joyce8/EMBER2024-capa huggingface dataset:
Function at 0x800d15
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xb], ah
mov bx, 0x4aa9
mov dl, 0xc
not dx
mov byte [esp + 5], bh
add al, dh
jmp 0x800d61
btc eax, edi
mov ax, word [esp + 0x16]
rcr eax, 5
push word [esp + 0xd]
mov edx, ecx
inc di
jmp 0x800ce0
lea ecx, [ecx - 0xd3]
pop dword [esp + 0xc]
mov edi, 0x7ee38d5c
mov ebx, eax
jmp 0x800cfb
mov dword [esp + 7], ecx
mov bh, byte [esp + 0xe]
xchg byte [esp + 8], al
mov bx, di
push word [esp + 0xc]
cpuid
jmp 0x800d9d
mov dword [esp + 0xe], ecx
xchg edx, edi
mov cl, 0xa2
cpuid
rdtsc
neg ah
jmp 0x800d3f
bsf bx, si
neg bx
bswap edi
mov cx, sp
cld
xchg byte [esp + 0x18], bl
jmp 0x800dda
lea ecx, reloc.kernel32.dll_GetCurrentProcessId
inc cl
mov bl, bh
push dword [esp + 0x18]
mov bp, bx
add esp, 5
jmp 0x800d71

Function at 0x800ffe
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
lea ebx, [edi + edi]
jmp 0x800e77
rdtsc
rcl dx, cl
mov byte [esp + 1], ah
push word [esp + 0x15]
mov word [esp + 6], sp
jmp 0x800ea5
push dword [esp + 8]
pop dword [esp + 0xc]
call fcn.00800f02
int1
pushal
not byte [ecx - 0x62f66ea0]
or eax, 0x6c10a754
jg 0x800f07
int1
imul esi, dword [eax + 0x68], 0x7061706c
imul ebp, dword [esi], reloc.kernel32.dll_GetCurrentProcessId
pushal
mov dx, sp
mov bx, word [esp + 8]
pop word [esp + 0xf]
jmp 0x800fda
mov ebx, 0x245c87de
adc bl, ch
salc
lea ebx, [edi]
invalid
mov si, 0xdbc7
lea ecx, [esp + edx]
lea eax, [ebp + 0x17]
cpuid
pop dx
sete ch
jmp 0x800f5d
not ch
stc
mov ebp, dword [esp + 0x1b]
lea ebx, [esp + ebx]
stc
xchg ebx, ebp
jmp 0x800f35
mov word [esp + 8], bx
bswap edi
btr ecx, esp
mov bh, byte [esp + 0x2d]
mov dl, 4
mov edi, eax
jmp 0x800f92
lea edx, [eax - 0xa1]
clc
mov ecx, 0x5806b2c6
lea edx, [edx*4]
btr ecx, esp
pop word [esp + 9]
jmp 0x800f4e
mov dword [esp + 3], ecx
bsr cx, cx
mov dword [esp + 0x27], eax
mov word [esp + 0x24], di
mov edx, 0xa243e936
cpuid
jmp 0x801014
shl di, cl
xchg bp, bx
mov ecx, dword [esp + 0x35]
push dword [esp + 6]
pop si
lea edx, [edi + ebp]
jmp 0x800f75
xchg byte [esp + 9], cl
mov ax, dx
mov si, 0x1599
mov dword [esp + 0x25], ecx
mov dl, dh
cmc
jmp 0x800fb1
mov byte [esp + 0xf], ah
pop ecx
cpuid
setp ah
call 0x800ffe
or bl, byte [eax - 0x79]
ljmp 0xb900
btc esi, edi
btr ebx, esp
mov ebx, 0x72deb3ce
pop edx
lea esp, [esp + 0x19]
mov dh, byte [esp + 0x1a]
jmp 0x800fee
Function at 0x80122a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x41]
rdtsc
lea esi, [esi - 0xfd]
cpuid
shr eax, 0x13
jmp 0x8016bb
mov ebp, esi
pushal
btr eax, esp
mov esi, dword [esp + 0x1a]
sub esp, 0x1c
jmp 0x801211
rdtsc
not ecx
call fcn.008012d7
not ecx
xchg ah, bl
mov si, word [esp + 6]
lea esp, [esp + 6]
xchg bx, dx
mov byte [esp + 7], bh
jmp 0x801333
add esp, 3
mov ebx, dword [esp + 5]
mov byte [esp + 0xc], bh
mov ecx, dword [esp + 0xf]
pop ax
btc ecx, edi
jmp 0x80138f
lea esi, [ecx + 0xf3]
push esp
cpuid
lea edi, [ebp - 0xf7]
lea esp, [esp + 0xb]
xor eax, esi
jmp 0x8013e9
mov edi, eax
pop word [esp + 9]
xchg dword [esp + 6], eax
mov dword [esp + 3], eax
pop ecx
xchg dword [esp + 2], edi
jmp 0x801372
mov byte [esp], ah
mov di, 0xe699
lea esp, [esp]
add esp, 0
xchg bx, si
xchg ebx, eax
call fcn.008013a5
fisttp dword [edx - 0x28]
mov edi, 0x826bbb4a
cmp eax, 0xc1e69f0c
int 0x13
ror ebp, 0x13
lea ecx, [esi + 0x8d]
lea edi, [esi - 0x75]
cld
xchg bh, cl
not dh
jmp 0x8013c6
add esp, 1
add esp, 1
cld
neg bx
cmc
shl dx, cl
jmp 0x8012f1
lea ebp, [edx*4]
push esp
mov dword [esp], ecx
rdtsc
mov si, 0x12d7
mov byte [esp + 2], ah
jmp 0x801603

Function at 0x8013a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x801414
and bx, 0x9862
neg eax
rdtsc
push word [esp + 2]
lea ebx, [eax*4]
lea ebx, [eax + ebx]
jmp 0x8013fc
rcl cx, cl
mov dword [esp + 1], ecx
neg ebx
mov ebx, 0xa7f0354
cld
jmp 0x801487
push word [esp]
lea edi, [ecx*4]
xchg byte [esp + 2], bl
lea edx, [ebp + 0xaf]
not edi
mov si, sp
jmp 0x8013a7
setne ch
not bp
xchg cx, si
bswap esi
rdtsc
jmp 0x80149b
sub esp, 0x14
push dword [esp + 2]
lea ebx, [esi - 0x95]
neg ah
bswap ebx
jmp 0x801459
xchg word [esp + 3], cx
mov bp, di
mov edi, 0x55522ee8
neg ebx
inc edx
pop bx
jmp 0x801470
and bx, 0x5fda
mov byte [esp + 0x19], bh
cpuid
mov cl, ch
lea edi, [eax + 0x59]
jmp 0x8014c1
mov cx, 0xd8ed
inc ebx
rdtsc
add esp, 2
lea esp, [esp + 0x19]
xchg byte [esp], bl
jmp 0x80159e
xchg byte [esp + 0x19], cl
cpuid
cpuid
xchg bh, cl
lea ebp, [edx*4]
jmp 0x8014f3
setle ah
push dword [esp + 0x1c]
cmc
bswap ebx
btc esi, edi
pop word [esp + 0x1d]
jmp 0x801514
btr eax, esp
pushal
mov word [esp + 0xa], bx
lea ecx, [esi + 0xb5]
cpuid
jmp 0x80152b
pop di
xchg ecx, ebx
lea ebp, [ecx*4]
push esp
cld
xchg cx, bx
jmp 0x801547
inc ebp
cmc
lea eax, [edx + ebx]
pop word [esp]
mov cx, bx
neg bh
jmp 0x801560
Function at 0x801641
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
xchg word [esp + 1], si
xchg dword [esp], edx
jmp 0x801650
not esi
xchg word [esp + 1], dx
setl bh
mov cl, 0x92
xchg dword [esp], eax
mov bx, 0x86e1
jmp 0x80169c
lea ecx, [eax - 0x81]
mov ebp, eax
pushal
rdtsc
mov word [esp + 0x20], dx
mov dx, word [esp + 4]
jmp 0x801a01
lea esi, [eax*4]
mov bx, sp
push dword [esp + 2]
mov ebp, 0x6aa9d578
bswap ebp
jmp 0x80167f
lea edi, [ebp - 0x77]
inc dx
clc
setnp bh
inc ecx
not ch
jmp 0x8017dd
setl dh
mov al, ah
mov eax, dword [esp]
rcr ah, 1
setl dh
mov bx, 0x64c3
jmp 0x8016d5
mov ebp, dword [esp]
mov bl, 0x88
rcr edi, 0x13
add cx, 0x772e
xchg ebp, ebx
cpuid
jmp 0x8016f5
not ebp
rdtsc
rdtsc
cpuid
clc
btr eax, edx
jmp 0x801734
lea ecx, [eax*4]
lea esi, [ebp + 0xcf]
mov ax, word [esp]
jmp 0x801791
mov cl, 0xba
neg ah
neg si
mov dl, 0x94
neg ax
cpuid
jmp 0x801722
mov ebx, dword [esp]
bsf bx, si
call fcn.0080175c
jne 0x5a0f93a1
mov ah, 0xa7
into
pop ecx
mov eax, 0x3c8bdc2a
and al, 0x8b
sbb al, 0x24
sub bl, ah
mov edi, dword [esp]
mov ebx, dword [esp]
mov ecx, dword [esp]
add di, 0x5176
btc esi, edi
jmp 0x80177a
stc
mov bx, word [esp]
mov cl, 0xaa
lea ebp, [eax + 0x19]
lea edi, [esi*4]
inc cx
jmp 0x80174c
mov ecx, 0xb7624564
ror ebx, 0x1f
mov dl, 0xf4
bswap eax
mov cl, 0x32
add si, 0x3896
jmp 0x80170f
cmc
mov byte [esp + 0xb], ah
and cx, 0x6a12
lea ebx, [ebx + edi]
sub esp, 0x1a
lea esp, [esp + 0x42]
jmp 0x801861
sete dh
mov al, ah
setae ah
mov cl, ch
xchg ebp, eax
mov bl, bh
jmp 0x8018be
pop word [esp + 0x21]
mov di, 0xcd4d
bswap ecx
mov al, 0xbe
push word [esp + 0x17]
mov di, 0x4e1d
jmp 0x8019db

Function at 0x80175c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
pushal
lea edi, reloc.kernel32.dll_GetCurrentProcessId
mov ecx, dword [esp + 0x12]
jmp 0x8017bc
mov al, 0x3e
lea esp, [esp + 3]
inc ecx
mov bl, 0x38
xor bp, 0x8f7c
rdtsc
jmp 0x801820
pop dword [esp + 0x14]
lea esp, [esp + 0xb]
rdtsc
neg cx
xchg word [esp + 3], ax
neg ecx
jmp 0x8017a6
mov dword [esp + 2], ecx
mov edx, ecx
pop ebx
bsf dx, si
mov edi, dword [esp + 1]
xchg bp, cx
jmp 0x80184a
bswap ebp
pop si
add esp, 0xf
rdtsc
call fcn.0080182f
fst dword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
mov bl, 0x44
neg esi
not bh
pop edi
stc
lea esi, [edx + edx]
mov byte [esp + 9], ch
pop bx
jmp 0x8017f5
sub esp, 0xe
cld
mov edx, 0xf896c9e
lea ebx, [edx*4]
jmp 0x801809

Function at 0x801c1c
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp]
lea esp, [esp + 1]
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x801c6d
push edx
pop dword [esp]
lea esp, [esp + 3]
jmp 0x801c04
mov eax, dword [eax]
jmp 0x801c7b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x801c57
mov eax, dword [eax + 8]
push eax
jmp 0x80069b

Function at 0x801c95
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 4], di
pushal
lea esp, [esp + 0x4a]
call fcn.00801c50
Function at 0x41855d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4018d8
mov edx, dword [ebp + 0x10]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call sub.MSVBVM60.DLL___vbaStrCopy
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrCopy
push dword [ebp + 0x18]
call sub.MSVBVM60.DLL_rtcSpaceBstr
mov edx, eax
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaStrMove
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaLenBstr
push eax
push dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [eax]
call sub.KERNEL32.DLL_GetPrivateProfileStringW
cmp eax, esi
je 0x4185f2
push eax
push dword [ebp - 0x1c]
call sub.MSVBVM60.DLL_rtcLeftCharBstr
mov edx, eax
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaStrMove
jmp 0x4185fc
xor edx, edx
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaStrCopy
push 0x41861d
jmp 0x41860c
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaFreeStr
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaFreeStr
ret
Function at 0x418c82
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401928
push dword [0x448018]
xor esi, esi
push 0x40ac94
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x5c], esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
push dword [ebp - 0x18]
call sub.SHLWAPI.DLL_PathFileExistsW
test eax, eax
je 0x418dbd
push 0x40acb4
call fcn.00418ba7
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
push dword [ebp - 0x18]
call sub.SHLWAPI.DLL_PathFileExistsW
test eax, eax
je 0x418dbd
push 8
push esi
push esi
push 1
pop esi
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0041a4ce
test ax, ax
jne 0x418e3c
push 0x40acc0
call fcn.00418ba7
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
push dword [ebp - 0x18]
call sub.SHLWAPI.DLL_PathFileExistsW
test eax, eax
je 0x418dbd
push esi
push esi
push 9
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0041a4ce
test ax, ax
jne 0x418e3c
push 0x409e64
call fcn.00418ba7
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
push dword [ebp - 0x18]
call sub.SHLWAPI.DLL_PathFileExistsW
test eax, eax
je 0x418dbd
push 3
push 5
push 2
push 2
lea eax, [ebp - 0x18]
push eax
call fcn.0041a4ce
test ax, ax
jne 0x418e3c
mov edx, dword [0x4480b0]
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrCopy
push dword [ebp - 0x18]
call sub.SHLWAPI.DLL_PathFileExistsW
test eax, eax
je 0x418dbd
or dword [ebp - 0x14], 0xffffffff
jmp 0x418e3c
push 0xa
pop eax
mov ecx, 0x80020004
push 0x40a890
push dword [ebp - 0x18]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], eax
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40a8b4
call sub.MSVBVM60.DLL___vbaStrCat
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x30
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 8
call sub.MSVBVM60.DLL_rtcMsgBox
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaFreeStr
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 4
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x14
push 0x418e6f
jmp 0x418e66
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaFreeStr
ret
Function at 0x41e2ee
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401c28
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
push 9
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_MoveFileExW
test eax, eax
je 0x41e351
or dword [ebp - 0x18], 0xffffffff
jmp 0x41e3e7
call sub.KERNEL32.DLL_GetLastError
push eax
call fcn.00408930
mov edx, eax
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrMove
call sub.MSVBVM60.DLL___vbaSetSystemError
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
push eax
call sub.MSVBVM60.DLL___vbaStrToUnicode
mov edx, eax
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaStrCopy
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 2
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
push 0xa
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x80020004
push 0x30
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x64], 0x4008
call sub.MSVBVM60.DLL_rtcMsgBox
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
push 3
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x10
push 0x41e41d
jmp 0x41e414
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaFreeStr
ret

Function at 0x41eab2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401c68
push 0xd
pop ecx
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x58], esi
call sub.MSVBVM60.DLL___vbaObjSetAddref
push 2
pop eax
push esi
push 0xfffffdfd
push dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x58]
push eax
call sub.MSVBVM60.DLL___vbaLateIdCallLd
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push 0x102b
lea eax, [ebp - 0x58]
push eax
call sub.MSVBVM60.DLL___vbaI4Var
push eax
call sub.USER32.DLL_SendMessageW
lea ecx, [ebp - 0x58]
call sub.MSVBVM60.DLL___vbaFreeVar
push 0x41eb51
jmp 0x41eb48
lea ecx, [ebp - 0x14]
call sub.MSVBVM60.DLL___vbaFreeObj
ret
Function at 0x43f444
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x402e08
mov edx, dword [ebp + 8]
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x64], edi
call sub.MSVBVM60.DLL___vbaStrCopy
push 0x40e68c
mov esi, 0x40a884
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push dword [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40e708
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 2
pop ebx
push ebx
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x43f523
push dword [ebp - 0x18]
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40e760
jmp 0x43f586
test al, 1
je 0x43f553
push dword [ebp - 0x18]
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40e7ac
jmp 0x43f586
cmp word [0x44809c], di
jne 0x43f5a6
push dword [ebp - 0x18]
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push esi
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x40e804
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaStrMove
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.MSVBVM60.DLL___vbaFreeStrList
add esp, 0xc
push 0xa
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x80020004
push 0x30
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x64], 0x4008
call sub.MSVBVM60.DLL_rtcMsgBox
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
push 3
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x10
push 0x43f638
jmp 0x43f627
lea ecx, [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaFreeStr
lea ecx, [ebp - 0x1c]
call sub.MSVBVM60.DLL___vbaFreeStr
ret
Function at 0x446c2e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x403486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403290
mov eax, dword [ebp + 8]
push dword [eax]
and dword [ebp - 0x18], 0
and dword [ebp - 0x28], 0
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x446c75
and eax, 1
neg eax
mov dword [ebp - 0x18], eax
push 0x446c86
jmp 0x446c85
ret
Function at 0x40a3f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46abcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045f604
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a472
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045d487
mov eax, dword [eax]
push 0x5491d0
push eax
call fcn.0044fa84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045f88f
test bl, bl
je 0x40a472
push 0x5491d0
lea ecx, [esp + 0xc]
call fcn.0045fc1f
push 0x54cd30
lea ecx, [esp + 0xc]
call fcn.0045fc1f
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a4ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045f88f
jmp 0x40a579
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a532
lea edx, [esp + 0x7c]
push 0x54cd2c
push edx
call fcn.0044fa84
add esp, 8
test eax, eax
je 0x40a532
lea eax, [esp + 0x7c]
push 0x54cd28
push eax
call fcn.0044fa84
add esp, 8
test eax, eax
je 0x40a532
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a4c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045f88f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ad70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40add2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40ade0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46ac4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x555058]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40af18
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40ae46
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045f88f
xor eax, eax
jmp 0x40af8f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045f9cc
push esi
lea ecx, [esp + 0xc]
call fcn.0045fc5b
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40af6d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040ad70
test eax, eax
jne 0x40af6d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040ad70
test eax, eax
jne 0x40af6d
lea eax, [esp + 0x14]
push 0x54cd44
push eax
call fcn.00450ac0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40af4c
lea ecx, [esp + 0x14]
push 0x54cd40
push ecx
call fcn.00450a40
mov esi, eax
add esp, 8
test esi, esi
jne 0x40af4c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40af4f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045f97c
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40ae5e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045f88f
xor eax, eax
jmp 0x40af8f
mov byte [esi], 0
push 0x54cd3c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045f88f
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4