joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47300a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x472f8f
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.00402d5c
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x472fe6
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.0041acb8
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x472fe6
lea edx, [ebp - 4]
mov eax, dword [0x489a4c]
call fcn.004064c0
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00472e2c
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473011
lea eax, [ebp - 4]
call fcn.00404434
ret

Function at 0x4874cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048e4
mov edi, 0x48aed8
xor eax, eax
push ebp
push 0x4875ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48af08]
call fcn.004046f4
mov dword [0x48ad24], eax
mov eax, dword [ebp - 4]
call fcn.004046f4
mov dword [0x48ad28], eax
push 0x1f4
mov eax, 0x48ad2c
mov ecx, 1
mov edx, dword [0x486d1c]
call fcn.0040577c
add esp, 4
mov dword [edi], 1
mov eax, dword [0x48ad2c]
mov edx, dword [edi]
mov ecx, dword [edi]
mov dword [eax + edx*4], ecx
inc dword [edi]
cmp dword [edi], 0x165
jne 0x487539
call fcn.004870b4
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov dword [0x48ad30], eax
mov eax, esi
call fcn.00404434
mov ebx, dword [0x48ad28]
test ebx, ebx
jle 0x4875d3
mov dword [0x48ad38], 1
call fcn.00487034
mov eax, dword [0x48ad2c]
mov edx, dword [edi]
mov eax, dword [eax + edx*4]
mov edx, dword [0x48ad2c]
mov ecx, dword [0x48ad30]
add eax, dword [edx + ecx*4]
mov ecx, 0x164
cdq
idiv ecx
mov eax, dword [0x48ad2c]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 4]
mov ecx, dword [0x48ad38]
movzx eax, byte [eax + ecx - 1]
xor edx, eax
lea eax, [ebp - 8]
call fcn.0040461c
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004046fc
inc dword [0x48ad38]
dec ebx
jne 0x48757a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4875f5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
ret
Function at 0x487600
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, 0x48aee8
mov edi, 0x48aed0
mov ebp, 0x48adb0
call fcn.004873d4
call fcn.00487438
movzx ebx, word [ebp + 6]
dec ebx
test ebx, ebx
jb 0x487647
inc ebx
mov dword [0x48aed8], 0
call fcn.004873ec
call fcn.0048746c
inc dword [0x48aed8]
dec ebx
jne 0x487634
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x48ad64], eax
mov eax, sub.kernel32.dll_LoadLibraryA
mov dword [0x48af10], eax
mov eax, sub.kernel32.dll_GetProcAddress_1
mov dword [0x48af0c], eax
mov eax, dword [0x48ad6c]
add eax, dword [ebp + 0x80]
mov dword [edi], eax
jmp 0x48769d
add ebx, dword [0x48ad6c]
push ebx
call dword [0x48af10]
mov dword [0x48aedc], eax
call fcn.004871f4
add dword [edi], 0x14
mov eax, dword [edi]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x487683
mov eax, dword [0x48ad6c]
add eax, dword [ebp + 0xa0]
mov dword [0x48aee4], eax
mov eax, dword [0x48aee4]
mov dword [esi], eax
jmp 0x4876fb
call fcn.00486d8c
sub eax, 8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
fdiv dword [0x487718]
call fcn.00402de8
mov dword [0x48aeec], eax
mov eax, dword [esi]
add eax, 8
mov dword [0x48aef0], eax
call fcn.00486db4
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, dword [esi]
mov dword [esi], eax
mov eax, dword [esi]
sub eax, dword [0x48aee4]
cmp eax, dword [ebp + 0xa4]
jb 0x4876bf
call fcn.00486d98
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x430000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x40107e
Capabilities:
Delete file
Manipulate console buffer
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.0040dcd0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
xor ebx, ebx
cmp dword [0x449674], 0x594
push edi
mov dword [ebp - 0x14], ecx
jne 0x4010b6
push ebx
lea eax, [ebp - 0x840]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x43a338]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43a33c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.00401077
mov eax, dword [0x43a340]
add dword [ebp - 0xc], 0x23f
mov dword [ebp - 0x34], eax
mov eax, dword [0x43a344]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x20
jmp 0x4010f4
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x14]
shl eax, 4
cmp dword [0x449674], 0xc
mov dword [ebp - 4], eax
jne 0x40114f
push ebx
lea eax, [ebp - 0x840]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push ebx
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosw word es:[edi], ax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x1040]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov eax, dword [ebp - 0x34]
add dword [ebp - 4], eax
mov eax, dword [0x449674]
cmp eax, 0xfa9
jne 0x40116b
mov dword [0x449670], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401191
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4495c8], ebx
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea eax, [edi + edx]
shr edx, cl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [0x44966c], 0xf4ea3dee
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add edi, esi
shr esi, cl
mov dword [ebp - 0x1c], edi
add esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x449674], 0xb03
jne 0x401208
push str.yacey_jutesepage_vomebawaridamuzixobonawodewagim
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
xor dword [ebp - 4], esi
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
add dword [ebp - 0xc], 0x61c88647
dec dword [ebp - 0x20]
jne 0x4010f1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x40144c
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x432471
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
cmp dword [0x449674], 0x400
push edi
jne 0x40150d
push 0xf
pop esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x44], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401be0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401920
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004015d0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.0040192a
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401700
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401aa0
fstp st(0)
or dword [esp + 0x44], 0xffffffff
add esp, 8
cmp dword [esp + 0x2c], 0x10
jb 0x401501
push dword [esp + 0x18]
call fcn.00401950
pop ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
call esi
cmp edi, 0x206d51
jg 0x40152a
inc edi
cmp edi, 0x4eed4
jl 0x401515
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp esi, 0x2b2589
jg 0x401544
inc esi
cmp esi, 0x118b1
jl 0x40152c
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
cmp esi, 0x2afdec
jle 0x401564
cmp dword [esp + 0x10], 0x787c7e45
jne 0x40156d
inc esi
cmp esi, 0x42f7
jl 0x401546
mov eax, dword [0x43cc8c]
mov dword [0x449674], eax
call fcn.00401244
mov esi, 0x3078f
cmp dword [0x449674], 0x51f
jne 0x401596
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
dec esi
jne 0x401581
mov ecx, dword [esp + 0x34]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403400
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4391c8]
jne 0x40340a
repz ret
jmp fcn.00407fee
Function at 0x407c1b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040490b
and dword [ebp - 4], 0
cmp dword [0x43e62c], 0
mov ebx, eax
jne 0x407ccc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407d7d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407d7d
push eax
call fcn.00404899
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e62c], eax
call esi
push eax
call fcn.00404899
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e630], eax
call esi
push eax
call fcn.00404899
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43e634], eax
call esi
push eax
call fcn.00404899
pop ecx
mov dword [0x43e63c], eax
test eax, eax
je 0x407ccc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404899
pop ecx
mov dword [0x43e638], eax
mov eax, dword [0x43e638]
cmp eax, ebx
je 0x407d24
cmp dword [0x43e63c], ebx
je 0x407d24
push eax
call fcn.00404914
push dword [0x43e63c]
mov esi, eax
call fcn.00404914
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407d24
test edi, edi
je 0x407d24
call esi
test eax, eax
je 0x407d1b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407d1b
test byte [ebp - 0xc], 1
jne 0x407d24
or dword [ebp + 0x10], 0x200000
jmp 0x407d5d
mov eax, dword [0x43e630]
cmp eax, ebx
je 0x407d5d
push eax
call fcn.00404914
pop ecx
test eax, eax
je 0x407d5d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407d5d
mov eax, dword [0x43e634]
cmp eax, ebx
je 0x407d5d
push eax
call fcn.00404914
pop ecx
test eax, eax
je 0x407d5d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e62c]
call fcn.00404914
pop ecx
test eax, eax
je 0x407d7d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407d7f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401620
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x4016a5
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call sub.msys_2.0.dll_strrchr
test eax, eax
je 0x401690
lea ebp, [eax + 1]
mov ecx, ebp
sub ecx, ebx
cmp ecx, 6
jle 0x401690
lea esi, [eax - 6]
mov ecx, 7
mov edi, str._.libs_
repe cmpsb byte [esi], byte es:[edi]
seta cl
mov esi, ecx
setb cl
mov edx, esi
cmp dl, cl
jne 0x401690
mov ecx, 3
mov edi, 0x40b9e0
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
mov ebx, ebp
seta dl
setb cl
cmp dl, cl
jne 0x401690
lea ebx, [eax + 4]
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_short_name]
mov dword [eax], ebx
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_name]
mov dword [0x40f028], ebx
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msys_2.0.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x37
mov dword [esp + 4], 1
mov dword [esp], str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
mov dword [esp + 0xc], eax
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x405970
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0
call sub.msys_2.0.dll_nl_langinfo
test eax, eax
mov ebp, eax
je 0x405af0
mov edi, str.US_ASCII
mov ecx, 9
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x405a10
mov ebx, dword [0x40f190]
test ebx, ebx
jne 0x4059c8
jmp 0x405a80
movzx esi, byte [ebx]
jmp 0x4244b0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x405a25
cmp byte [eax], 0
jne 0x405a94
mov dword [esp], str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x405a3a
cmp byte [eax], 0
jne 0x405a94
mov dword [esp], str.LANG
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x405a4f
cmp byte [eax], 0
jne 0x405a94
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esp + 4], str.CP_u
mov dword [esp + 8], eax
mov ebp, 0x40f180
mov dword [esp], 0x40f180
call sub.msys_2.0.dll_sprintf
mov ebx, dword [0x40f190]
test ebx, ebx
jne 0x4059c8
mov dword [0x40f190], str.CP936
mov ebx, str.CP936
jmp 0x4059c8
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x405a4f
lea ebp, [eax + 1]
mov dword [esp + 4], 0x40
mov dword [esp], ebp
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x405afa
sub eax, ebp
cmp eax, 0xc
mov ebx, eax
ja 0x405a4f
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], 0x40f180
call sub.msys_2.0.dll_memcpy
mov byte [ebx + 0x40f180], 0
mov eax, 0x40f180
jmp 0x405a05
mov ebp, 0x40c388
jmp 0x40599d
mov eax, ebp
jmp 0x405a05
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x40894b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
and eax, eax
call fcn.0040897e
inc ebx
or eax, eax
xor dword [esi], edi
sub eax, 0x80d47269
add eax, ebx
add esi, 1
cmp esi, ecx
jne fcn.0040894b
sub ebx, 0xfdb3cced
mov eax, 0x4b2607b6
ret
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4068ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4068c6
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4068c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40691d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4068ff
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x1610034d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2fdd0111
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219