joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415710
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x415879
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x415879
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea ecx, [edx + edx*2]
mov eax, ebx
sub eax, ecx
mov ecx, 0
setne cl
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
add ecx, edx
add ecx, ecx
add ecx, ecx
mov dword [ebp - 0xc], ecx
test esi, esi
jne 0x415763
pop esi
pop edi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
test edx, edx
je 0x4157de
add edi, 2
mov dword [ebp - 4], edx
nop
movzx edx, byte [edi - 2]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
movzx eax, byte [edi - 1]
movzx edx, byte [edi]
and eax, 0xf
add eax, eax
add eax, eax
shr edx, 6
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 2], al
movzx edx, byte [edi]
and edx, 0x3f
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 3], al
add ecx, 4
add edi, 3
dec dword [ebp - 4]
jne 0x415770
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
dec eax
je 0x415840
dec eax
jne 0x41586f
movzx eax, byte [edi + ebx - 2]
lea edx, [edi + ebx - 2]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
movzx edx, byte [edx]
movzx eax, byte [edi + ebx - 1]
lea ebx, [edi + ebx - 1]
and edx, 3
shl edx, 4
shr eax, 4
or edx, eax
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
movzx eax, byte [ebx]
and eax, 0xf
movzx edx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0xc]
mov byte [ecx + esi + 2], dl
mov byte [ecx + esi + 3], 0x3d
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + ebx - 1]
shr eax, 2
movzx edx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
movzx eax, byte [edi + ebx - 1]
and eax, 3
shl eax, 4
movzx edx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], dl
mov word [ecx + esi + 2], 0x3d3d
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415a90
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.SOFTWAREkingsoftOffice6.0Common
push 0x80000002
mov dword [ebp - 0x214], 0
call edi
mov esi, eax
test esi, esi
je 0x415af1
lea ecx, [ebp - 0x214]
push ecx
push 0x20019
push 0
push str.SOFTWAREWOW6432NodekingsoftOffice6.0Common
push 0x80000002
call edi
mov esi, eax
xor edx, edx
push 0x208
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00480280
add esp, 0xc
pop edi
test esi, esi
pop esi
jne 0x415b6f
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push str.InstallRoot
push eax
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415b6f
push str.office6cfgs_setup.cfg
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
jmp 0x415ba9
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.cfgs_setup.cfg
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
push 0x409
push str.UILanguage
push str.Local
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret
Function at 0x417120
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d60b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58d038]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047f6d1
push 4
mov dword [ebp - 4], 0
call fcn.004801e4
mov edi, eax
add esp, 4
test edi, edi
je 0x4171a0
call fcn.0047f38f
mov dword [edi], eax
call fcn.0047f14e
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0047f083
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x417196
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0047f0ab
jmp 0x4171a2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x418df1
cmp byte [edi + 0x49], bl
je 0x418df1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x418de5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x418d45
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x418d5d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x418d86
dec eax
je 0x418d8a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x418de0
jmp 0x418dec
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x418d9a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x418dc3
cmp ebx, 0x10
jae 0x418da9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0048273d
add esp, 0x10
cmp esi, eax
jne 0x418ddd
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x418de9
test esi, esi
jne 0x418d51
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407dc0
jmp 0x418d4b
lea ecx, [ebp - 0x2c]
call fcn.00469740
xor al, al
jmp 0x418df3
lea ecx, [ebp - 0x2c]
call fcn.00469740
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret
Function at 0x419c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544d02
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x220], esi
mov word [esi], ax
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 1
mov word [ebp - 0x218], cx
call fcn.00480280
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x419d0d
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419d00
jmp 0x419d5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x419d6e
push 0x208
lea edx, [ebp - 0x218]
push 0
push edx
call fcn.00480280
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x419d6e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419d50
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, esi
call fcn.00401b70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret

Function at 0x41bc40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ec68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, 8
cmp dword [esi + 0x14], edi
jb 0x41bc7c
mov eax, dword [esi]
jmp 0x41bc7e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41bd0f
cmp dword [esi + 0x14], edi
jb 0x41bc97
mov eax, dword [esi]
jmp 0x41bc99
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call edi
test eax, eax
jne 0x41bd0f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x41bd0f
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0041ac10
add esp, 8
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
je 0x41bce4
push ecx
call fcn.0041bc40
add esp, 4
test eax, eax
jne 0x41bced
lea ecx, [ebp - 0x2c]
call fcn.0046e6d0
xor eax, eax
jmp 0x41bd14
cmp dword [esi + 0x14], 8
jb 0x41bcf5
mov esi, dword [esi]
push 0
push esi
call edi
test eax, eax
jne 0x41bd07
call ebx
cmp eax, 0xb7
jne 0x41bce1
lea ecx, [ebp - 0x2c]
call fcn.0046e6d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret
Function at 0x41bd30
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cb08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0041ac10
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.0041bc40
add esp, 0xc
test eax, eax
jne 0x41bd97
cmp dword [ebp - 0x18], 8
jb 0x41bd93
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00480102
add esp, 4
xor eax, eax
jmp 0x41bdcd
cmp dword [esi + 0x14], 8
jb 0x41bd9f
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41bda9
mov eax, dword [edi]
jmp 0x41bdab
mov eax, edi
mov ecx, dword [ebp + 0x10]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x18], 8
mov esi, eax
jb 0x41bdcb
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00480102
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret
Function at 0x41f650
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e500
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x30], ebx
xor esi, esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x34]
push ecx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jne 0x41f6c9
lea edx, [ebp - 0x48]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp edi, edx
je 0x41f785
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
jmp 0x41f785
xor ecx, ecx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x34], ebx
jle 0x41f740
mov edx, dword [eax + ecx*4]
cmp edx, ebx
je 0x41f72e
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41f6f0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.00401b70
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00406860
cmp dword [ebp - 0x18], 8
mov byte [ebp - 4], bl
jb 0x41f72e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00480102
add esp, 4
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, dword [ebp - 0x34]
jl 0x41f6d3
mov esi, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x48]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp edi, eax
je 0x41f766
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
jmp 0x41f785
cmp esi, ebx
je 0x41f785
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push edx
push esi
call fcn.004025e0
push esi
call fcn.00480102
add esp, 0x14
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret
Function at 0x4203f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.00415a60
test eax, eax
je 0x42057b
push ebx
mov ebx, 1
push edi
test byte [0x5932f8], bl
jne 0x420438
or dword [0x5932f8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [0x5932f4], eax
mov eax, dword [0x5932f4]
push 0xa
push 0x10
push 0x5932d4
push eax
call fcn.0048161f
push 0xa
push 0x10
push 0x5932b4
push esi
call fcn.0048161f
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xa
push 0x10
push 0x593294
push eax
call fcn.0048161f
push str.crash_handle
push str.exitsource
mov dword [0x593290], ebx
mov dword [0x59328c], 0
mov dword [0x593288], 0xc
call fcn.0043ff50
push str.crash
push str.exitreason
call fcn.0043ff50
add esp, 0x20
call fcn.0043fea0
mov ecx, 8
mov esi, str.kcrashdumper.exe
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x28]
push ecx
movsw word es:[edi], word [esi]
call fcn.00415a60
push eax
push 0x54eecc
push 0x592a88
call fcn.004203b0
call fcn.00415a70
push eax
push 0x5932b4
push 0x593294
push 0x5932d4
push 0x592a88
push str._s__pid_s__tid_s__exp_s__callfrom1__module_s
push 0x591988
call fcn.004203d0
add esp, 0x2c
push 0x591974
push 0x591930
push 0
push 0
push 0
push ebx
push 0
push 0
push 0x591988
mov edx, 0xa
push 0x592a88
mov dword [0x591930], 0x44
mov dword [0x59195c], ebx
mov word [0x591960], dx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
mov dword [0x591928], eax
pop ebx
test eax, eax
je 0x42057b
mov eax, dword [0x591974]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x591978]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [0x591974]
push edx
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00480264
mov esp, ebp
pop ebp
ret

Function at 0x420c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x420c9b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x420cd2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x420cce
jmp 0x420cc0
cmp esi, eax
jae 0x420cd2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x420cc0
cmp esi, eax
jb 0x420cd9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420e92
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x420e61
cmp eax, 2
jne 0x420e7c
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x420e8c
test eax, eax
je 0x420e87
test al, 1
jne 0x420e7c
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x420e8c
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4216e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545528
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58d038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00421450
push str.wps.exe
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.00404e30
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x421733
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp dword [ebp - 0x18], 8
jb 0x421751
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00480102
add esp, 4
xor eax, eax
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x421777
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00480102
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00480264
mov esp, ebp
pop ebp
ret
Function at 0x421d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e878
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x58d038]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [eax + 0x10], ebx
je 0x421e43
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], ebx
je 0x421e43
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x421dae
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x10]
call fcn.00421cb0
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], edi
jb 0x421dc3
mov eax, dword [esi]
jmp 0x421dc5
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.00421cb0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
push 0x2001f
push eax
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.00420d70
cmp eax, ebx
je 0x421e58
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x421dfe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x421e1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421e43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
mov edi, 4
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x421e87
cmp dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
je 0x421e8a
mov edi, dword [ebp + 0x14]
cmp esi, ebx
je 0x421e95
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x421eb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421eda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret