
fsub qword [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
push 4
mov dword [ebp - 0x3c], eax
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041fa70
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
xor dl, byte [eax + 2]
add ecx, ebx
mov al, byte [ecx]
xor al, dl
mov byte [ecx], al
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
sub ecx, esi
mov dl, byte [ecx + ebx - 1]
mov ecx, dword [ebp - 0x1c]
xor dl, byte [ecx + 3]
mov cl, byte [eax + esi + 1]
xor cl, dl
mov byte [eax + esi + 1], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov edx, eax
sub edx, esi
mov cl, byte [edx + ebx]
mov dl, byte [eax + esi]
xor cl, dl
mov edx, dword [ebp - 0x1c]
xor cl, byte [edx]
mov byte [eax + esi], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi + 1]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
add esi, 2
xor dl, byte [eax + 1]
mov al, byte [ecx + ebx - 1]
lea ecx, [ecx + ebx - 1]
xor al, dl
mov byte [ecx], al
mov eax, dword [ebp - 0x38]
cmp esi, eax
jne 0x5369bf
wait
push 0x536a69
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push edx
push 0
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret