joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33c3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x33c62c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0033b850
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x33c5bc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x33c5b2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0032abc0
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x33c5dd
inc eax
cmp byte [esi + eax], 0
jne 0x33c5d6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0033b7d0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x33c5fa
inc edi
cmp byte [edi + ebx], 0
jne 0x33c5f3
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x33c60a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x33c602
test esi, esi
je 0x33c61f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0033b820
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4026d0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x510f44]
test al, 1
jne 0x402788
or eax, 1
mov dword [0x510f44], eax
mov dword [0x510f30], 0
mov dword [0x510f34], 0
mov dword [0x510f38], 0
mov dword [0x510f3c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.enableetw
push eax
call fcn.0048ea2e
add esp, 8
test eax, eax
setne byte [0x510f40]
test eax, eax
je 0x40277b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x510f30], eax
test eax, eax
je 0x40277b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EventRegister
push eax
call esi
push str.EventWrite
push dword [0x510f30]
mov dword [0x510f34], eax
call esi
push str.EventUnregister
push dword [0x510f30]
mov dword [0x510f3c], eax
call esi
mov dword [0x510f38], eax
pop esi
push 0x4d2390
call fcn.0048d42f
add esp, 4
mov eax, 0x510f30
ret
Function at 0x4044c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c66a8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x50c3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00405c90
push 0x4d69bc
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00403080
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x404513
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x14]
test eax, eax
sete bl
cmp edx, 8
jb 0x404555
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40454b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4045bb
push edx
push ecx
call fcn.0048d1e5
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x40459f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404595
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4045bb
push edx
push ecx
call fcn.0048d1e5
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret
call fcn.00498b39
int3

Function at 0x404870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4048c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4048c9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4048ba
cmp esi, edx
jae 0x4048c9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4048a8
cmp esi, edx
jae 0x4048c9
cmp word [esi], 0
je 0x4048c9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4069a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6a48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x50c3e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x406ac6
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], 0
je 0x406ac6
cmp dword [eax + 0x14], 8
jb 0x4069e9
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x14]
call fcn.004034c0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x406a01
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x10]
call fcn.004034c0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0x2001f
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406a74
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406a5e
cmp dword [ebp - 0x1c], 4
mov ecx, 0xd
cmovne eax, ecx
mov esi, dword [ebp + 0x14]
test eax, eax
cmove esi, dword [ebp - 0x20]
test edi, edi
je 0x406a77
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406a77
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406a94
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x406ab3
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407250
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6b18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x50c3e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x407366
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], 0
je 0x407366
cmp dword [eax + 0x14], 8
jb 0x407299
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x14]
call fcn.004034c0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x4072b1
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x10]
call fcn.004034c0
lea eax, [ebp - 0x1c]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x407315
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test esi, esi
je 0x407317
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407317
xor bl, bl
mov edx, dword [ebp - 0x10]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407334
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x407353
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413770
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x50c3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4137d8
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x234], 0x103
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0x22c
push 0
push eax
call fcn.0048f8b0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x41381a
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x230]
xor bl, bl
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41384d
mov edi, edi
cmp dword [ebp - 0x228], edi
je 0x41384b
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x413830
jmp 0x41384d
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0048d444
mov esp, ebp
pop ebp
ret
Function at 0x41c870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp + 0xc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x41c8a1
cmp esi, 0xffffffff
je 0x41c8a1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 8

Function at 0x41c8e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x50c3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41c9be
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareKingsoftwpscloudperfinfoc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41c9be
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x41c97d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub ecx, 0xd53e8000
push 0
push 0x2710
sbb eax, 0x19db1de
push eax
push ecx
call fcn.0048d490
jmp 0x41c981
xor eax, eax
xor edx, edx
push 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0xb
push 0
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0048d444
mov esp, ebp
pop ebp
ret 8
Function at 0x41cf40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8958
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x50c3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x48], 0
push eax
push 0x4d55b4
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.004025c0
push 0x13
xor eax, eax
mov dword [ebp - 4], 0
push str.HardwareAccelerated
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.004025c0
push 0x35
xor eax, eax
mov byte [ebp - 4], 1
push str.SoftwarekingsoftOffice6.0wppApplication_Settings
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004025c0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push 0x80000001
push eax
call fcn.00406ae0
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 8
jb 0x41d039
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d02f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d18a
push edx
push ecx
call fcn.0048d1e5
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x41d087
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d07d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d18a
push edx
push ecx
call fcn.0048d1e5
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x41d0d5
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d0cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d18a
push edx
push ecx
call fcn.0048d1e5
add esp, 8
mov ebx, dword [ebp - 0x5c]
lea esi, [ebp - 0x70]
mov edi, dword [ebp - 0x70]
cmp ebx, 8
cmovae esi, edi
cmp dword [ebp - 0x60], 0x10
jne 0x41d10c
mov ecx, str.AccelerationNone
mov edx, 0x10
sub esi, ecx
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x41d10c
add ecx, 2
sub edx, 1
jne 0x41d0f6
mov byte [ebp - 0x71], dl
jmp 0x41d13b
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0
push eax
push 0
push 0
push 0x41d1a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x70]
mov byte [ebp - 0x71], 1
cmp ebx, 8
jb 0x41d16b
lea ebx, [ebx*2 + 2]
mov eax, edi
cmp ebx, 0x1000
jb 0x41d161
mov edi, dword [edi - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d18f
push ebx
push edi
call fcn.0048d1e5
add esp, 8
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret
call fcn.00498b39
call fcn.00498b39
int3
Function at 0x41f6b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7b38
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x50c3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x41f87b
xor edi, edi
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x38], edi
jle 0x41f874
mov edx, dword [eax + edi*4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f733
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004025c0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov ecx, dword [ebp - 0x18]
cmovae eax, ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], eax
cmp ecx, 0x10
jb 0x41f7c1
add ecx, 0xfffffff1
lea ecx, [eax + ecx*2]
mov dword [ebp - 0x3c], ecx
sub ecx, eax
sar ecx, 1
je 0x41f7bb
lea esp, [esp]
cmp word [eax], 0x2f
je 0x41f790
add eax, 2
sub ecx, 1
jne 0x41f780
jmp 0x41f7bb
mov edx, str._startup_source
mov edi, eax
mov esi, 0x10
sub edi, edx
mov edi, edi
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x41f80d
add edx, 2
sub esi, 1
jne 0x41f7a0
sub eax, dword [ebp - 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41f818
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x41f7fc
lea ecx, [edx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x41f7f2
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f899
push ecx
push ebx
call fcn.0048d1e5
add esp, 8
mov eax, dword [ebp - 0x34]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, dword [ebp - 0x38]
jge 0x41f871
jmp 0x41f717
mov ecx, dword [ebp - 0x3c]
add eax, 2
jmp 0x41f776
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x41f837
cmp dword [ebp - 0x14], 8
mov ecx, edx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.004025c0
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 0x29], 1
cmp ecx, 8
jb 0x41f86e
lea ecx, [ecx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x41f864
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f899
push ecx
push ebx
call fcn.0048d1e5
add esp, 8
mov eax, dword [ebp - 0x34]
mov bl, byte [ebp - 0x29]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret
call fcn.00498b39
int3
Function at 0x423c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9380
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50c3e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
push edi
call fcn.00423e20
mov dword [ebx], vtable.KClientHostSplashShow.0
mov dword [ebx + 0x48], 0
cmp byte [0x513110], 0
mov dword [ebp - 4], 0
je 0x423c98
mov eax, 1
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1e]
push eax
push 0x4da038
push str.KClientHostSplashShow
push 1
call fcn.00432d40
add esp, 0x14
mov esi, dword [ebp + 8]
mov dword [ebx + 0x20], 0
mov byte [ebp - 4], 1
mov al, byte [esi + 0x80]
mov byte [ebx + 0x4c], al
cmp byte [esi], 0
je 0x423de9
cmp byte [esi + 0x83], 0
jne 0x423de9
push 0
mov dword [ebx + 0x20], 1
call fcn.0047a000
add esp, 4
test al, al
je 0x423cf3
test edi, edi
je 0x423ced
cmp edi, 1
je 0x423ced
cmp edi, 2
je 0x423ced
cmp edi, 3
jne 0x423cf3
test byte [esi + 8], 0x1f
jmp 0x423cf7
cmp dword [esi + 8], 0
je 0x423d00
mov dword [ebx + 0x20], 0
cmp dword [esi + 0xd0], 0
je 0x423d10
mov dword [ebx + 0x20], 0
cmp dword [esi + 4], 0
jne 0x423d28
cmp dword [esi + 0x28], 1
je 0x423d28
cmp dword [esi + 0x10], 1
je 0x423d28
cmp byte [esi + 0x7e], 0
je 0x423d2f
mov dword [ebx + 0x20], 0
cmp dword [ebx + 0x24], 1
jne 0x423d7d
cmp dword [esi + 0x30], 1
jne 0x423d7d
mov edi, dword [esi + 0x2c]
mov esi, dword [edi]
cmp esi, edi
je 0x423d7a
push 0xffffffffffffffff
lea ecx, [esi + 8]
push str..pps
call fcn.00425080
cmp eax, 0xffffffff
jne 0x423d73
push eax
push str..ppsx
lea ecx, [esi + 8]
call fcn.00425080
cmp eax, 0xffffffff
jne 0x423d73
mov esi, dword [esi]
cmp esi, edi
jne 0x423d44
jmp 0x423d7a
mov dword [ebx + 0x20], 0
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 1
jne 0x423de9
test byte [esi + 8], 0x1f
je 0x423de9
lea eax, [ebp + 8]
xor esi, esi
push eax
push 1
push esi
push str.SoftwarekingsoftOffice6.0CommonApplication_Settings
push 0x80000001
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423de3
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], esi
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 4
push eax
push esi
push esi
push str.oleForceShowSplash
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423dda
cmp dword [ebp + 0xc], eax
setne al
mov dword [ebp - 0x14], eax
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebx + 0x48], esi
mov dword [ebx + 0x20], esi
cmp byte [0x513110], 0
mov byte [ebp - 4], 2
je 0x423e07
push dword [ebp - 0x1c]
push dword [ebp - 0x1e]
push dword [ebp - 0x20]
call fcn.00432da0
add esp, 0xc
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x424190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c93f2
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x50c3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call fcn.0048f8b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x424251
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42425f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0048f8b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42425f
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0040aff0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d444
mov esp, ebp
pop ebp
ret