Function at 0x471bb0
Capabilities:
Create process on windows
Encode data using base64
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
mov ebx, ecx
push esi
mov esi, dword [0x59174c]
push edi
mov cl, byte [ebx]
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], edi
test cl, cl
je 0x4723ba
test esi, esi
mov eax, 0x4eb673
cmovne eax, esi
cmp byte [eax], 0
je 0x4723ba
lea eax, [esp + 0xc]
cmp cl, 0x2e
push eax
push eax
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
mov eax, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_sUserChoice
push ebx
cmove eax, edx
push eax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00482d60
mov ecx, dword [esp + 0x28]
add esp, 0x1c
xor edx, edx
push 0x62f
sub esp, 8
call fcn.00470440
add esp, 0xc
test byte [ebp + 0xc], 1
je 0x471de3
cmp byte [ebx], 0x2e
jne 0x471d5a
push 0x636
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithList
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithList
push edi
push edi
call fcn.0047f200
add esp, 0x14
lea edx, [edi + 2]
mov ecx, eax
call fcn.004705c0
mov edi, eax
add esp, 8
test edi, edi
je 0x471db6
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0x12c
push eax
lea eax, [esp + 0x204]
mov dword [esp + 0x18], 0x12c
push eax
xor esi, esi
lea eax, [esp + 0x2c]
push esi
push esi
push eax
lea eax, [esp + 0xe4]
push eax
push esi
push edi
call dword [0x595de0]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x471d11
nop dword [eax]
lea eax, [esp + 0x200]
push 0x4f26f4
push eax
call ebx
add esp, 8
test eax, eax
je 0x471d11
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0x64
push eax
lea eax, [esp + 0x204]
mov dword [esp + 0x18], 0x12c
push eax
push 0
push 0
lea eax, [esp + 0x34]
inc esi
push eax
lea eax, [esp + 0xe4]
push eax
push esi
push edi
call dword [0x595de0]
test eax, eax
je 0x471cc0
push edi
call dword [0x595de8]
lea eax, [esp + 0x200]
push 0x4f26f4
push eax
call ebx
add esp, 8
test eax, eax
jne 0x471db6
push 0x63f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithList
push dword [esp + 0x24]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithList
push eax
push eax
call fcn.0047f200
add esp, 0xc
lea edx, [esp + 0xdc]
mov ecx, eax
jmp 0x471dae
push 0x645
push str.Misc.c
push 2
lea eax, [esp + 0xdc]
xor edx, edx
push 0x12c
push eax
mov ecx, str.SoftwareClasses_rdp_shellopencommand
call fcn.004702c0
add esp, 0x14
test eax, eax
je 0x471db6
lea eax, [esp + 0xd0]
push 0x4f26f4
push eax
call fcn.00483590
add esp, 8
test eax, eax
je 0x471db6
push 0x647
sub esp, 8
mov ecx, str.SoftwareClasses_rdp
xor edx, edx
call fcn.00470440
add esp, 0xc
cmp dword [esp + 0xc], 0
je 0x471dd7
lea eax, [esp + 0xc]
push eax
call fcn.0047e900
add esp, 4
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x64e
push str.Misc.c
push ecx
mov ecx, dword [esp + 0x18]
xor edx, edx
push 0
push 0
push 0xffffffffffffffff
call fcn.00470010
add esp, 0x18
cmp byte [ebx], 0x2e
je 0x471e8a
push 0x651
push str.Misc.c
push ecx
push 0
push str.URL:rdp
push 1
xor edx, edx
mov ecx, str.SoftwareClasses_rdp
call fcn.00470010
add esp, 0x18
mov edx, str.URL_Protocol
push 0x652
push str.Misc.c
push ecx
push 0
push 0x4eb673
push 1
mov ecx, str.SoftwareClasses_rdp
call fcn.00470010
add esp, 0x18
push 0x653
push str.Misc.c
push ecx
push 0
push str.__s_____1_
push esi
push str.__s_____1_
push 0
push 0
call fcn.0047f200
add esp, 0x14
xor edx, edx
mov ecx, str.SoftwareClasses_rdp_shellopencommand
push eax
push 1
call fcn.00470010
add esp, 0x18
lea eax, [esp + 0x14]
mov dword [esp + 0x30], edi
push eax
push 8
mov dword [esp + 0x1c], edi
call dword [0x595eb4]
push eax
call dword [0x595dc0]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], edi
push eax
push 0
push 0
push 1
push dword [esp + 0x24]
call dword [0x595e00]
mov eax, dword [esp + 0x24]
inc eax
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov esi, eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x28]
push esi
push 1
push dword [esp + 0x24]
call dword [0x595e00]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
push 0x5ed
push str.Misc.c
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
lea eax, [esp + 0x3c]
push 0
push dword [esp + 0x2c]
push eax
call fcn.0047ce40
add esp, 0x18
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x65c
push ecx
mov ecx, dword [esp + 0x14]
mov edx, 2
call fcn.004705c0
mov esi, eax
add esp, 8
mov dword [esp + 0x1c], esi
test esi, esi
je 0x472230
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x472229
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push dword [esp + 0x34]
lea eax, [esp + 0x68]
push dword [esp + 0x3c]
push str._08x_08x
push eax
call fcn.004010a0
lea eax, [esp + 0x20]
push eax
push eax
push eax
push str.user_choice_set_via_windows_user_experience_d18b6dd5_6124_4341_9318_804003bafa0b
lea eax, [esp + 0x84]
push eax
push 0x4f26f4
push dword [esp + 0x58]
lea eax, [esp + 0x3c]
push ebx
push str._s_s_s_s_s
push 0
push eax
call fcn.00482d60
add esp, 0x3c
mov dword [esp + 0x14], eax
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_CharLowerA]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x472046
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [0x595e74]
mov esi, eax
test esi, esi
jne 0x472026
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x472046
lea eax, [esi + esi]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [esp + 0x20], eax
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [0x595e74]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x78]
push eax
lea edi, [edi*2 + 2]
call fcn.004d0d10
add esp, 4
lea eax, [esp + 0x78]
push edi
push dword [esp + 0x24]
push eax
call fcn.004d13d0
add esp, 0xc
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004d0c70
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x60]
mov edx, edi
push eax
call fcn.004715e0
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x68]
mov edx, edi
push eax
call fcn.004717b0
mov eax, dword [esp + 0x2c]
xor eax, dword [esp + 0x54]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x30]
xor eax, dword [esp + 0x58]
push 0xd
mov dword [esp + 0x44], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 0x1c
mov dword [esp + 0x14], eax
test eax, eax
je 0x47215d
xor edx, edx
mov esi, eax
nop dword [eax]
movzx ecx, byte [esp + edx + 0x24]
inc edx
cmp edx, 8
jge 0x4720fe
movzx eax, byte [esp + edx + 0x24]
inc edx
cmp edx, 8
jge 0x472100
movzx edi, byte [esp + edx + 0x24]
inc edx
jmp 0x472102
xor eax, eax
xor edi, edi
shl ecx, 8
add ecx, eax
shl ecx, 8
add ecx, edi
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x4ef148]
mov byte [esi], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x4ef148]
mov byte [esi + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + 0x4ef148]
mov byte [esi + 2], al
movzx eax, byte [ecx + 0x4ef148]
mov byte [esi + 3], al
add esi, 4
cmp edx, 8
jl 0x4720e0
mov eax, dword [esp + 0x14]
mov word [eax + 0xb], 0x3d
push dword [esp + 0x1c]
mov dword [esp + 0x30], eax
call dword [0x595de8]
push 0x680
push ecx
mov ecx, dword [esp + 0x14]
mov edx, 0xa
call fcn.004705c0
add esp, 8
mov esi, eax
mov dword [esp + 0x1c], esi
push 0xa
push 0x4f26f4
push 1
push 0
push str.ProgId
push esi
call dword [0x595d98]
mov dword [esp + 0x14], eax
test eax, eax
je 0x472264
call fcn.00493410
test eax, eax
je 0x472223
call fcn.00493410
cmp dword [eax], 0
je 0x472223
mov eax, dword [0x52e820]
test eax, eax
je 0x4721cf
mov edi, dword [eax + 0x190]
jmp 0x4721d5
mov edi, dword [0x52e824]
call fcn.00493410
test eax, eax
je 0x4721e7
call fcn.00493410
mov ebx, dword [eax]
jmp 0x4721e9
xor ebx, ebx
push str.Error_setting_key_value:_HKCU_sProgId:__s
push 0
push dword [esp + 0x1c]
call fcn.0047f8c0
add esp, 8
push eax
push dword [esp + 0x14]
push str.Error_setting_key_value:_HKCU_sProgId:__s
push dword [0x52e820]
push edi
push 0
push 0x683
push str.Misc.c
push 0x103
call ebx
add esp, 0x28
xor edi, edi
test esi, esi
je 0x472230
push esi
call dword [0x595de8]
cmp dword [esp + 0x10], 0
je 0x472344
lea eax, [esp + 0x10]
push eax
call fcn.0047e900
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [esp + 0x10]
call ebx
add esp, 4
mov dword [esp + 0x10], 0
jmp 0x47234a
mov edx, dword [esp + 0x2c]
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472270
sub ecx, edi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push str.Hash
push esi
call dword [0x595d98]
mov dword [esp + 0x14], eax
test eax, eax
je 0x472308
call fcn.00493410
test eax, eax
je 0x472223
call fcn.00493410
cmp dword [eax], 0
je 0x472223
mov eax, dword [0x52e820]
test eax, eax
je 0x4722be
mov edi, dword [eax + 0x190]
jmp 0x4722c4
mov edi, dword [0x52e824]
call fcn.00493410
test eax, eax
je 0x4722d6
call fcn.00493410
mov ebx, dword [eax]
jmp 0x4722d8
xor ebx, ebx
push str.Error_setting_key_value:_HKCU_sHash:__s
push 0
push dword [esp + 0x1c]
call fcn.0047f8c0
add esp, 8
push eax
push dword [esp + 0x14]
push str.Error_setting_key_value:_HKCU_sHash:__s
push dword [0x52e820]
push edi
push 0
push 0x687
jmp 0x472214
cmp byte [ebx], 0x2e
jne 0x47233a
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.cmd__c_ie4uinit.exe__ClearIconCache
call esi
push 0
push str.cmd__c_ie4uinit.exe__show
call esi
mov esi, dword [esp + 0x1c]
mov edi, 1
jmp 0x472225
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [esp + 0x20], 0
je 0x47236f
lea eax, [esp + 0x20]
push eax
call fcn.0047e900
add esp, 4
push dword [esp + 0x20]
call ebx
add esp, 4
mov dword [esp + 0x20], 0
cmp dword [esp + 0xc], 0
je 0x472394
lea eax, [esp + 0xc]
push eax
call fcn.0047e900
add esp, 4
push dword [esp + 0xc]
call ebx
add esp, 4
mov dword [esp + 0xc], 0
cmp dword [esp + 0x2c], 0
je 0x4723b1
lea eax, [esp + 0x2c]
push eax
call fcn.0047e900
add esp, 4
push dword [esp + 0x2c]
call ebx
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret