joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448eb0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 0x20
push 2
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x448f3b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jle 0x448f0a
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_allocate_sid:_0x_08x.
push str.kupdate::KProcessUtils::IsUserInGroup
push 0x1be
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 5
call fcn.0041a9b0
add esp, 0x18
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x448f84
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jle 0x448f62
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_check_token_group:_0x_08x.
push str.kupdate::KProcessUtils::IsUserInGroup
push 0x1c4
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 5
call fcn.0041a9b0
add esp, 0x18
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x10], ebx
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret

Function at 0x448fc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.004ba010
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
movzx edx, byte [ebp - 6]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x11c]
push edx
push eax
push ecx
push str.major:__d__minor:__d__type:__d
push str.kupdate::KProcessUtils::IsWin7OrLater
push 0x3b7
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 4
call fcn.0041a9b0
mov eax, dword [ebp - 0x11c]
add esp, 0x20
cmp eax, 6
jne 0x449062
cmp byte [ebp - 6], 1
mov eax, dword [ebp - 0x118]
jne 0x44904d
cmp eax, 1
je 0x449052
cmp eax, 2
jb 0x449064
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
ja 0x449052
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x449080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x594e23], 0
jne 0x449111
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.004ba010
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebp - 0x114], 6
jb 0x4490f5
cmp dword [ebp - 0x110], 2
jb 0x4490f5
mov al, 1
mov byte [0x594e22], al
mov byte [0x594e23], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [0x594e22], al
mov byte [0x594e23], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x594e22]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x449d40
Capabilities:
Shutdown system

Disassembly:
push esi
push str.Restart_computer.
push str.kupdate::KProcessUtils::RestartComputer
push 0x2e2
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 7
call fcn.0041a9b0
push 1
push str.SeShutdownPrivilege
call fcn.00449ba0
mov esi, eax
add esp, 0x1c
test esi, esi
jns 0x449d94
push esi
push str.Failed_ajust_privilege:_0x_08x.
push str.kupdate::KProcessUtils::RestartComputer
push 0x2e6
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.0041a9b0
add esp, 0x18
mov eax, esi
pop esi
ret
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x449ddb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jle 0x449db6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push str.Failed_exit_window:_0x_08x.
push str.kupdate::KProcessUtils::RestartComputer
push 0x2ec
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.0041a9b0
add esp, 0x18
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x44a030
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44a17a
cmp word [esi], 0
je 0x44a17a
test ebx, ebx
je 0x44a17a
push edi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.004ba010
add esp, 0xc
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x44a0d9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jle 0x44a0aa
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x74
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.0041a9b0
add esp, 0x18
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x230]
push ecx
push edi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x44a125
lea ebx, [ebx]
lea edx, [ebp - 0x20c]
push esi
push edx
call fcn.004bb2ef
add esp, 8
test eax, eax
jne 0x44a112
lea eax, [ebp - 0x228]
push eax
mov ecx, ebx
call fcn.00449f80
lea ecx, [ebp - 0x230]
push ecx
push edi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x44a0f0
jmp 0x44a158
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jle 0x44a139
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x81
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.0041a9b0
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebx]
xor eax, eax
cmp edx, dword [ebx + 4]
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
push 0x542a80
push str.kupdate::KProcessUtils::GetProcessPid
push 0x6b
push str.S:_rc_v11_edu_20191101_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.0041a9b0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44a450
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5293bb
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x44a516
cmp esi, 0xffffffff
je 0x44a516
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x21a]
push ecx
mov word [ebp - 0x21c], ax
call fcn.004ba010
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x44a50f
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a4e6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.00402460
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x44a518
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret

Function at 0x44a5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bad8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x22
xor eax, eax
xor edi, edi
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
call fcn.00402460
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00401fb0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
jae 0x44a65f
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a6a3
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x34]
push eax
push edi
push edi
push str.Start
push ecx
mov dword [ebp - 0x38], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 8
mov esi, dword [ebp - 0x34]
jb 0x44a6b8
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004b9008
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44a6e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529412
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x220], esi
mov word [esi], ax
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 1
mov word [ebp - 0x218], cx
call fcn.004ba010
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemWow64DirectoryW]
test eax, eax
je 0x44a78d
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a780
jmp 0x44a7db
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x44a7ee
push 0x208
lea edx, [ebp - 0x218]
push 0
push edx
call fcn.004ba010
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x44a7ee
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a7d0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, esi
call fcn.00402460
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44ad90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x214], ecx
xor ecx, ecx
push 0x206
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x20a]
push edx
mov dword [ebp - 0x21c], eax
mov word [ebp - 0x20c], cx
call fcn.004ba010
add esp, 0xc
push 0
push 0x25
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x44ae0a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x44ae13
mov ecx, dword [str._ntdll.dll]
mov edx, dword [0x54a650]
mov dword [eax], ecx
mov ecx, dword [0x54a654]
mov dword [eax + 4], edx
mov edx, dword [0x54a658]
mov dword [eax + 8], ecx
mov ecx, dword [0x54a65c]
mov dword [eax + 0xc], edx
mov dx, word [0x54a660]
mov dword [eax + 0x10], ecx
push edi
mov word [eax + 0x14], dx
call fcn.0044a810
mov eax, dword [0x594e18]
test eax, eax
je 0x44ae76
push 0
lea ecx, [ebp - 0x20c]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x44ae87
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.004b7ad5
add esp, 4
mov esi, eax
call fcn.0044a810
mov eax, dword [0x594e14]
test eax, eax
je 0x44aeee
push esi
push edi
push 0
lea edx, [ebp - 0x20c]
push edx
call eax
test eax, eax
je 0x44aeee
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x210], 0
call fcn.0044a810
mov eax, dword [0x594e10]
test eax, eax
je 0x44aeee
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x539ff0
push esi
call eax
test eax, eax
jne 0x44af09
push esi
call fcn.004b9ded
add esp, 4
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
movzx ecx, word [eax + 0x12]
mov edx, dword [ebp - 0x224]
mov dword [edx], ecx
movzx ecx, word [eax + 0x10]
mov edx, dword [ebp - 0x214]
mov dword [edx], ecx
movzx ecx, word [eax + 0x16]
mov edx, dword [ebp - 0x218]
mov dword [edx], ecx
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x21c]
push esi
mov dword [ecx], eax
call fcn.004b9ded
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
mov eax, 1
pop edi
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44b540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5295b3
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x27c], edi
push 0x22
xor eax, eax
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], edi
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], edi
mov word [ebp - 0x238], ax
call fcn.00402460
push str.wpscloudsvr
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x254]
push edx
mov dword [ebp - 4], 1
call fcn.00402b90
add esp, 0xc
cmp dword [ebp - 0x224], 8
mov byte [ebp - 4], 3
jb 0x44b5ea
mov eax, dword [ebp - 0x238]
push eax
call fcn.004b9008
add esp, 4
push 0x208
lea eax, [ebp - 0x21a]
xor ecx, ecx
xor edx, edx
push edi
push eax
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], edi
mov word [ebp - 0x238], cx
mov word [ebp - 0x21c], dx
call fcn.004ba010
mov eax, dword [ebp - 0x254]
add esp, 0xc
cmp dword [ebp - 0x240], 8
mov dword [ebp - 0x274], edi
jae 0x44b63c
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x274]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x44b692
mov ecx, dword [ebp - 0x274]
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push str.ImagePath
push ecx
mov dword [ebp - 0x278], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44b6b0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, esi
call fcn.00402460
mov dword [ebp - 0x27c], 1
cmp dword [esi + 0x10], edi
je 0x44b73b
push 1
push 0xffffffffffffffff
push 0x542a7c
mov ecx, esi
call fcn.00449190
cmp eax, 0xffffffff
jne 0x44b6f6
xor eax, eax
jmp 0x44b706
push 1
push 0xffffffffffffffff
push 0x542a7c
mov ecx, esi
call fcn.00449190
inc eax
push eax
push edi
lea edx, [ebp - 0x270]
push edx
mov ecx, esi
call fcn.00408740
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00402630
cmp dword [ebp - 0x25c], 8
jb 0x44b73b
mov eax, dword [ebp - 0x270]
push eax
call fcn.004b9008
add esp, 4
cmp dword [ebp - 0x240], 8
jb 0x44b753
mov ecx, dword [ebp - 0x254]
push ecx
call fcn.004b9008
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44b770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529623
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x278], edi
mov ebx, 7
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
mov dword [ebp - 0x280], esi
mov word [esi], ax
push 0x208
lea edx, [ebp - 0x21a]
xor ecx, ecx
push edi
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x278], 1
mov word [ebp - 0x21c], cx
call fcn.004ba010
add esp, 0xc
lea eax, [ebp - 0x274]
push eax
push 0x20019
push edi
push str.SoftwareKingsoftOffice6.0Common
mov dword [ebp - 0x274], edi
call fcn.00521ab0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x44b98c
mov eax, dword [ebp - 0x274]
lea ecx, [ebp - 0x27c]
push ecx
lea edx, [ebp - 0x21c]
push edx
push edi
push edi
push str.InstallRoot
push eax
mov dword [ebp - 0x27c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 1
xor eax, eax
push 0x539ff0
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x244], edi
mov word [ebp - 0x254], ax
call fcn.00402460
push str.wpscloudsvr.exe
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x270]
push edx
mov dword [ebp - 4], 1
call fcn.00402b90
add esp, 0xc
mov ebx, eax
xor eax, eax
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44b8d0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00402460
push 0xffffffffffffffff
push edi
push ebx
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 3
call fcn.00401fb0
push 0xffffffffffffffff
push edi
push eax
mov ecx, esi
call fcn.00402240
mov ebx, 8
cmp dword [ebp - 0x224], ebx
jb 0x44b92c
mov edx, dword [ebp - 0x238]
push edx
call fcn.004b9008
add esp, 4
xor eax, eax
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], edi
mov word [ebp - 0x238], ax
cmp dword [ebp - 0x25c], ebx
jb 0x44b95c
mov ecx, dword [ebp - 0x270]
push ecx
call fcn.004b9008
add esp, 4
xor edx, edx
mov dword [ebp - 0x25c], 7
mov dword [ebp - 0x260], edi
mov word [ebp - 0x270], dx
cmp dword [ebp - 0x240], ebx
jb 0x44b98c
mov eax, dword [ebp - 0x254]
push eax
call fcn.004b9008
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44b9b0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529668
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x44ba25
cmp edi, 0xffffffff
je 0x44ba25
push 0x14
push str.wpscloudsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x4c], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [ebp - 4], 1
test esi, esi
je 0x44ba22
cmp esi, 0xffffffff
jne 0x44ba29
push edi
call ebx
xor al, al
jmp 0x44baa6
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x44ba5f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
xor al, al
jmp 0x44baa6
push str.wpscloudsvr
lea ecx, [ebp - 0x48]
call fcn.00402580
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebp - 4], 2
call fcn.0044a5f0
add esp, 4
cmp eax, 4
sete bl
cmp dword [ebp - 0x34], 8
jb 0x44ba94
mov edx, dword [ebp - 0x48]
push edx
call fcn.004b9008
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
test bl, bl
jne 0x44ba25
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret
Function at 0x44bc70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529708
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x590cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x48]
push eax
mov bl, 1
call fcn.0044b540
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.0044b440
add esp, 0xc
mov edi, 8
mov byte [ebp - 4], 2
cmp dword [ebp - 0x34], edi
jb 0x44bcd3
mov edx, dword [ebp - 0x48]
push edx
call fcn.004b9008
add esp, 4
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
cmp dword [ebp - 0x1c], eax
jne 0x44bd20
lea ecx, [ebp - 0x64]
push ecx
call fcn.0044b770
add esp, 4
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00402630
mov byte [ebp - 4], 2
cmp dword [ebp - 0x50], edi
jb 0x44bd1a
mov edx, dword [ebp - 0x64]
push edx
call fcn.004b9008
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x44bd70
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x44bd2b
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44bd70
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x18], edi
jae 0x44bd48
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
push ecx
push str.CheckService
push eax
call fcn.00448d80
mov eax, dword [ebp - 0x68]
add esp, 0xc
test ax, ax
je 0x44bd72
cmp eax, 0xffffffff
jne 0x44bd70
call fcn.0044b9b0
mov bl, al
jmp 0x44bd72
xor bl, bl
cmp dword [ebp - 0x18], edi
jb 0x44bd83
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004b9008
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b9ff3
mov esp, ebp
pop ebp
ret