joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e7e
Capabilities:
Log keystrokes

Disassembly:
push 0x20
mov eax, 0x411ec5
call fcn.0041072e
mov esi, ecx
push str.Firstrun:_Rendering_initial_view.
lea ecx, [ebp - 0x28]
call fcn.004014c6
lea eax, [ebp - 0x28]
push eax
push 2
call sub.Mso20Win32Client.dll_Ordinal_1271
xor ebx, ebx
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.004027ef
cmp dword [esi + 0x154], ebx
jne 0x408ed2
mov ecx, esi
call fcn.0040904a
push 1
push dword [0x41c2a4]
call sub.Mso20Win32Client.dll_Ordinal_1115
jmp 0x408fdd
cmp byte [esi + 0x159], bl
je 0x408f44
mov byte [esi + 0x169], 1
cmp dword [esi + 0x16c], ebx
jne 0x408f34
push 0x354
call fcn.00401628
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x408f13
push dword [esi + 4]
lea ecx, [esi + 0x64]
push ecx
push dword [esi + 0x5c]
mov ecx, eax
call fcn.0040a39a
mov edi, eax
jmp 0x408f15
mov edi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x16c]
test ecx, ecx
je 0x408f2e
mov dword [esi + 0x16c], ebx
call fcn.0040b2ae
mov dword [esi + 0x16c], edi
mov ecx, dword [esi + 0x16c]
call fcn.0040b5bc
jmp 0x408fdd
cmp byte [esi + 0x15a], bl
je 0x408fd6
cmp dword [esi + 0x170], ebx
jne 0x408fa7
push 0x14
call fcn.00401628
pop ecx
mov ecx, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
test ecx, ecx
je 0x408f86
push dword [esi + 0x58]
lea eax, [esi + 0x64]
push dword [esi + 4]
push eax
push dword [esi + 0x5c]
call fcn.0040c1b5
mov edi, eax
jmp 0x408f88
mov edi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x170]
test ecx, ecx
je 0x408fa1
mov dword [esi + 0x170], ebx
call fcn.0040c66f
mov dword [esi + 0x170], edi
cmp byte [esi + 0x15b], 0
mov ecx, dword [esi + 0x170]
jne 0x408fcf
mov byte [esi + 0x169], 1
call fcn.0040cd30
mov ecx, dword [esi + 0x170]
call fcn.0040ce45
jmp 0x408fdd
call fcn.0040cece
jmp 0x408fdd
mov ecx, esi
call fcn.004090cc
mov eax, dword [esi + 0x5c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x409044
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
call ebx
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
mov ecx, dword [ebp - 0x2c]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x3c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x2c]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x3c]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
call ebx
push eax
call edi
push eax
call esi
call fcn.004106e0
ret

Function at 0x409569
Capabilities:
Log keystrokes

Disassembly:
mov byte [ecx + 0x169], 0
mov byte [ecx + 0x15a], 0
jmp fcn.00408e7e
Function at 0x40d701
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x41cf04], 0
je 0x40d719
mov eax, dword [0x41cf08]
jmp 0x40d7e9
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d768
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x41cf08
push esi
push esi
push dword [0x41c3f8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d768
cmp dword [ebp - 8], 4
je 0x40d7c2
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x40d779
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d7ca
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x41cf08
push esi
push esi
push dword [0x41c3f8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d7ca
cmp dword [ebp - 8], 4
jne 0x40d7ca
mov esi, dword [0x41cf08]
jmp 0x40d7d0
mov dword [0x41cf08], esi
cmp dword [ebp - 4], 0
mov byte [0x41cf04], 1
je 0x40d7e6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d7ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.CLSID
push Ordinal_1
mov dword [ebp - 8], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40d87f
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40d875
push 4
pop edi
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x417758
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d875
cmp dword [ebp + 8], edi
jne 0x40d875
mov edi, dword [ebp - 0xc]
cmp edi, 3
ja 0x40d875
cmp dword [ebp - 4], ebx
je 0x40d881
push dword [ebp - 4]
call esi
jmp 0x40d881
cmp dword [ebp - 4], ebx
je 0x40d87f
push dword [ebp - 4]
call esi
mov edi, ebx
cmp dword [ebp - 8], ebx
je 0x40d88b
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e4d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x417fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push eax
push 0
push 2
push esi
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40e542
cmp dword [ebp - 0x210], 4
jb 0x40e542
test edi, edi
lea eax, [ebp - 0x20c]
cmovne esi, edi
push esi
push eax
call fcn.0040e5fc
jmp 0x40e544
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00410158
mov esp, ebp
pop ebp
ret 8

Function at 0x40e556
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x417fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push eax
push 0
push 2
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40e5e9
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x40e5e9
shr ecx, 1
push 0xffffffffffffffff
cmp word [ebp + ecx*2 - 0x210], 0x5c
sete al
lea eax, [eax*2 + str.Microsoft_SharedOffice16_]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040e5fc
jmp 0x40e5eb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00410158
mov esp, ebp
pop ebp
ret 4

Function at 0x40f128
Capabilities:
Enumerate process modules

Disassembly:
push 0x3a0
mov eax, 0x41248e
call fcn.0041072e
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.004061e7
xor eax, eax
mov dword [ebp - 0x39c], 0x1000
mov esi, 0x400
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x3a8]
call fcn.0040f32c
mov ecx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x39c]
mov edi, dword [ebp - 0x3a4]
sub edi, ecx
push eax
sar edi, 2
mov eax, edi
shl eax, 2
push eax
push ecx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x40f1e3
mov esi, dword [ebp - 0x39c]
shr esi, 2
cmp edi, esi
jb 0x40f167
test esi, esi
je 0x40f1d0
mov edi, dword [ebp - 0x3a8]
dec esi
mov ecx, ebx
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x3ac], eax
lea eax, [ebp - 0x3ac]
push eax
push dword [ebx]
call fcn.0040f0d3
test esi, esi
jne 0x40f1b2
lea ecx, [ebp - 0x3a8]
call fcn.0040f308
call fcn.004106e0
ret 4
push str.::EnumProcesses___failed_to_enumerate_the_list_of_process_current_running
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x398]
call fcn.0040ef76
push 0x4192fc
lea eax, [ebp - 0x398]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x40fbe4
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x417fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x214], 1
call sub.VCRUNTIME140.dll_memset
mov edx, 0x41cf9c
mov dword [ebp - 0x210], esi
add esp, 0xc
mov eax, edx
xor ecx, ecx
cmp dword [eax], 0
je 0x40fc45
add eax, 0x14
inc ecx
cmp eax, 0x41cfc4
jl 0x40fc30
jmp 0x40fd9c
imul esi, ecx, 0x14
add esi, edx
je 0x40fd9c
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fd80
cmp dword [ebp - 0x214], 1
jne 0x40fd80
cmp word [ebp - 0x20c], ax
je 0x40fd80
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x40fd80
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x40fcc7
add eax, eax
cmp eax, 0x208
jae 0x40fdaf
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x40fccd
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.00410145
mov dword [esi], eax
test eax, eax
je 0x40fd80
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._GetPerfhostHookVersion_0
push eax
call edi
test eax, eax
jne 0x40fcfa
mov eax, dword [ebp + 0x10]
jmp 0x40fcfc
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x40fd20
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_12
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_4
jmp 0x40fd54
cmp eax, 2
jne 0x40fd35
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_8
jmp 0x40fd12
cmp eax, 3
jne 0x40fd5e
push str._InitPerf_v3_4
push dword [esi]
call edi
push str._PerfCodeMarker_v3_8
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_v3_4
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x40fd80
cmp dword [esi + 0x10], 0
je 0x40fd80
cmp dword [esi + 0xc], 0
je 0x40fd80
push dword [0x41d014]
push esi
call fcn.0040fbab
test eax, eax
jns 0x40fd9c
cmp dword [esi], 0
je 0x40fd8d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410158
mov esp, ebp
pop ebp
ret 0xc
call fcn.00410916
int3
Function at 0x410165
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x417fcc], eax
je 0x410187
cmp dword [0x417fcc], ebx
jne 0x41021b
push edi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edi, dword [ebp - 8]
xor edi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor edi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x417fcc
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
test edi, edi
push eax
push dword [ebp - 4]
cmovne ebx, edi
mov edi, 0x417fcc
push 4
push edi
mov dword [0x417fcc], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push edi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x417fcc]
not eax
mov dword [0x41c4e0], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410456
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41a570
call fcn.00410c49
push 1
call fcn.004104d9
pop ecx
test al, al
jne 0x4102ff
push 7
call fcn.00410d92
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004104a4
mov byte [ebp - 0x24], al
mov eax, dword [0x41d028]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4102f8
test eax, eax
jne 0x410369
mov dword [0x41d028], ecx
push 0x4132f4
push 0x4132dc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41034c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x410450
push 0x4132d8
push 0x4132b8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41d028], 2
jmp 0x41036e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00410636
pop ecx
call fcn.00410d86
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41039e
push esi
call fcn.004105a9
pop ecx
test al, al
je 0x41039e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00410fc1
call esi
call fcn.00410d8c
mov esi, eax
cmp dword [esi], edi
je 0x4103bc
push esi
call fcn.004105a9
pop ecx
test al, al
je 0x4103bc
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00410ea7
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00410eda
test al, al
jne 0x4103f5
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4103fe
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00410653
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x410450
call fcn.00410c8f
ret
call fcn.00410165
jmp 0x4102e0
Function at 0x404870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.___Encrypt_ra_file
push 3
mov esi, edx
mov dword [ebp - 0x24], 0
mov edi, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00408d60
add esp, 8
test edi, edi
je 0x404a6b
test esi, esi
je 0x404a6b
mov edx, dword [ebp + 8]
test edx, edx
je 0x404a6b
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00404460
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x10
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x404924
push str.Cannot_encrypt_data
push 1
call fcn.00408d60
add esp, 8
jmp 0x404a4c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403ec0
add esp, 0xc
test eax, eax
jne 0x404953
push str.Cannot_encrypt_key
push 1
call fcn.00408d60
add esp, 8
jmp 0x404a3c
push 0
push 0
push 2
push 0
push 1
push 0x2000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40498b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_creating_encrypted_file:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x404a39
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4049ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_writing_key_len:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x404a32
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4049e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_writing_key:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x404a32
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404a18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_writing_data:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x404a32
push edi
push dword [ebp - 8]
push str.Wrote__d_bytes_of_data_to__s
push 3
call fcn.00408d60
add esp, 0x10
mov dword [ebp - 0x24], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404a4c
push eax
call ebx
dec dword [0x4de7b4]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404a5c
push eax
call ebx
dec dword [0x4de7b4]
test esi, esi
je 0x404a7a
push esi
call ebx
dec dword [0x4de7b4]
jmp 0x404a7a
push str.Invalid_params
push 1
call fcn.00408d60
add esp, 8
push str.Encrypt_ra_file___
push 3
call fcn.00408d60
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
Function at 0x405350
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edx
push eax
push 0
push 1
mov ebx, ecx
mov dword [ebp - 8], 0
push 0
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4053b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_initializing_string_decoding:0x_X
push 1
call fcn.00408d60
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
push eax
push 0
push 0
call dword [0x4db46c]
add esp, 0xc
mov edi, eax
push 0
push 0
push 0
call dword [0x4db46c]
mov esi, eax
add esp, 0xc
mov eax, dword [edi + 4]
test eax, eax
jne 0x4053f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_allocate_buffer:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x40545d
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push 1
push 0
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x405422
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_decoding_string:0x_X
push 1
call fcn.00408d60
add esp, 0xc
jmp 0x40545d
push 0
push esi
push edi
call dword [0x4db460]
mov eax, dword [esi + 8]
add esp, 0xc
test eax, eax
je 0x40545d
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 0xc]
inc dword [0x4de7b4]
mov dword [ecx], eax
mov ecx, dword [esi + 8]
push ecx
push dword [esi + 4]
inc ecx
push ecx
push eax
call fcn.004b33e3
add esp, 0x10
push 1
push edi
call dword [0x4dbca0]
add esp, 8
test esi, esi
je 0x405479
push 1
push esi
call dword [0x4dbca0]
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
Function at 0x408d60
Capabilities:
Check for time delay via gettickcount
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4dc0c0], 0
push esi
push edi
je 0x408ee0
push 0x4df120
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4dbcac]
shr esi, 1
je 0x408ed5
lea eax, [ebp + 0x10]
xor edi, edi
push eax
push edi
push dword [ebp + 0xc]
dec esi
push esi
push 0x4dc0c8
call fcn.00401000
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004b2fd2
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x408de1
cmp eax, esi
ja 0x408de1
jne 0x408df0
jmp 0x408de6
mov edi, 0x8007007a
xor eax, eax
mov word [esi*2 + 0x4dc0c8], ax
test edi, edi
js 0x408ed5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4dd330]
cmp eax, 0x2710
jbe 0x408e2c
lea eax, [ebp - 8]
push eax
push dword [0x4dd334]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x408e2c
cmp eax, 0xa
jbe 0x408e2c
call fcn.00408c40
call esi
mov dword [0x4dd330], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
xor edx, edx
push 0x4dc0c8
push dword [ebp + 8]
mov ecx, 0x7d0
push esi
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
div ecx
push edx
push str._02d_02d_02d__02d_02d_02d__03d__d__d__s__r
push dword [0x4dc0c4]
push 0x4dd338
call fcn.004010a0
add esp, 0x34
test eax, eax
js 0x408ed5
mov eax, dword [0x4dc0c4]
mov ecx, 0x4dd338
shr eax, 1
mov edx, eax
je 0x408eb4
cmp word [ecx], 0
je 0x408eb8
add ecx, 2
sub eax, 1
jne 0x408ea6
test eax, eax
je 0x408ed5
sub edx, eax
lea ecx, [ebp - 0xc]
push 0
push ecx
lea eax, [edx + edx]
push eax
push 0x4dd338
push dword [0x4dd334]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4df120
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
Function at 0x40a5d0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], 1
push esi
push str.___Setting_debug_values__d
push 3
mov edi, edx
mov dword [ebp - 0xc], 0
call fcn.00408d60
add esp, 0xc
test esi, esi
je 0x40a6e0
test edi, edi
jne 0x40a624
push str.NULL_debug_folder
push 1
call fcn.00408d60
add esp, 8
jmp 0x40a704
lea eax, [ebp - 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumpskb4svc.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x40a66d
cmp eax, 2
jne 0x40a6d8
lea eax, [ebp - 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumpskb4svc.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40a66d
push eax
push str.Error_creating_key:0x_X
push 1
call fcn.00408d60
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
lea eax, [ebp - 8]
push 4
push eax
push 4
push str.DumpType
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumpskb4svc.exe
push 0x80000002
call esi
test eax, eax
je 0x40a6a0
push eax
push str.Error_setting_dump_type:0x_X
push 1
call fcn.00408d60
add esp, 0xc
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a6a5
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push str.DumpFolder
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumpskb4svc.exe
push 0x80000002
call esi
test eax, eax
je 0x40a704
push eax
push str.Error_setting_dump_type:0x_X
jmp 0x40a6fa
push eax
push str.Error_opening_key:0x_X
jmp 0x40a6fa
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumpskb4svc.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x40a704
push eax
push str.Error_deleting_key:0x_X
push 1
call fcn.00408d60
add esp, 0xc
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40a712
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Setting_debug_values___
push 3
call fcn.00408d60
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret