joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465f95
Capabilities:
Encode data using xor

Disassembly:
imul esi, dword [ebx + 0x37f83169], 0x8675a651
lahf
cmp dword [esi - 0x5d7c824d], edx
test eax, 0xb1f13277
outsd dx, dword [esi]
sahf
xor eax, 0x5286343f
add dword [edx], edx
aas
xchg byte [edx + 1], dl
adc bh, byte [edi]
xchg esi, eax
dec ecx
cmpsd dword [esi], dword es:[edi]
xor byte [esi], dl
sbb edi, esp
outsb dx, byte [esi]
invalid

Function at 0x46ad6e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sbb byte [ecx + 0x64], al
mov dword [edi - 0x80], ebp
sbb ebx, dword [ebp + 0x598bb82c]
packsswb mm7, mm7
fiadd dword [ecx - 0x285e1560]
xchg edi, eax
ficomp word [edi + 0x18ae0f7f]
js 0x46ad5f
inc edx
and esp, ecx
pop edx
lodsb al, byte [esi]
das
lds esi, [edx + 0x1ff3d7a]
pop esp
leave
cdq
add dword [ecx], edx
xchg ebx, eax
fidivr word [ebx + esi + 0x21]
invalid

Function at 0x46adab
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push esi
jb 0x46ad76
cdq
sub ax, 0x1882
inc ecx
mov dword fs:[edi - 0x80], ebp
lahf
jg 0x46ad88
scasb al, byte es:[edi]
sbb byte [eax - 0x1e], bh
add dword [ecx + ecx*8 - 0x67], ebx
cmp cl, byte [edx - 0x42ebcdb0]
imul esi, dword [0xb3cccb04], 7
sbb byte [ecx], dl
push esp
jle 0x46adf1
mov edi, 0x24b77d34
sub eax, 0xe44b87c1
jmp 0x46ad58
xor dword [edx - 0x31], ecx
cmp dword [esi + 0x1f], esp
jmp 0x256e9b38
Function at 0x475790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00475983
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004804d8
xor ebx, ebx
cmp eax, ebx
jne 0x47593e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00475983
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047d1b7
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4ceaac
add esp, 0x10
test eax, eax
jne 0x475859
push esi
call fcn.00472e42
mov esi, eax
cmp esi, ebx
pop ecx
je 0x475859
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x475844
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x475859
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x475852
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004819eb
cmp byte [esp + 0x13], bl
je 0x475889
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004759c0
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4758f9
push 0x14
call 0x4cdd19
cmp eax, ebx
pop ecx
je 0x4758b3
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4758b5
xor edi, edi
cmp edi, ebx
je 0x4758f9
push esi
push edi
call fcn.00474ee6
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00474fae
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004750d7
add esp, 0x18
call fcn.00475983
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047fba5
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x475910
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x475922
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x475965
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x475965
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00474fae
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004750d7
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fba5
Capabilities:
Encode data using xor

Disassembly:
invalid
inc cl
pop ecx
sti
pop eax
inc edx
popfd
lahf
outsd dx, dword [esi]
scasd eax, dword es:[edi]
or dword [edx], ecx
sar dword [esi + 0x75], cl
inc ebx
out dx, eax
loope 0x47fa6f
or dword [edi - 0x5a], 0x1168c6ee
insb byte es:[edi], dx
jbe 0x47fab6
out dx, al
invalid
ficom dword [edx - 0x16ae0434]
retf 0x4499
and bl, byte [edi]
push 0xffffffffffffffdf
in al, dx
cmp eax, 0xf4cf9712
lcall 0xacd3, 0x92769c16
ret
xchg edx, eax
shr dword [ebx + eax*8 - 0x30cbb1ba], cl
jne 0x47fa9f
in eax, 0xe5
insb byte es:[edi], dx
invalid
add al, 0x52
dec edx
inc eax
add byte [ebp + 0x4c], cl
xor byte [eax + 0x4c], al
nop
fisubr dword [ecx - 0x73]
invalid
cmp al, 0xbc
ror byte [ebx + edi*8], 0x6c
add dword [edi*4 - 0x4bf43fdd], ecx
jl 0x47fb43
xor dword [ebx], 0xa07976fd
xlatb
jg 0x47fafc
and byte [eax + edi*4], bh
sub dword [ecx - 0x64], esp
movsb byte es:[edi], byte [esi]
pop eax
jo 0x47fb0a
int 0x5b
int3
salc
invalid
cld
mov eax, dword [0x99689684]
jne 0x47fbc5
sub bh, bl
jns 0x47fc0b
jge 0x47fb41
mov dl, 0xab
stosd dword es:[edi], eax
les ebp, [ebp + edi + 0x6f3130b6]
pop es
mov esp, 0xa7146d20
sbb cl, al
stosd dword es:[edi], eax
pop eax
xchg ebp, eax
sub ebx, ebp
jnp 0x47fb26
invalid
adc dword [edi], edi
or ecx, edx
cmp eax, 0x9ef007b4
jecxz 0x47fb8d
and bh, bl
ror ah, cl
jecxz 0x47fb8d
popal
pop esp
lodsb al, byte [esi]
test eax, 0x7f5d855f
jo 0x47fb69
pop ebp
or al, 0xc7
cld
pop edi
xchg ecx, eax
and ebx, dword [eax - 0x13833356]
test dword [ebp - 0x17], eax
dec ebx
adc eax, 0xef36d456
mov byte [0x91b31ed9], al
cwde
insb byte es:[edi], dx
lea esi, [edx]
wait
and dh, byte [eax]
sub cl, byte [edi + ebp*8 - 0x1b5b34fe]
aad 0x4c
lodsd eax, dword [esi]
mov ch, 0x4f
fistp word [eax + 0xb5ff6df]
test byte [eax - 0x2b], 0xa6
aad 0xa6
imul eax, dword gs:[ebx + 0x40], 0xffffffe3
fdivr st(2)
push 0xa3bd10e0
aam 0xa3
xor byte [edi + ebx*2 + 0x3c], bh
cld
enter 0xffffffffffff85ad, 0x5d
cdq
jle 0x47fbe0
add esp, dword [edx]
invalid
Function at 0x48c830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048ca23
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00497578
xor ebx, ebx
cmp eax, ebx
jne 0x48c9de
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048ca23
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00494257
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e5b4c
add esp, 0x10
test eax, eax
jne 0x48c8f9
push esi
call fcn.00489ee2
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48c8f9
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48c8e4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48c8f9
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c8f2
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00498a8b
cmp byte [esp + 0x13], bl
je 0x48c929
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048ca60
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48c999
push 0x14
call 0x4e4db9
cmp eax, ebx
pop ecx
je 0x48c953
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48c955
xor edi, edi
cmp edi, ebx
je 0x48c999
push esi
push edi
call fcn.0048bf86
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048c04e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048c177
add esp, 0x18
call fcn.0048ca23
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00496c45
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c9b0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48c9c2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48ca05
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48ca05
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048c04e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048c177
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493e86
Capabilities:
Encode data using xor

Disassembly:
cwde
test byte [edi - 0x3d108213], ch
popfd
out dx, eax
or al, 0x8d
inc eax
sti
sbb cl, ch
cmp ecx, edx
sti
out 0xbf, eax
xor bl, cl
jb 0x493e97
mov ch, 0xaf
fst dword [eax + 0x1db9b70f]
pop ds
scasd eax, dword es:[edi]
inc esp
pop eax
pop esi
dec ecx
imul edx, dword [esi + 0x4de2b7b], 0x3188ae9d
shl ecx, cl
neg dword [edi - 0x188754f5]
js 0x493ed1
sbb cl, cl
sub eax, 0xc40a00e3
test eax, 0xc807c748
enter 0xffffffffffff8b1a, 0xffffffffffffffbb
mov byte [edx + 0xd0c4188], al
mov byte [ecx + 0xc], al
or eax, 0xa0c9d41e
stosd dword es:[edi], eax
mov word gs:[ebx + 0x61], es
push ds
aam 0xc9
mov al, byte [0x438c65ab]
popal
sub eax, 0x4934f7f3
fist word [ecx + 0x34]
aas
scasb al, byte es:[edi]
scasb al, byte es:[edi]
insd dword es:[edi], dx
pop ss
int 0x53
fbstp tbyte [ebx]
add edi, ecx
pop eax
xchg edi, eax
cmp al, 0xa
pop ecx
cmp edi, dword [eax - 0x6a]
mov dh, 0xf3
salc
cmp dword [eax + eax*4 + 0x73], ecx
daa
ror dword [ecx], cl
push cs
mov ecx, 0x15d81aff
jg 0x493f6b
dec ecx
push ds
push 0x75135f85
test eax, 0xbd9300b
sbb dword [ecx + ebx*2 - 0x4f], 0x4f
jns 0x493fc7
movsd dword es:[edi], dword [esi]
mov eax, 0xf4cb63db
fld xword [edi + ebp]
push edx
pop ebp
inc esp
scasd eax, dword es:[edi]
adc byte [edi + 0x54], dl
add dword [ebx + edi*4 - 0x7b9225ce], 0xe882e1d7
xchg edi, eax
ja 0x493f9e
call 0x7b4ab735
jnp 0x493ffe
pop edi
push edi
dec ecx
xchg ecx, eax
sub eax, 0x55066047
fld dword [edx - 0x5c]
aad 0xd9
sub dword [eax + eax*8 + 0x5533243f], esi
cmp eax, 0x9f30ae08
jle 0x493f8a
mov bl, 0x35
rcl byte [eax + 0x42], 0x6b
inc esp
sti
mov byte [0xc05030cb], al
mov ecx, 0x41902c33
push 0xc22ef54f
pop esp
in al, 0xc8
xor eax, ebp
movsb byte es:[di], byte [si]
loopne 0x493fac
int1
outsd dx, dword [esi]
mov al, 0xa2
loope 0x494039
aaa
jmp 0x493f99
and ch, byte [edx - 0x14d63acb]
inc edi
in eax, dx
fiadd dword [edx - 0x64]
mov edi, 0xd01e82b9
sbb byte [esi], 0xd0

Function at 0x494032
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
salc
push edi
imul edx, dword [ecx - 0x42], 0xffffff80
fidiv dword [eax - 0x544f6976]
push ds
das
rol byte [eax - 0x6c], cl
add edx, eax
sub ecx, ecx
dec edi
invalid
nop
Function at 0x496c45
Capabilities:
Encode data using xor

Disassembly:
xor bh, byte [eax]
into
invalid
inc eax
loopne 0x496c35
lds ecx, ds:[eax]
sbb esi, ebp
jg 0x496c1f
clc
cmp al, 0xd
mov al, 0x6f
ja 0x496c5c
out dx, al
cmp byte [eax], bh
add esp, dword [edi - 0x757b5917]
bnd jbe 0x496ccd
cmpsb byte [esi], byte es:[edi]
test byte [edx - 0x1694890e], cl
out 0xf8, eax
xchg dword [edx - 0x1a], ebp
adc esp, esi
fidivr word [edi + edx + 0xa]
insb byte es:[edi], dx
and dword [0xb94ab6f7], esp
cli
pop ds
neg byte [ebx]
ret
jmp 0x6ad1654e
insd dword es:[edi], dx
or eax, 0x529d253f
pop es
fild dword [ebp - 0x41417eaa]
sub esi, ebp
shr dword [ecx - 0x1a], cl
xchg esi, eax
int 0x23
adc dword [edi], esp
cmp dword [esi - 0x2c0ad442], 0xcd96e669
and edx, dword [ecx]
daa
sbb byte [ebx + 0x56], bh
jns 0x496cc3
mov dword [0x66fc348f], eax
add eax, dword [ebx + 0x70]
xchg dl, dl
xor byte [edi], bh
stc
sahf
sbb dword [eax], ecx
test dword [esi - 0x1875679d], edx
dec edi
imul esp, dword [edx + 0x48], 0xffffffb6
dec esp
pushfd
add ecx, ecx
mov ebx, 0xe6e050e4
invalid

Function at 0x4a04b9
Capabilities:
Encode data using xor

Disassembly:
dec edx
adc eax, 0x40f37f75
popfd
lea edx, [ebp - 0x787b082f]
xchg dword [ebp + 0x3a], edi
jge 0x4a0502
and al, 0xfb
pop esp
add al, 0x93
inc ebx
sbb dl, byte [eax]
push 0x33
xor byte [ebx - 2], 0x7a
pop ss
aad 0xb9
jp 0x4a04c5
invalid
adc al, 0xa9
invalid
Function at 0x4ad9d3
Capabilities:
Encode data using xor

Disassembly:
jno 0x4ad9a1
mov edx, 0x3c35aae1
add al, 0xd7
invalid
pop esi
daa
jb 0x4ad95f
dec eax
in al, 0xcf
rcl dword [esi - 0x19], 0xaa
xchg edi, eax
insd dword es:[edi], dx
mov ah, 0xac
mov edx, 0x11adaa14
jl 0x4ad9f9
cmpsb byte [esi], byte es:[edi]
dec edx
leave
push ecx
cli
pop es
cmp byte [edx], dh
xor cl, bh
push 0xfffffffffffffff4
cmp eax, 0xfecd1c2b
push ss
and al, 0x95
jecxz 0x4ad9d5
dec edi
test byte fs:[ecx], 0x75
mov eax, dword [0x4fa0e0d2]
aaa
xor al, 0xa1
cmpsd dword [esi], dword es:[edi]
stosb byte es:[edi], al
cli
jno 0x4ada71
inc ebp
or cl, dh
sysenter
xchg edx, eax
xchg esi, eax
push esi
add al, 0xd4
invalid
invalid
Function at 0x4080de
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x416177
call fcn.00414d14
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.004035e8
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi], vtable.ScObjects::Thread.0
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call fcn.00406dc4
cmp eax, ebx
pop ecx
je 0x408122
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x408124
xor eax, eax
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x407eba
push ebx
push ebx
call sub.MSVCR80.dll__beginthreadex
add esp, 0x18
cmp eax, 0xffffffff
jne 0x408154
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x408160
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 8]
mov dword [ecx + 4], eax
mov eax, esi
call fcn.00414db3
ret

Function at 0x40c8bb
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x420ae4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x40c8ff
call ebx
test eax, eax
jns 0x40c8f5
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x420ae0], eax
mov dword [0x420ae4], 1
mov eax, dword [0x420ae0]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x40c91b
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x40c94b
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x40c941
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x40c935
push dword [eax + 8]
call dword [eax]
jmp 0x40c93b
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x40c94a
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x40c9f3
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x420ad8], ebx
jne 0x40ca3f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push ebx
push 1
push ebx
push ebx
mov edi, 0x420ad8
push edi
call esi
test eax, eax
jne 0x40ca3d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x80090016
jne 0x40ca3c
push 8
push 1
push ebx
push ebx
push edi
call esi
test eax, eax
jne 0x40ca3c
call ebp
mov dword [0x420ad8], ebx
pop ebp
pop edi
pop esi
mov eax, dword [0x420ad8]
pop ebx
ret
Function at 0x40cb46
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x416feb
call fcn.00414d7d
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
call fcn.0040698d
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], 1
call fcn.0040c9f3
cmp eax, esi
jne 0x40cb87
push 0xffffffffffffffff
push 0x41ae24
mov ecx, edi
call fcn.004069fe
jmp 0x40cbcd
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
push 0xffffffffffffffff
mov ecx, edi
push 0x41ae24
je 0x40cb80
call fcn.004069fe
movzx eax, byte [ebp + esi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x41a3f0
push eax
call sub.MSVCR80.dll_sprintf
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00406b80
add esp, 0x14
inc esi
cmp esi, 0x10
jb 0x40cba6
mov eax, edi
call fcn.00414dc7
ret
Function at 0x40d490
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x5c
mov eax, 0x417106
call fcn.00414d7d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], ebx
call fcn.0040c9f3
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ebx
call fcn.0040698d
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0040698d
push dword [ebp - 0x3c]
mov eax, 0x41a544
push eax
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], esi
push eax
push dword [ebp - 0x3c]
push edi
call fcn.00406b53
pop ecx
pop ecx
push eax
call fcn.00406b80
pop ecx
pop ecx
push eax
call fcn.00406b53
pop ecx
pop ecx
push eax
call fcn.00406b80
pop ecx
pop ecx
push eax
call fcn.00406b53
cmp dword [ebp - 0x48], ebx
pop ecx
pop ecx
jne 0x40d526
push 0xffffffffffffffff
push 0x41ae24
mov ecx, edi
call fcn.004069fe
jmp 0x40d5f8
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40d513
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
push ebx
push ecx
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40d513
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push eax
push dword [ebp - 0x40]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], eax
call esi
test eax, eax
je 0x40d513
push dword [ebp - 0x44]
call fcn.00406dc4
cmp eax, ebx
pop ecx
mov dword [ebp - 0x3c], eax
jne 0x40d596
push 0xffffffffffffffff
push 0x41ae24
mov ecx, edi
call fcn.004069fe
jmp 0x40d5ea
push ebx
lea ecx, [ebp - 0x44]
push ecx
push eax
push 2
push dword [ebp - 0x40]
call esi
test eax, eax
push 0xffffffffffffffff
mov ecx, edi
push 0x41ae24
je 0x40d58f
call fcn.004069fe
xor esi, esi
cmp dword [ebp - 0x44], ebx
jbe 0x40d5ea
cmp esi, 0x28
jae 0x40d5ea
mov eax, dword [ebp - 0x3c]
movzx eax, byte [esi + eax]
push eax
lea eax, [ebp - 0x38]
push 0x41a3f0
push eax
call sub.MSVCR80.dll_sprintf
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.00406b80
add esp, 0x14
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x40d5bc
cmp dword [ebp - 0x3c], ebx
je 0x40d5f8
push dword [ebp - 0x3c]
call fcn.00406dc9
pop ecx
cmp dword [ebp - 0x40], ebx
je 0x40d606
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], bl
call fcn.004069c9
mov eax, edi
call fcn.00414dc7
ret
Function at 0x412a61
Capabilities:
Create mailslot

Disassembly:
push 0x14
mov eax, 0x417ff2
call fcn.00414d14
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [0x42090c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00412d91
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.WinInterAppStream.0
call fcn.0040698d
lea eax, [esi + 0x40]
push eax
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
call fcn.00406b53
pop ecx
pop ecx
push eax
call fcn.00406b53
push 0xc
lea edi, [esi + 0x56]
push ebx
push edi
call sub.MSVCR80.dll_memset
add esp, 0x14
mov eax, edi
xor ecx, ecx
call fcn.00412a50
test al, al
je 0x412ad6
cmp dword [esi + 0x5a], ebx
je 0x412ad6
mov ecx, edi
push ecx
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x52], eax
mov byte [ebp - 4], bl
call fcn.004069c9
mov eax, esi
call fcn.00414db3
ret 8

Function at 0x4148e9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4209d0]
jne 0x4148f3
repz ret
jmp fcn.00415024
Function at 0x48e6e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x403276
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x401540
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], eax
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov dword [ebp - 0x40], 0x80020004
mov dword [ebp - 0x48], 0xa
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcFreeFile]
mov esi, eax
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov ecx, dword [ebp - 0x34]
push ecx
push esi
push 0xffffffffffffffff
push 1
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFileOpen]
call edi
push esi
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaFileClose]
call ebx
mov edx, dword [ebp - 0x34]
push edx
push esi
push 0xffffffffffffffff
push 0x120
call edi
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
push esi
push 1
lea eax, [ebp - 0x24]
push eax
push 2
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaGet4]
call edi
cmp word [ebp - 0x24], 0x5a4d
push esi
je 0x48e7bd
call ebx
mov dword [ebp - 0x30], 0xffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x48e84c
jmp 0x48e842
push 0x3d
lea ecx, [ebp - 0x38]
push ecx
push 4
call edi
push esi
mov edx, dword [ebp - 0x38]
add edx, 1
jo 0x48e863
push edx
lea eax, [ebp - 0x2c]
push eax
push 4
call edi
cmp dword [ebp - 0x2c], 0x4550
push esi
je 0x48e7fd
call ebx
mov dword [ebp - 0x30], 0xffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x48e84c
jmp 0x48e842
mov ecx, dword [ebp - 0x38]
add ecx, 0x5d
jo 0x48e863
push ecx
lea edx, [ebp - 0x28]
push edx
push 2
call edi
push esi
call ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
call dword [sym.imp.MSVBVM60.DLL___vbaExitProc]
push 0x48e84c
jmp 0x48e842
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219