joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a8e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x20]
xor edx, edx
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
mov edi, dword [0x100ad2bc]
lea eax, [edi + edi*2]
movzx edi, word [ecx + edi*2]
movzx esi, word [ecx + eax*2 + 0x4a]
mov eax, dword [ebx]
mov dword [esp + 0x18], edi
mov eax, dword [ebx + eax*8]
div esi
movzx eax, byte [0x100ad2c9]
mov esi, 0x50d
inc word [ecx]
mov ebp, edx
mov dword [esp + 0x2c], eax
movzx eax, word [ecx]
mov dword [esp + 0x10], ebp
add si, word [ebx + eax*8]
mov eax, dword [0x100ad2f0]
xor eax, 0xb26
movzx edx, si
mov dword [esp + 0x1c], eax
movzx eax, word [ecx + 0x1678]
mov dword [esp + 0x14], eax
cmp ebp, 0x178
jg 0x1001aa57
lea eax, [ebp*4 + 0x7c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0x14f2
nop dword [eax]
movzx eax, word [ecx]
mov edx, 0xd23
lea esi, [ecx + eax*2]
mov ecx, dword [esp + 0x2c]
lea eax, [edi + edi*2]
add edi, edi
sub edx, dword [ecx + eax*4]
mov eax, 0x60606061
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
xor word [esi], ax
lea esi, [ebx + edi*8]
mov edx, dword [0x100ad2f8]
mov eax, dword [0x100ad2bc]
inc edx
mov edi, dword [esp + 0x1c]
mov dword [0x100ad2f8], edx
mov eax, dword [edi + eax*8 + 0x64]
mov edi, ecx
mov ecx, dword [esp + 0x10]
add eax, dword [edi + ecx*8]
imul eax, edx
xor edx, edx
mov ecx, dword [esp + 0x18]
div dword [esi]
xor edx, edx
mov dword [esi], eax
mov eax, dword [0x100ad300]
movzx edi, word [ebp + ebp + 0x972]
imul edi, dword [ecx + eax]
add ecx, 4
mov eax, dword [0x100ad2e8]
div dword [0x100ad304]
movzx eax, word [0x100ad2d0]
mov dword [0x100ad304], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
lea esi, [edx + eax*4]
mov eax, dword [esp + 0x20]
xor eax, dword [0x100ad2c0]
cdq
idiv dword [esp + 0x24]
mov eax, edx
cdq
idiv dword [esi]
mov dword [esi], eax
mov esi, dword [esp + 0x10]
movzx eax, word [0x100ad2d0]
xor eax, esi
inc esi
cdq
idiv dword [0x100ad2f0]
mov eax, dword [esp + 0x14]
sub edx, eax
mov dword [esp + 0x10], esi
dec eax
or ebp, edx
cmp ecx, 0x65c
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
jle 0x1001a970
mov dword [esp + 0x18], edi
mov esi, dword [0x100ad304]
mov al, byte [0x100ad2c9]
inc esi
inc al
mov dword [0x100ad304], esi
mov byte [0x100ad2c9], al
movzx eax, al
movzx edx, word [ecx + esi*4]
and edx, esi
mov dword [ebx + eax*4], edx
movzx eax, byte [0x100ad2c9]
inc dword [0x100ad304]
mov edx, dword [esp + 0x2c]
movzx esi, word [ecx + eax*8]
lea edi, [edx + eax*4]
mov eax, dword [0x100ad2c0]
add eax, dword [0x100ad2bc]
xor eax, ebp
imul esi, eax
or dword [edi], esi
mov edx, dword [ebx]
mov eax, dword [0x100ad2ec]
mov edi, dword [esp + 0x18]
lea esi, [eax + edx*4]
mov eax, dword [0x100ad2fc]
xor edx, edx
div dword [ebx + edi*8]
pop edi
xor dword [esi], edx
inc dword [0x100ad2fc]
movzx eax, word [ecx]
pop esi
pop ebp
pop ebx
movzx eax, word [eax + eax + 0x972]
add esp, 0x18
ret
Function at 0x1001ab50
Capabilities:
Resume thread

Disassembly:
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add edx, 0xfffff110
xor dword [esp + 4], 0x8cb
xor ecx, 0x16bd
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
add ebp, 0xffffebaf
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
lea ebx, [edi - 0x1624]
xor edi, 0x96a
lea eax, [ebx + 0x1451]
cmp ebp, eax
je 0x1001ac29
mov eax, ecx
xor eax, 0x24b4
cmp edi, eax
je 0x1001abd9
cmp dword [esi + 0x6c], 0xe08
jae 0x1001abcb
mov eax, dword [0x100a3aec]
sub eax, dword [esi + 0xc4]
or dword [esi + 0x80], eax
jmp 0x1001abd3
mov eax, dword [0x100a3ae0]
mov dword [esi + 0x44], eax
xor edi, 0x3e7
mov eax, ebx
xor eax, 0x295e
cmp edi, eax
jge 0x1001abf4
mov eax, dword [esi + 0x58]
add eax, 0x4c908
xor dword [0x100a3b08], eax
jmp 0x1001ac29
mov eax, dword [esi + 0x24]
sub eax, dword [esi + 0x94]
xor eax, 0x1b81
cmp edx, eax
je 0x1001ac29
mov eax, dword [0x1008a74c]
mov ecx, dword [esi + 0xd0]
and ecx, edi
imul ecx, dword [eax + 0xd8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, 0xfffffe9f
cmp ebp, eax
je 0x1001ac7c
push dword [0x1008a74c]
lea eax, [edx + 0x6e5]
push eax
lea eax, [ebx + 0x18eb]
push eax
lea eax, [ecx + 0x2676]
push eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffe8d
push eax
lea eax, [ebx + 0x295e]
push eax
lea eax, [edi + 0xe2]
push eax
call fcn.10007aa0
add esp, 0x1c
lea eax, [ebp + 0x2676]
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x94]
or ebx, 0x1ca9
push ebx
mov eax, ecx
sub eax, ebp
push eax
mov eax, dword [esi + 0xc]
imul eax, edx
and eax, ecx
push eax
mov eax, dword [esi + 0x24]
add eax, dword [esi + 0x14]
push esi
push eax
call fcn.100096c0
add esp, 0x14
lea eax, [ebp + 0x728]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10020ff5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10021004
pop dword [ebp - 0x48]
mov eax, 0xe03588e3
sub eax, 0xd03378df
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x20018b21
add dword [ebp - 0x58], 0x2e50ba2a
mov dword [ebp - 0x54], 0xeba2d1b2
sub dword [ebp - 0x54], 0xb96f856d
mov dword [ebp - 0x50], 0x45c58511
add dword [ebp - 0x50], 0x686bf1d
mov dword [ebp - 0x4c], 0x96ec167d
sub dword [ebp - 0x4c], 0x96ec167d
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe7b8c47
add dword [ebp - 0x58], 0x65f6dd0f
mov dword [ebp - 0x54], 0x2d7cfcc6
add dword [ebp - 0x54], 0x13ef64af
mov dword [ebp - 0x50], 0x58864f4d
add dword [ebp - 0x50], 0xae91d1f
mov dword [ebp - 0x4c], 0x4be3c3f2
add dword [ebp - 0x4c], 0xb41c3c0e
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x3e0a0275
sub eax, 0x2e07e235
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37d1a
push 0
call eax
mov ecx, 0xb40b5ef2
sub ecx, 0xb40b181a
mov edx, eax
mov ebx, 0xb782989
add ebx, 0x48af277
add ebx, dword [ebp - 0x48]
mov esi, 0xa1d1fe86
add esi, 0xa780d1c7
sub dword [ebp - 0x3c], 0x1b47492c
mov edi, dword [ebx]
sub dword [ebp - 0x20], esi
sub edi, esi
xor dword [ebp - 0x40], 0x25a7be3f
mov dword [edx], edi
sub dword [ebp - 0x20], edi
add edx, 4
add ebx, 0x3a196810
sub ebx, 0x3a19680c
loop 0x10021121
add eax, 0xd5fe8c20
add eax, 0x2a028213
mov ebx, eax
add eax, 5
mov ecx, 0xc0bf64eb
add ecx, 0x4f409b15
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10005510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000551f
pop dword [ebp - 0x20]
mov eax, 0x569546d1
add eax, 0xb96b0e4e
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x2fe2a0ab
sub dword [ebp - 0x30], 0xe1905b60
mov dword [ebp - 0x2c], 0x544edcf2
add dword [ebp - 0x2c], 0xdde46f53
mov dword [ebp - 0x28], 0xd39ae45e
sub dword [ebp - 0x28], 0x874ea030
mov dword [ebp - 0x24], 0x6d597416
sub dword [ebp - 0x24], 0x6d597416
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x80a4e8d0
sub dword [ebp - 0x30], 0xc327f7a
mov dword [ebp - 0x2c], 0xf28d8d86
add dword [ebp - 0x2c], 0x4eded3ef
mov dword [ebp - 0x28], 0xbcda5862
sub dword [ebp - 0x28], 0x596aebf6
mov dword [ebp - 0x24], 0x93f1d9c5
sub dword [ebp - 0x24], 0x93f1d9c5
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d153
push 0
call eax
mov ecx, 0x6d5a9dd3
sub ecx, 0x6d5a4473
mov edi, eax
mov ebx, 0xede0cad0
add ebx, 0x22216d30
add ebx, dword [ebp - 0x20]
mov esi, 0x503d6fea
xor dword [ebp - 0x1c], 0xab8fc330
mov edx, dword [ebx]
xor dword [ebp - 4], esi
sub edx, esi
sub dword [ebp - 0x18], 0x44c97907
mov dword [edi], edx
add dword [ebp - 4], 0x711becb0
add edi, 4
add ebx, 4
loop 0x10005631
add eax, 0x15853
xor ebx, ebx
add ebx, eax
add eax, 0x3af0f1b5
sub eax, 0x3af0f1b0
mov ecx, 0xb80071ba
sub ecx, 0xa80071ba
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x414265
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x414274
pop dword [ebp - 0x44]
mov eax, 0x414274
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3e883
push 0
mov eax, 0x98552434
sub eax, 0x98133224
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x804b9bd9
add ecx, 0x7fb4adf4
mov edi, eax
mov ebx, 0x72ecf7a0
add ebx, 0x8d568a60
add ebx, dword [ebp - 0x44]
mov esi, 0x164d99fb
sub esi, 0xce95f0f6
mov edx, dword [ebx]
sub dword [ebp - 0x38], esi
xor edx, esi
mov dword [edi], edx
mov dword [ebp - 0xc], 0x8ab500ad
add edi, 0xbba7ac55
sub edi, 0xbba7ac51
add ebx, 0xe5c0302e
add ebx, 0x1a3fcfd6
loop 0x4142ce
add eax, 0x11a07
mov ebx, eax
add eax, 5
mov ecx, 0xada3fcab
add ecx, 0x529c0355
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100135d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100135e2
pop dword [ebp - 0x30]
mov eax, 0x100135e2
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7323d209
sub dword [ebp - 0x40], 0x24d18cbe
mov dword [ebp - 0x3c], 0xdd2e0b37
sub dword [ebp - 0x3c], 0xaafabef2
mov dword [ebp - 0x38], 0xad270318
sub dword [ebp - 0x38], 0x60dabeea
mov dword [ebp - 0x34], 0x19ba9389
sub dword [ebp - 0x34], 0x19ba9389
lea eax, [ebp - 0x40]
push eax
mov eax, 0x970bb2f7
sub eax, 0x8709d277
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb835b143
add dword [ebp - 0x40], 0xbc3cb813
mov dword [ebp - 0x3c], 0xb4873f1d
add dword [ebp - 0x3c], 0x8ce52258
mov dword [ebp - 0x38], 0x9ac481c4
add dword [ebp - 0x38], 0xc8aaeaa8
mov dword [ebp - 0x34], 0xc33cdfd
sub dword [ebp - 0x34], 0xc33cdfd
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x40876
push 0
call eax
mov ecx, 0x550a
xor edi, edi
add edi, eax
mov ebx, 0x10035800
add ebx, dword [ebp - 0x30]
mov esi, 0x875c3b3d
sub esi, 0x6f84f33a
add dword [ebp - 8], 0x569a32fb
mov edx, dword [ebx]
add dword [ebp - 0x1c], esi
xor edx, esi
xor dword [ebp - 0x20], edx
mov dword [edi], edx
add dword [ebp - 0x10], 0x2ff6de0c
add edi, 0xc611d9eb
sub edi, 0xc611d9e7
add ebx, 0x42db284a
add ebx, 0xbd24d7ba
loop 0x100136f0
add eax, 0xfbeb94b5
add eax, 0x415b246
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x37f86a88
sub ecx, 0x27f86a88
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10011f7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10011f8d
pop dword [ebp - 0x40]
mov eax, 0x59fb1a2e
sub eax, 0x49f9faa1
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x45a84
push 0
mov eax, 0x77591c7c
add eax, 0x98aa04dc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x99d9b4ae
add ecx, 0x6626a3a4
xor esi, esi
add esi, eax
mov edi, 0xfbe50578
add edi, 0x141f7a88
add edi, dword [ebp - 0x40]
mov ebx, 0xa6350e60
add ebx, 0xddd30870
mov edx, dword [edi]
add dword [ebp - 4], ecx
sub edx, ebx
xor dword [ebp - 0x2c], edi
mov dword [esi], edx
sub dword [ebp - 0x2c], esi
add esi, 4
add edi, 0x64ed2a90
add edi, 0x9b12d574
loop 0x10011fee
add eax, 0xa15cf4ab
sub eax, 0xa15ba090
mov ebx, eax
add eax, 0x4032ba3c
sub eax, 0x4032ba37
mov ecx, 0x22d4c32f
add ecx, 0xed2b3cd1
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100194d5
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xea0
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x100194fb
mov eax, 0x80070057
jmp 0x1001970d
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x484]
xor ebx, ebx
push str.SoftwareMicrosoftOffice_i.0Registration
push 0x100
push eax
mov dword [esi], ebx
mov dword [ebp - 0xe9c], ebx
call fcn.10011f7e
add esp, 0x10
test eax, eax
je 0x100196fd
lea eax, [ebp - 0xe9c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x484]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100196fd
push 0x40
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push dword [ebp - 0xe9c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x103
je 0x100196fd
test edi, edi
jne 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x484]
mov edi, 0x100
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.10011f7e
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.10011f7e
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.10011f7e
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe98], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0x284]
mov dword [ebp - 0xe94], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10019655
lea eax, [ebp - 0xea0]
mov dword [ebp - 0xea0], 0x802
push eax
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0xe98]
push eax
push ebx
push 0x1003b278
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0xe94], ebx
je 0x10019669
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100196ce
cmp dword [ebp - 0xe98], 1
je 0x1001967f
cmp dword [ebp - 0xe98], 2
jne 0x100196ce
cmp dword [ebp - 0xe98], 2
jne 0x100196d2
push 0x104
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100196d2
push 0xffffffffffffffff
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push 0x401
push eax
call fcn.10011f7e
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x1001970a
lea eax, [ebp - 0xe90]
push str._no_more_entries_
push eax
call fcn.10011f7e
pop ecx
pop ecx
test eax, eax
je 0x1001970a
xor eax, eax
cmp ax, word [ebp - 0xe90]
je 0x1001970a
lea eax, [ebp - 0xe90]
push eax
jmp 0x10019702
push str._no_more_entries_
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c65c
leave
ret 0x10
Function at 0x438c89
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
inc edx
call fcn.00438cc1
mov ebx, ebx
add ebx, 0xc192d93a
xor dword [eax], edi
mov edx, ebx
or edx, edx
inc eax
add edx, 0x36e2d0c3
mov edx, 0xf061871a
cmp eax, ecx
jne fcn.00438c89
or ebx, edx
add ebx, 1
and edx, ebx
ret
Function at 0x476089
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x478f10
call fcn.004767c8
push 1
call fcn.0047632c
pop ecx
test al, al
jne 0x475f32
push 7
call fcn.00476593
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004762f7
mov byte [ebp - 0x24], al
mov eax, dword [0x49dd84]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x475f2b
test eax, eax
jne 0x475f9c
mov dword [0x49dd84], ecx
push 0x4783d8
push 0x4783c8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x475f7f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x476083
push 0x4783c4
push 0x4783bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49dd84], 2
jmp 0x475fa1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00476489
pop ecx
call fcn.00476587
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x475fd1
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fd1
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004767c2
call esi
call fcn.0047658d
mov esi, eax
cmp dword [esi], edi
je 0x475fef
push esi
call fcn.004763fc
pop ecx
test al, al
je 0x475fef
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004766a8
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004766db
test al, al
jne 0x476028
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x476031
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004764a6
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x476083
call fcn.0047680e
ret
call fcn.00475da3
jmp 0x475f13

Function at 0x401dc0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e30
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401350
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x40477d
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
mov eax, dword [0x42d068]
xor eax, esp
mov dword [esp + 0xd8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [esp + 8], eax
xor ebx, ebx
push edi
xor eax, eax
mov dword [esp + 0xac], ebx
push 0x208
mov dword [esp + 0xb4], 7
mov word [esp + 0xa0], ax
call fcn.004085dc
mov esi, eax
mov dword [esp], 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push esi
call fcn.0040978c
pop ecx
pop ecx
test eax, eax
jne 0x4047f3
mov edi, ebx
jmp 0x4047ff
add eax, 2
push eax
call fcn.0040dce1
pop ecx
mov edi, eax
push esi
call fcn.004085e5
pop ecx
push edi
lea ecx, [esp + 0xa0]
call fcn.00404999
lea ecx, [esp + 0x84]
call fcn.00404318
push ecx
lea edx, [esp + 0x88]
lea ecx, [esp + 0xd0]
call fcn.0040592d
pop ecx
lea ecx, [esp + 0x9c]
push ecx
mov ecx, eax
call fcn.0040554f
push eax
lea ecx, [esp + 0xb8]
call fcn.00406cbc
lea ecx, [esp + 0xcc]
call fcn.00406fd4
push 0x44
pop esi
push esi
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.0040a3d0
xor eax, eax
mov dword [esp + 0x2c], esi
lea edi, [esp + 0x1c]
mov dword [esp + 0x88], ebx
stosd dword es:[edi], eax
lea ecx, [esp + 0x78]
add esp, 0xc
mov dword [esp + 0x80], 7
stosd dword es:[edi], eax
push 0x429a08
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ax, word [ebp + 0x14]
xor edi, edi
mov word [esp + 0x54], ax
inc edi
xor eax, eax
mov dword [esp + 0x50], edi
mov word [esp + 0x70], ax
call fcn.00404999
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x70]
call fcn.0040554f
push 2
push 0x429a0c
lea ecx, [esp + 0x74]
call fcn.0040567a
push dword [esp + 0xc]
lea ecx, [esp + 0x70]
call fcn.004049c0
cmp dword [esp + 0x80], 8
lea eax, [esp + 0x6c]
cmovae eax, dword [esp + 0x6c]
push eax
call fcn.0040dce1
cmp dword [esp + 0x9c], 8
mov esi, eax
pop ecx
lea ecx, [esp + 0x84]
cmovae ecx, dword [esp + 0x84]
push ecx
call fcn.0040dce1
pop ecx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push ebx
push edi
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40493a
or ebx, 0xffffffff
jmp 0x404953
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push 0x1388
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea ecx, [esp + 0x6c]
call fcn.00406fd4
lea ecx, [esp + 0xb4]
call fcn.00406fd4
lea ecx, [esp + 0x84]
call fcn.00406fd4
lea ecx, [esp + 0x9c]
call fcn.00406fd4
mov ecx, dword [esp + 0xe4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004081d2
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1206a768
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1211a8b6
call fcn.120820e8
sub esp, 0x218
mov eax, dword [section..cdata]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], esi
call fcn.120f7704
cmp eax, esi
jne 0x1206a811
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x1206a7c8
lea eax, [ebp - 0x210]
push eax
call fcn.1206a768
cmp eax, esi
jne 0x1206a810
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x1206a7b8
call fcn.12068a93
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.12068a93
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.12082031
leave
ret 4