joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ee25
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x41ee3e
mov eax, dword [ebp - 4]
jmp 0x41ef18
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x41eef3
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48cd38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x48cd38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48cd38]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x48cd38]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48cd38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x48cd38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x48cd38]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x48cd38]
dec ebp
jne 0x41ee5d
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x41ef0f
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x48cd38]
dec ecx
jne 0x41eefd
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4241a2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
jbe 0x42429c
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 8], 1
sub dword [ebp - 8], ecx
mov dword [ebp - 0xc], 2
sub dword [ebp - 0xc], ecx
push esi
mov esi, dword [ebp + 0x10]
jmp 0x4241da
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
add edi, ecx
movzx ecx, byte [edi]
shr ecx, 2
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
mov cl, byte [edi]
and cl, 3
add edx, edi
shl cl, 4
cmp edx, dword [ebp + 0xc]
jae 0x424271
mov ebx, dword [ebp - 4]
mov edx, dword [ebp + 8]
lea edx, [ebx + edx + 1]
mov bl, byte [edx]
shr bl, 4
add bl, cl
movzx ecx, bl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov cl, byte [edx]
mov edx, dword [ebp - 0xc]
and cl, 0xf
add edx, edi
shl cl, 2
cmp edx, dword [ebp + 0xc]
jae 0x42425d
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov dl, byte [edx + edi + 2]
mov bl, dl
and bl, 0x3f
shr dl, 6
add dl, cl
movzx ecx, dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, bl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
jmp 0x424285
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
mov byte [eax + esi + 3], 0x3d
jmp 0x424285
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov edi, dword [ebp - 4]
add edi, 3
add eax, 4
mov dword [ebp - 4], edi
cmp edi, dword [ebp + 0xc]
jb 0x4241d7
pop esi
pop ebx
pop edi
leave
ret
Function at 0x42429f
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub esp, 0xc
cmp byte [ecx + eax - 1], 0x3d
jne 0x4242bd
dec eax
cmp byte [ecx + eax - 1], 0x3d
je 0x4242b2
mov dword [ebp + 0xc], eax
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
jbe 0x42436f
push ebx
mov dword [ebp - 8], 2
sub dword [ebp - 8], ecx
mov dword [ebp - 0xc], 3
sub dword [ebp - 0xc], ecx
push edi
mov edi, dword [ebp + 0x10]
movsx eax, byte [ecx + 1]
movsx edx, byte [ecx]
mov al, byte [eax + 0x48df98]
mov dl, byte [edx + 0x48df98]
shl dl, 2
mov bl, al
sar bl, 4
and bl, 3
or dl, bl
mov byte [esi + edi], dl
mov edx, dword [ebp - 8]
add edx, ecx
inc esi
cmp edx, dword [ebp + 0xc]
jae 0x42435a
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
movsx edx, byte [edx + ebx + 2]
mov dl, byte [edx + 0x48df98]
mov bl, dl
sar bl, 2
shl al, 4
and bl, 0xf
or bl, al
mov eax, dword [ebp - 0xc]
mov byte [esi + edi], bl
add eax, ecx
inc esi
cmp eax, dword [ebp + 0xc]
jae 0x42435a
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
movsx eax, byte [eax + ebx + 3]
mov al, byte [eax + 0x48df98]
and al, 0x3f
shl dl, 6
or al, dl
mov byte [esi + edi], al
inc esi
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
add ecx, 4
cmp eax, dword [ebp + 0xc]
jb 0x4242e4
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret

Function at 0x42488d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4248f6
cmp dword [ebp + 0x10], 1
je 0x4248ce
cmp dword [ebp + 0x10], 2
je 0x4248ce
push 0xd
pop eax
jmp 0x4248f6
mov eax, dword [ebp - 4]
test edi, edi
je 0x4248f0
test eax, eax
je 0x4248eb
test al, 1
jne 0x4248c9
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4248f0
jmp 0x4248c9
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x4249e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4bfcf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.0042483e
mov ebx, eax
cmp ebx, esi
je 0x424a55
lea ecx, [ebp - 0x214]
call fcn.00424823
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466576
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x424a73
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.004249e4
cmp eax, esi
jne 0x424aba
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call ebx
test eax, eax
je 0x424a5d
lea ecx, [ebp - 0x214]
call fcn.00424823
push dword [ebp - 0x218]
mov ecx, edi
call fcn.004247b3
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00424823
mov eax, esi
jmp 0x424a44

Function at 0x4256d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
cmp eax, ecx
je 0x425760
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push dword [ebp + 8]
push eax
call esi
cmp dword [ebp - 8], 1
je 0x425712
cmp dword [ebp - 8], 2
jne 0x42575f
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.00417a47
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
call fcn.00417bf0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call esi
test eax, eax
jne 0x42575e
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov word [ebx + eax*2], cx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
call fcn.00424e98
mov dword [ebp - 0xc], 1
pop ebx
pop esi
mov eax, dword [ebp - 0xc]
pop edi
leave
ret 8
Function at 0x426ff2
Capabilities:
Persist via run registry key

Disassembly:
push esi
push edi
call fcn.004252e2
call fcn.00424c97
mov edi, str.wpslive
push edi
push dword [0x4bd7d4]
mov esi, SysReAllocString
push esi
call fcn.0043d7b6
push edi
push dword [0x4bd830]
push esi
call fcn.0043d822
push esi
call fcn.00424c09
push esi
call fcn.00424e10
add esp, 0x20
xor eax, eax
pop edi
inc eax
pop esi
ret
push 0x48f54c
push str.DblClk_ToggleHeaderFooterView
push dword [0x4bd818]
push SysReAllocString
call fcn.0043d6c9
add esp, 0x10
call fcn.0042587b
call fcn.00425290
xor eax, eax
inc eax
ret
cmp dword [0x4bd848], 0
jne 0x42614a
call fcn.0042600c
jmp 0x4254d5
cmp dword [0x4bd844], 0
jne 0x426e87
push esi
mov esi, SysReAllocString
push esi
call fcn.0042695c
push esi
call fcn.004250e6
pop ecx
pop ecx
pop esi
xor eax, eax
inc eax
ret
push SysReAllocString
call fcn.00426a63
pop ecx
jmp 0x425933
push 4
mov eax, 0x48781d
call fcn.00468a6e
push str.office6_addonsqingqingbangong.dll
push dword [0x4c1a34]
lea eax, [ebp - 0x10]
push eax
call fcn.0042bc31
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [0x4bd844], 0
jne 0x426f31
push dword [ebp - 0x10]
mov esi, SysReAllocString
push str.LibPath
push dword [0x4bd828]
push esi
call fcn.0043d6c9
add esp, 0x10
call fcn.00426df9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00417891
xor eax, eax
inc eax
call fcn.00468b46
ret
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
sub ecx, 0x65
je 0x42701a
dec ecx
je 0x427014
dec ecx
je 0x42700e
dec ecx
jne 0x427020
pop ebp
jmp 0x426ee0
pop ebp
jmp 0x42613c
pop ebp
jmp 0x426ed0
pop ebp
jmp 0x426e69
pop ebp
ret
Function at 0x427054
Capabilities:
Check if file exists

Disassembly:
push 0x228
mov eax, 0x48463b
call fcn.00468ad7
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push edi
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.00466c70
add esp, 0xc
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office
mov esi, 0x104
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], esi
call fcn.0042483e
test eax, eax
jne 0x4270f0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push str.LocationRoot
lea ecx, [ebp - 0x230]
call fcn.0042488d
lea ecx, [ebp - 0x230]
call fcn.00424823
push str.office6
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0046b5ac
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42713c
mov esi, ebx
lea ecx, [ebp - 0x230]
call fcn.00424823
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00417891
mov eax, esi
lea esp, [ebp - 0x244]
call fcn.00468b5a
ret
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00418067
mov esi, str.univf.dll
push esi
mov byte [ebp - 4], 2
call fcn.00468f76
pop ecx
push eax
push esi
lea ecx, [ebp - 0x220]
call fcn.00417d0b
push 8
push edi
push dword [ebp - 0x220]
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x234], eax
cmp eax, edi
je 0x4271f9
push str.kuniverify
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], ebx
jle 0x4271b2
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.0041796d
mov eax, dword [ebp + 8]
mov ebx, eax
cmp eax, edi
je 0x4271c7
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4271cb
xor eax, eax
jmp 0x4271e1
lea esi, [eax + eax]
mov eax, esi
call fcn.0046b580
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.0042412e
cmp dword [ebp - 0x224], edi
je 0x4271f9
push eax
call dword [ebp - 0x224]
movzx eax, al
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00417891
mov esi, dword [ebp - 0x21c]
jmp 0x427118

Function at 0x42723e
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x42724e
xor eax, eax
inc eax
jmp 0x427282
mov eax, dword [ebp + 8]
push esi
push dword [eax]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x42727f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x427278
xor eax, eax
mov dword [edi], esi
inc eax
jmp 0x427281
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop edi
pop ebp
ret 4
Function at 0x427b4f
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xec
mov eax, 0x48470f
call fcn.00468ad7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xa4], eax
cmp dword [ebx + 0x10], esi
je 0x427cf7
cmp dword [ebx + 0x14], 8
jb 0x427b88
mov eax, dword [ebx]
jmp 0x427b8a
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427cf7
mov edi, 0x48faac
push edi
lea ecx, [ebp - 0x80]
call fcn.00424491
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], esi
call fcn.0042796c
push edi
push eax
xor ebx, ebx
lea eax, [ebp - 0x64]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.00427991
add esp, 0x18
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041f501
push esi
push ebx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0041f501
push 0x48fd94
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.004279bc
push dword [ebp - 0xa0]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0042796c
add esp, 0x18
push esi
push ebx
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 7
call fcn.0041f501
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 0x38]
inc eax
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call fcn.00427781
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x427c4d
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
sar eax, 1
push eax
push dword [ebp - 0x20]
call fcn.0046b6da
xor eax, eax
mov dword [ebp - 0xb4], esi
lea edi, [ebp - 0xb0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0xf4]
push esi
push eax
mov dword [ebp - 0xf8], 0x44
call fcn.00466c70
mov eax, dword [ebp - 0xa4]
add esp, 0x18
cmp dword [eax + 0x10], esi
jne 0x427c9b
xor eax, eax
jmp 0x427ca3
cmp dword [eax + 0x14], 8
jb 0x427ca3
mov eax, dword [eax]
lea ecx, [ebp - 0xb4]
push ecx
lea ecx, [ebp - 0xf8]
push ecx
push eax
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x427cd1
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xb4]
lea ecx, [ebp - 0x20]
call fcn.00447f98
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.0041f501
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0041f501
mov eax, edi
jmp 0x427cf9
xor eax, eax
call fcn.00468b5a
ret
Function at 0x427cff
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push 0x250
mov eax, 0x484758
call fcn.00468ad7
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
push 0x48fd40
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x258], edi
call fcn.00424491
push 0xffffffffffffffff
push edi
push ebx
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], edi
call fcn.004273e7
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00466c70
add esp, 0xc
mov dword [ebp - 0x254], edi
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 1
jae 0x427d7b
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x254]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x427e21
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x48fd98
push dword [ebp - 0x254]
mov dword [ebp - 0x258], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x25c], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp dword [ebp - 0x25c], edi
jle 0x427e21
push dword [ebx]
lea ecx, [ebp - 0x250]
call fcn.00424491
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x250]
push eax
mov ecx, esi
call fcn.004200ea
push edi
push 1
lea ecx, [ebp - 0x250]
call fcn.0041f501
jmp 0x427e30
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
cmp dword [ebp - 0x254], edi
je 0x427e4d
cmp dword [ebp - 0x254], 0xffffffff
je 0x427e4d
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x234]
call fcn.0041f501
mov eax, esi
call fcn.00468b5a
ret

Function at 0x427e63
Capabilities:
Delete file

Disassembly:
push 0x24
mov eax, 0x484788
call fcn.00468ad7
mov eax, dword [ebp + 8]
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
and dword [ebp - 4], ecx
lea esi, [eax + 0x1c]
lea ecx, [ebp - 0x2c]
push ecx
add eax, 0x54
push eax
push esi
call fcn.00427b4f
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x2c]
mov edi, eax
call fcn.0041f501
test edi, edi
je 0x427edd
cmp edi, 0xffffffff
je 0x427edd
and dword [ebp - 0x30], 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esi + 0x14], 8
jb 0x427ed1
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x30]
jmp 0x427ef4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
shl esi, 0x10
or esi, 5
test edi, edi
je 0x427efb
cmp edi, 0xffffffff
je 0x427efb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.00468b5a
ret
Function at 0x427f03
Capabilities:
Delete registry value

Disassembly:
push 0x40
mov eax, 0x4847b5
call fcn.00468ad7
mov esi, dword [ebp + 8]
sub esp, 0x1c
mov ebx, ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push dword [ebx]
call fcn.00427853
lea eax, [ebp - 0x48]
push eax
call fcn.00427a7f
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x427f3b
mov eax, dword [eax]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push esi
call fcn.00427853
lea eax, [ebp - 0x2c]
push eax
call fcn.00427a7f
add esp, 0x20
cmp dword [eax + 0x14], 8
jb 0x427f5e
mov eax, dword [eax]
push eax
call fcn.00468eeb
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov edi, eax
call fcn.0041f501
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0041f501
test edi, edi
jne 0x427f98
cmp dword [esi + 0x14], 8
jb 0x427f8c
mov esi, dword [esi]
mov eax, dword [ebx + 4]
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.00468b5a
ret 4

Function at 0x428339
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x23c
mov eax, 0x484848
call fcn.00468ad7
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], ebx
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
xor eax, eax
inc eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x238]
push eax
push 0x20019
push esi
push str.SoftwareKingsoftOfficewpscloudsvr_refs
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428449
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], 0x104
call fcn.00466c70
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
jmp 0x42843d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00424491
lea eax, [ebp - 0x234]
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00428299
push esi
push 1
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.0041f501
inc dword [ebp - 0x23c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x240], 0x104
push dword [ebp - 0x238]
call edi
test eax, eax
je 0x4283df
cmp dword [ebp - 0x238], esi
je 0x428466
cmp dword [ebp - 0x238], 0xffffffff
je 0x428466
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.00468b5a
ret
Function at 0x42846e
Capabilities:
Check if file exists
Delete registry value

Disassembly:
push 0x18
mov eax, 0x484880
call fcn.00468a6e
lea eax, [ebp - 0x24]
xor edi, edi
push eax
mov dword [ebp - 0x10], edi
call fcn.00428339
pop ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], edi
test eax, eax
jne 0x4284b7
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00428306
jmp 0x428551
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push edi
push str.SoftwareKingsoftOfficewpscloudsvr_refs
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428527
mov esi, dword [ebp - 0x24]
jmp 0x428522
cmp dword [esi + 0x14], 8
jb 0x4284eb
mov eax, dword [esi]
jmp 0x4284ed
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42851f
cmp dword [esi + 0x14], 8
jb 0x428502
mov eax, dword [esi]
jmp 0x428504
mov eax, esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
call fcn.004280f0
mov esi, dword [eax]
jmp 0x428522
add esi, 0x1c
cmp esi, dword [ebp - 0x20]
jne 0x4284e1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00428306
cmp dword [ebp - 0x10], edi
je 0x428551
cmp dword [ebp - 0x10], 0xffffffff
je 0x428551
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
call fcn.00428053
mov eax, esi
call fcn.00468b46
ret

Function at 0x4286ae
Capabilities:
Delete file

Disassembly:
push 0x5c
mov eax, 0x48490b
call fcn.00468ad7
mov esi, dword [ebp + 8]
lea edi, [esi + 0x1c]
push edi
call fcn.00428620
push edi
call fcn.00428561
pop ecx
pop ecx
test al, al
je 0x4286de
push esi
call fcn.00427e63
pop ecx
jmp 0x428793
push str.wpscloudsvr
lea ecx, [ebp - 0x2c]
call fcn.00424491
and dword [ebp - 4], 0
sub esp, 0x1c
mov eax, esp
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x68], esp
push ecx
push eax
call fcn.00427cff
pop ecx
pop ecx
lea eax, [ebp - 0x64]
push eax
call fcn.00427a7f
add esp, 0x20
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x42871b
mov eax, dword [eax]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x68], esp
push edi
call fcn.00427853
lea eax, [ebp - 0x48]
push eax
call fcn.00427a7f
add esp, 0x20
cmp dword [eax + 0x14], 8
jb 0x42873e
mov eax, dword [eax]
push eax
call fcn.00468eeb
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.0041f501
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.0041f501
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041f501
test esi, esi
je 0x428791
cmp dword [edi + 0x14], 8
jb 0x428778
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x428791
call dword [sym.imp.KERNEL32.dll_GetLastError]
shl eax, 0x10
or eax, 5
jmp 0x428793
xor eax, eax
call fcn.00468b5a
ret