joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a224
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
mov eax, dword [ebp + 0x3b8]
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x1a6]
push edi
push eax
mov word [ebp + 0x1a4], di
call fcn.0042b8b0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.kwsmain.exe
lea eax, [ebp + 0x1a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a38e
push esi
lea eax, [ebp - 0x62]
push edi
push eax
mov dword [ebp - 0x68], edi
mov word [ebp - 0x64], di
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1a4]
push eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
xor esi, esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, edi
mov dword [ebp - 0x7c], eax
je 0x40a38b
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042a208
cmp eax, edi
pop ecx
mov dword [ebp - 0x70], eax
je 0x40a38b
push eax
push dword [ebp - 0x7c]
lea eax, [ebp + 0x1a4]
push dword [ebp - 0x6c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40a382
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x4471bc
push dword [ebp - 0x70]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40a382
cmp dword [ebp - 0x78], edi
jbe 0x40a349
mov eax, dword [ebp - 0x74]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
movzx eax, di
push eax
movzx eax, si
shr edi, 0x10
push edi
push eax
shr esi, 0x10
push esi
push 0x447e0c
lea eax, [ebp - 0x64]
push 0x104
push eax
call fcn.00409b2a
mov ecx, dword [ebp - 0x80]
add esp, 0x1c
lea eax, [ebp - 0x64]
push eax
call fcn.00403d76
mov dword [ebp - 0x68], 1
push dword [ebp - 0x70]
call fcn.0042b7db
pop ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 0x3ac]
pop edi
xor ecx, ebp
pop esi
call fcn.0042b92a
add ebp, 0x3b0
leave
ret 4
Function at 0x40a3a7
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a0]
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x18e]
push ebx
push eax
mov word [ebp + 0x18c], bx
call fcn.0042b8b0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x18c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.ksversion.ini
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a497
push edi
lea eax, [ebp - 0x7a]
push ebx
push eax
mov word [ebp - 0x7c], bx
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp + 0x18c]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push 0x446e68
push str.fileversion
push str.VERSION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40a488
xor ecx, ecx
cmp word [ebp - 0x7c], bx
je 0x40a488
lea eax, [ebp - 0x7c]
cmp word [eax], 0x2d
jne 0x40a47e
mov word [eax], 0x2e
inc ecx
lea eax, [ebp + ecx*2 - 0x7c]
cmp word [eax], bx
jne 0x40a473
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
call fcn.00403d76
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x394]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b92a
add ebp, 0x398
leave
ret 4
Function at 0x40ab07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.00409ba0
push eax
lea ecx, [ebp - 0x48]
call fcn.00409b46
xor ebx, ebx
cmp dword [edi + 0x1c], ebx
jne 0x40ab4c
cmp dword [ebp - 0x48], ebx
je 0x40ab42
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xe00001
jmp 0x40ac60
cmp dword [esi + 0x40], ebx
jne 0x40ab94
cmp dword [esi + 0x34], 8
jb 0x40ab5c
mov ecx, dword [esi + 0x20]
jmp 0x40ab5f
lea ecx, [esi + 0x20]
cmp dword [esi + 0x18], 8
jb 0x40ab6a
mov eax, dword [esi + 4]
jmp 0x40ab6d
lea eax, [esi + 4]
push ecx
push eax
call dword [edi + 0x24]
cmp dword [esi + 0x38], ebx
je 0x40ab7d
push dword [esi + 0x3c]
call dword [edi + 0x20]
cmp dword [ebp - 0x48], ebx
je 0x40ac5e
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x40ac5e
push ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], 7
call fcn.00401734
lea ecx, [ebp - 0x28]
call fcn.0040297c
mov eax, dword [esi + 0x38]
push 0xffffffffffffffff
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x3c]
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 8], eax
call fcn.00403692
push 0xffffffffffffffff
push ebx
add esi, 0x1c
push esi
lea ecx, [ebp - 0x28]
call fcn.00403692
push edi
lea ecx, [ebp - 0x4c]
call fcn.00409b46
lea eax, [ebp - 0x44]
push eax
lea ecx, [edi + 0x28]
call fcn.0040aaa1
cmp dword [ebp - 0x4c], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x40abf8
push dword [ebp - 0x4c]
call esi
mov eax, dword [edi + 0x18]
cmp eax, ebx
je 0x40ac17
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40ac4c
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x18], ebx
push ebx
push ebx
push edi
push 0x40a9eb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [edi + 0x18], eax
jne 0x40ac4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x44]
mov edi, eax
call fcn.00409e30
cmp dword [ebp - 0x48], ebx
je 0x40ac48
push dword [ebp - 0x48]
call esi
mov eax, edi
jmp 0x40ac60
lea ecx, [ebp - 0x44]
call fcn.00409e30
cmp dword [ebp - 0x48], ebx
je 0x40ac5e
push dword [ebp - 0x48]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b92a
leave
ret 8
Function at 0x40b050
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x40b072
xor eax, eax
jmp 0x40b0ef
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x40b0d9
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.Application_Data
push esi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0042e95d
pop ecx
pop ecx
push eax
call fcn.0042b9b3
add esp, 0xc
pop esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0042b9b3
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0042b92a
leave
ret

Function at 0x40b0fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b114
test al, 0x10
jne 0x40b114
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x40b117
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b12e
test al, 0x10
je 0x40b12e
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x40b131
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b148
test al, 0x10
je 0x40b148
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x40b6ea
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
mov esi, dword [ebp + 8]
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0042b8b0
add esp, 0xc
call fcn.00413884
cmp eax, 7
push 0x104
lea eax, [ebp - 0x20c]
push eax
jl 0x40b73c
push str._userprofile_AppDataRoamingMicrosoftInternet_ExplorerQuick_Launch
jmp 0x40b741
push str._userprofile_Application_DataMicrosoftInternet_ExplorerQuick_Launch
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.004040fd
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042b92a
leave
ret
Function at 0x40e9ba
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x3c], 0
je 0x40eacc
cmp byte [esi + 0x41], 0
je 0x40eacc
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40e9f4
xor al, al
jmp 0x40eace
push 0
push 8
lea ecx, [ebp - 0x20]
call fcn.0040e994
push ebx
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040c037
mov ecx, eax
call fcn.0040de7f
mov edi, dword [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040c037
mov ecx, eax
call fcn.0040de7f
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
add edi, ebx
push edi
push dword [ebp - 0x28]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x40ea66
dec eax
je 0x40ea6a
dec eax
dec eax
je 0x40eac8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00401cd1
pop edi
mov al, bl
pop ebx
jmp 0x40eace
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040c037
mov ecx, eax
call fcn.0040de7f
mov edi, dword [ebp - 0x24]
sub edi, eax
je 0x40eaaa
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040c037
mov ecx, eax
call fcn.0040de7f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00430351
add esp, 0x10
cmp edi, eax
jne 0x40ea52
cmp byte [esi + 0x41], 0
je 0x40eac8
test edi, edi
jne 0x40ea02
push edi
push 8
lea ecx, [ebp - 0x20]
call fcn.0040e6f4
jmp 0x40ea02
mov bl, 1
jmp 0x40ea54
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042b92a
leave
ret
Function at 0x413884
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x144
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0xa4]
push esi
push eax
mov dword [ebp - 0xa8], 0x11c
call fcn.0042b8b0
add esp, 0xc
cmp dword [0x455d34], esi
jne 0x4139c7
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4139c7
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp - 0xa4], 5
jne 0x413989
cmp dword [ebp - 0xa0], esi
jne 0x413900
mov dword [0x455d30], ebx
jmp 0x4139c0
cmp dword [ebp - 0xa0], ebx
jne 0x413917
mov dword [0x455d30], 2
jmp 0x4139c0
cmp dword [ebp - 0xa0], 2
jne 0x4139c0
push edi
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0xcc], esi
lea edi, [ebp - 0xc8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [ebp + 0x72], bl
pop edi
jne 0x413961
cmp word [ebp - 0xcc], 9
jne 0x413961
mov dword [0x455d30], 3
jmp 0x4139c0
test word [ebp + 0x70], 0x8000
je 0x413975
mov dword [0x455d30], 5
jmp 0x4139c0
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
and eax, 2
add eax, 4
jmp 0x4139bb
cmp dword [ebp - 0xa4], 6
jne 0x4139c0
cmp dword [ebp - 0xa0], esi
jne 0x4139a7
xor eax, eax
cmp byte [ebp + 0x72], bl
setne al
add eax, 7
jmp 0x4139bb
cmp dword [ebp - 0xa0], ebx
jne 0x4139c0
mov al, byte [ebp + 0x72]
dec al
neg al
sbb eax, eax
add eax, 0xa
mov dword [0x455d30], eax
mov dword [0x455d34], ebx
pop ebx
mov ecx, dword [ebp + 0x74]
mov eax, dword [0x455d30]
xor ecx, ebp
pop esi
call fcn.0042b92a
add ebp, 0x78
leave
ret

Function at 0x416f41
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x416f5a
mov eax, dword [ebp - 4]
jmp 0x417034
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x41700f
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4490e8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4490e8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4490e8]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4490e8]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4490e8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4490e8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4490e8]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4490e8]
dec ebp
jne 0x416f79
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x41702b
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4490e8]
dec ecx
jne 0x417019
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41714a
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
and dword [ebp - 0x74], 0
push ebx
mov ebx, dword [ebp + 0x1ac]
push esi
push edi
push 0x11
pop ecx
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1a8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1b0]
push 0x1c2
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x2a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0042b8b0
xor esi, esi
add esp, 0xc
cmp dword [ebp - 0x80], esi
je 0x4172ce
cmp dword [ebp - 0x78], esi
je 0x4172ce
cmp ebx, esi
jne 0x4171ca
mov ebx, dword [ebp - 0x80]
cmp dword [ebp - 0x7c], esi
jne 0x4171d2
mov dword [ebp - 0x7c], ebx
push 0x103
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push 0x104
push eax
call fcn.00430ff0
add esp, 0x10
push esi
push esi
push 0x2001f
push esi
push esi
lea eax, [ebp - 0x70]
push eax
push 0x80000002
lea ecx, [ebp - 0x74]
call fcn.00406745
mov edi, eax
cmp edi, esi
lea ecx, [ebp - 0x74]
je 0x41721a
call fcn.00401253
mov eax, edi
jmp 0x4172d9
xor edi, edi
inc edi
push edi
push dword [ebp - 0x7c]
push str.Description
call fcn.004067ad
push edi
push ebx
push str.DisplayName
lea ecx, [ebp - 0x74]
call fcn.004067ad
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0
push str.ErrorControl
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], edi
call esi
push edi
push str.SchedulerGroup
push str.Group
lea ecx, [ebp - 0x74]
call fcn.004067ad
push 2
push dword [ebp - 0x78]
lea ecx, [ebp - 0x74]
push str.ImagePath
call fcn.004067ad
push edi
push str.LocalSystem
push str.ObjectName
lea ecx, [ebp - 0x74]
call fcn.004067ad
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
push 0
push str.Start
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 2
call esi
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
push 0
push str.Type
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x110
call esi
lea ecx, [ebp - 0x74]
call fcn.00401253
xor eax, eax
jmp 0x4172d9
lea ecx, [ebp - 0x74]
call fcn.00401253
or eax, 0xffffffff
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b92a
add ebp, 0x19c
leave
ret
Function at 0x4172f1
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push 0x20019
push str.SYSTEMCurrentControlSetServicesKingsoft_Antivirus_WebShield_Service
xor esi, esi
push 0x80000002
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], esi
call fcn.0040126a
test eax, eax
je 0x41734d
lea ecx, [ebp - 0x7c]
call fcn.00401253
xor eax, eax
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop esi
call fcn.0042b92a
add ebp, 0x194
leave
ret
push 0x206
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push str.ImagePath
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x104
call fcn.004012d7
test eax, eax
jne 0x41732d
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41739d
lea ecx, [ebp - 0x7c]
call fcn.00401253
mov eax, esi
jmp 0x417337
xor esi, esi
inc esi
jmp 0x417391

Function at 0x4173a2
Capabilities:
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x388], eax
push esi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor esi, esi
push 0x80000002
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], esi
call fcn.0040126a
test eax, eax
jne 0x417415
push 0x3fe
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push str.kwsuninstalldel
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x200
call fcn.004012d7
test eax, eax
jne 0x417415
inc esi
lea ecx, [ebp - 0x7c]
call fcn.00401253
mov ecx, dword [ebp + 0x388]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042b92a
add ebp, 0x38c
leave
ret
Function at 0x417e0e
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
push edi
push 0xf003f
mov ebx, str.SOFTWAREkingsoftkswsvc
push ebx
mov edi, 0x80000002
xor esi, esi
push edi
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], esi
call fcn.0040126a
test eax, eax
je 0x417e61
push esi
push esi
push 0x2001f
push esi
push esi
push ebx
push edi
lea ecx, [ebp - 0x78]
call fcn.00406745
push 4
lea eax, [ebp - 0x7c]
push eax
push 4
push esi
push str.forduba
push dword [ebp - 0x78]
xor edi, edi
inc edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x80]
push eax
push str.autosetting
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x80], esi
call fcn.0040129f
cmp dword [ebp - 0x80], esi
jne 0x417f8a
push 0x206
lea eax, [ebp - 0x72]
push esi
push eax
mov word [ebp - 0x74], si
call fcn.0042b8b0
mov ebx, 0x104
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.0040b321
add esp, 0x14
test eax, eax
je 0x417f70
push str.kws.ini
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.0042b939
add esp, 0xc
call dword [0x4545d0]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, str.FirstRun
push edi
mov dword [ebp - 0x7c], eax
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x417f00
xor eax, eax
jmp 0x417f15
lea eax, [esi + esi]
call fcn.0042c100
mov eax, esp
push dword [ebp - 0x7c]
push esi
push edi
push eax
call fcn.0040ba65
lea ecx, [ebp - 0x74]
push ecx
push 0x447e08
push eax
push str.setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, 0x4494e8
push edi
call ebx
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x417f41
xor eax, eax
jmp 0x417f56
lea eax, [esi + esi]
call fcn.0042c100
mov eax, esp
push dword [ebp - 0x7c]
push esi
push edi
push eax
call fcn.0040ba65
lea ecx, [ebp - 0x74]
push ecx
push 0x447e08
push eax
push str.setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor edi, edi
inc edi
xor esi, esi
push 4
lea eax, [ebp - 0x7c]
push eax
push 4
push esi
push str.autosetting
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x78]
call fcn.00401253
lea ecx, [ebp - 0x78]
call fcn.00401253
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
call fcn.0042b92a
add ebp, 0x198
leave
ret
Function at 0x417fba
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x192]
push edi
push eax
mov word [ebp + 0x190], di
call fcn.0042b8b0
add esp, 0xc
push 1
push 0x17
lea eax, [ebp + 0x190]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x20019
push str.SOFTWAREKingsoftAntiVirusSetupOem
push 0x80000002
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], edi
call fcn.0040126a
test eax, eax
jne 0x4180b6
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x449a70
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x104
call fcn.004012d7
test eax, eax
jne 0x4180b6
lea eax, [ebp - 0x78]
push eax
call fcn.0042b16d
test eax, eax
pop ecx
je 0x4180b6
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call esi
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4180b6
push 0x449a5c
lea eax, [ebp + 0x190]
push eax
call esi
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x7c]
call fcn.00401253
xor eax, eax
inc eax
jmp 0x4180c0
lea ecx, [ebp - 0x7c]
call fcn.00401253
xor eax, eax
mov ecx, dword [ebp + 0x398]
pop edi
xor ecx, ebp
pop esi
call fcn.0042b92a
add ebp, 0x39c
leave
ret
Function at 0x41812f
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x3e8], eax
mov eax, dword [ebp + 0x3f8]
push ebx
mov ebx, dword [ebp + 0x3f4]
push esi
push edi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x400]
xor edi, edi
push 0x206
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x1e2]
push edi
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
mov word [ebp + 0x1e0], di
call fcn.0042b8b0
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x44d970
push 1
push edi
push 0x44d980
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x418274
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x78]
push edx
push 0x44d9a0
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x418274
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push 2
push dword [ebp - 0x7c]
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, edi
jl 0x418274
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 7
push edi
push eax
call dword [ecx + 0x4c]
mov esi, eax
cmp esi, edi
jl 0x418274
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 2
lea edx, [ebp - 0x70]
push edx
push 0x104
lea edx, [ebp + 0x1e0]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
jl 0x418274
lea eax, [ebp + 0x1e0]
push ebx
push eax
call fcn.0042eb1e
test eax, eax
pop ecx
pop ecx
je 0x418274
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x3c]
cmp dword [ebp - 0x80], edi
je 0x41824d
mov eax, dword [ebp - 0x74]
push dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push edi
push dword [ebp - 0x7c]
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, edi
jl 0x418274
push edi
push dword [ebp - 0x7c]
push 0x1005
push 0x7fffffff
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0x78]
cmp eax, edi
je 0x418281
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x74]
cmp eax, edi
je 0x41828e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x3e8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b92a
add ebp, 0x3ec
leave
ret