joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f4e3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 0x10], ebx
jne 0x46f4f8
xor eax, eax
pop edi
pop ebx
leave
ret
mov eax, dword [esi + 0x1c]
xor ecx, ecx
add eax, dword [esi + 0x90]
push ebx
adc ecx, dword [esi + 0x94]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi + 0x78]
push eax
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46f540
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.00470055
push 2
pop eax
jmp 0x46f4f4
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.00447480
mov byte [ebp - 0x1c], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [esi + 0x10], ebx
jbe 0x46f613
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x78]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0x18
lea ecx, [ebp - 0x38]
push ecx
push eax
call edi
test eax, eax
je 0x46f61c
cmp dword [ebp - 0xc], ebx
je 0x46f61c
cmp dword [ebp - 4], ebx
je 0x46f5a6
push dword [ebp - 4]
call fcn.004b3fe5
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 4]
inc eax
push ecx
call fcn.00470662
test al, al
je 0x46f617
mov eax, dword [esi + 0x78]
push ebx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, ecx
push ecx
push dword [ebp - 4]
push eax
call edi
test eax, eax
je 0x46f61c
cmp dword [ebp - 0xc], ebx
je 0x46f61c
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
xor eax, eax
mov word [edx + ecx*2], ax
lea eax, [ebp - 0x38]
lea ebx, [esi + 0x6c]
push eax
call fcn.004706ef
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.00470789
push dword [ebp - 4]
add eax, 0x18
push eax
call fcn.00405499
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ebx, ebx
cmp eax, dword [esi + 0x10]
jb 0x46f573
xor edi, edi
jmp 0x46f636
push 3
pop edi
jmp 0x46f636
push 2
pop edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x54]
push ecx
push 0x103
push esi
mov ebx, eax
call fcn.00470055
push dword [ebp - 4]
call fcn.004b3fe5
pop ecx
lea ecx, [ebp - 0x20]
call fcn.004029ae
mov eax, edi
jmp 0x46f4f4
Function at 0x46f64e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
cmp dword [edi + 0x9c], ebx
push esi
jle 0x46f667
xor eax, eax
jmp 0x46f7cd
mov eax, dword [edi + 0xc]
xor ecx, ecx
add eax, dword [edi + 0x90]
push ebx
adc ecx, dword [edi + 0x94]
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [edi + 0x78]
push eax
push ecx
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46f6b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 0x54]
push ecx
push 0x103
push edi
mov ebx, eax
call fcn.00470055
push 2
pop eax
jmp 0x46f7cd
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
cmp dword [edi + 8], ebx
jbe 0x46f7c2
mov eax, dword [edi + 0x78]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [ebp - 8]
push ecx
push 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call esi
test eax, eax
je 0x46f7a8
cmp dword [ebp - 8], ebx
je 0x46f7a8
lea eax, [ebp - 0x1c]
push eax
call fcn.00447480
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], ebx
je 0x46f70f
push dword [ebp - 4]
call fcn.004b3fe5
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
inc eax
push ecx
call fcn.00470662
test al, al
je 0x46f77b
mov eax, dword [edi + 0x78]
push ebx
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, ecx
push ecx
push dword [ebp - 4]
push eax
call esi
test eax, eax
je 0x46f787
cmp dword [ebp - 8], ebx
je 0x46f787
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
push eax
mov word [eax + edx*2], cx
lea eax, [ebp - 0x1c]
push eax
call fcn.00405499
lea esi, [edi + 0x98]
lea ebx, [ebp - 0x1c]
call fcn.004837a8
mov ecx, ebx
call fcn.004029ae
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor ebx, ebx
cmp eax, dword [edi + 8]
jb 0x46f6c7
jmp 0x46f7c2
lea ecx, [ebp - 0x1c]
call fcn.004029ae
push 3
jmp 0x46f7c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 0x54]
push ecx
push 0x103
push edi
mov ebx, eax
call fcn.00470055
lea ecx, [ebp - 0x1c]
call fcn.004029ae
jmp 0x46f7bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 0x54]
push ecx
push 0x103
push edi
mov ebx, eax
call fcn.00470055
push 2
pop ebx
push dword [ebp - 4]
call fcn.004b3fe5
pop ecx
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x470eaa
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00447480
movzx ebx, word [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0x4ed604
push 2
push ebx
call edi
mov esi, eax
lea eax, [esi - 1]
push eax
push 0x78
pop ecx
lea edx, [ebp - 4]
call fcn.00439db6
push esi
lea esi, [ebp - 4]
call fcn.00412dd9
push eax
push 2
push ebx
call edi
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x4f8858
push dword [ebp + 8]
call fcn.0044c153
add esp, 0x10
mov ecx, esi
call fcn.004029ae
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4712fe
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x471385
push esi
call fcn.004b0190
mov edi, eax
pop ecx
test edi, edi
jne 0x47133d
push 8
pop esi
push edi
call fcn.004b3fe5
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x471385
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4f6654
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47138e
cmp dword [ebp - 0x10], 0
je 0x47138e
mov eax, dword [ebp - 8]
test ebx, ebx
je 0x471377
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x47138e
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
jmp 0x47138e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
jmp 0x471330

Function at 0x471640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 0xc8
xor ebx, ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b0190
pop ecx
mov esi, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push esi
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x471692
inc dword [ebp - 4]
jmp 0x471653
cmp eax, ebx
jne 0x4716b4
cmp dword [ebp - 8], 1
je 0x4716c2
cmp dword [ebp - 8], 4
jne 0x471653
push dword [esi]
push 0x4f8968
push edi
call fcn.0044c153
add esp, 0xc
mov bl, 1
push esi
call fcn.004b3fe5
mov al, bl
pop ecx
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [esi + ecx*2], ax
push esi
lea eax, [ebp + 0xc]
push eax
call fcn.004054bc
call fcn.00439ecc
lea ecx, [ebp + 0xc]
call fcn.004029ae
push esi
call fcn.004b3fe5
mov al, 1
jmp 0x4716bc
Function at 0x4718d2
Capabilities:
Get file size

Disassembly:
mov eax, dword [eax]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x471901
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x471919
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test esi, esi
je 0x471917
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x471a7e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
mov dword [ebp - 0x64], 0x44
call fcn.004b4140
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], bl
cmp byte [ebp + 0x18], bl
je 0x471abd
lea esi, [ebp - 0xc]
call fcn.00482d5b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [edx - 0xc]
neg ecx
sbb ecx, ecx
and ecx, edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x64]
push edx
push ebx
push ebx
push dword [ebp + 0x14]
push ebx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x471b04
lea esi, [ebp - 0xc]
call fcn.00482d3f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
cmp dword [ebp + 0x10], ebx
je 0x471b20
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x471af5
Function at 0x471b2d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push 0x38
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.004b4140
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x400
cmp dword [ebp + 0xc], ebx
je 0x471b62
mov dword [ebp - 0x3c], 0x440
push edi
mov edi, dword [esi]
mov ecx, esi
call fcn.004607a0
test al, al
je 0x471b73
add edi, 8
xor eax, eax
cmp byte [ebp + 0x10], bl
mov dword [ebp - 0x30], edi
sete al
mov dword [ebp - 0x34], 0x4f137c
pop edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
je 0x471b96
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 4]
push eax
call fcn.0045f630
mov esi, dword [ebp - 4]
pop ecx
lea ecx, [ebp - 4]
call fcn.004607a0
test al, al
je 0x471bb2
add esi, 8
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x471bd1
lea ecx, [ebp - 4]
call fcn.004029ae
pop esi
mov al, bl
pop ebx
leave
ret
cmp dword [ebp + 0xc], ebx
je 0x471bf2
cmp dword [ebp - 8], ebx
je 0x471bf2
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
jmp 0x471bc3
Function at 0x471e2c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
xor edi, edi
push 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x471e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x471f38
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push 1
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x471eb8
call ebx
cmp eax, 0x7a
jne 0x471f2d
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
call fcn.00444a35
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x18]
call esi
cmp eax, edi
je 0x471f2d
cmp dword [ebp - 0x1c], edi
je 0x471f2d
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x471f2f
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x20]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x10]
call fcn.004b3fe5
pop ecx
cmp dword [ebp - 0x18], edi
je 0x471f29
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x471f48
call ebx
push dword [ebp - 0x10]
call fcn.004b3fe5
pop ecx
cmp dword [ebp - 0x18], edi
je 0x471f46
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1fae
leave
ret

Function at 0x471f57
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x471f7e
push eax
jmp 0x471fb8
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x471faf
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp + 8]
je 0x471fcd
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x471f97
test esi, esi
je 0x471fbe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b1fae
leave
ret
push edi
mov edi, dword [ebp - 0x228]
test esi, esi
je 0x471fdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
jmp 0x471fc0
Function at 0x4722cd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 3
push SysReAllocStringLen
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
lea ecx, [ebp - 0x410]
push ecx
mov ebx, 0x3ff
push ebx
lea ecx, [ebp - 0x40c]
push ecx
mov dword [ebp - 0x410], edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x41c], eax
push eax
jmp 0x47235e
mov eax, dword [ebp - 0x410]
mov byte [ebp + eax - 0x40c], 0
lea eax, [ebp - 0x40c]
push eax
call fcn.004615b0
push 0
lea eax, [ebp - 0x410]
push eax
push ebx
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x41c]
call edi
cmp dword [ebp - 0x410], 0
jne 0x47232d
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x472395
lea ecx, [eax - 2]
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.0043b439
mov edi, esi
call fcn.00439ecc
lea ecx, [ebp - 0x414]
call fcn.004029ae
cmp dword [ebp - 0x41c], 0
je 0x4723aa
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b1fae
leave
ret
Function at 0x47321b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push edi
push eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4732ab
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004054bc
lea ebx, [ebp - 0x7c]
call fcn.0045e2c0
inc dword [ebp - 0x74]
mov ecx, ebx
call fcn.004029ae
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x473268
pop ebx
mov ecx, dword [ebp + 0x198]
pop edi
xor ecx, ebp
pop esi
call fcn.004b1fae
add ebp, 0x19c
leave
ret 4

Function at 0x4732c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov esi, eax
mov eax, dword [ebx]
push 0
push eax
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp eax, 0xea
jne 0x473326
push dword [ebp - 4]
call fcn.00402919
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
call fcn.00412dd9
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.00402961
xor eax, eax
cmp dword [ebp - 8], eax
pop edi
pop esi
setne al
pop ebx
leave
ret

Function at 0x473b7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push edi
push dword [ebp + 8]
lea edi, [esi + 4]
mov eax, edi
call fcn.00440b48
xor eax, eax
cmp byte [esi + 0xc], al
je 0x473ba2
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x473bc6
cmp dword [edi], eax
je 0x473bc6
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push 0x473bea
push eax
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esi, 0x10
mov edi, eax
call fcn.004199db
pop edi
pop esi
pop ebp
ret 4
Function at 0x473e9f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov esi, eax
push 0x4f9830
lea eax, [ebp - 4]
push eax
call fcn.004054bc
lea edi, [esi + 0x1c]
lea ecx, [ebp - 4]
call fcn.0045fe00
lea ecx, [ebp - 4]
call fcn.004029ae
lea ebx, [esi + 4]
push ebx
lea esi, [ebp - 8]
call fcn.00483fab
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
pop ecx
je 0x473f07
mov edi, dword [edi]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
mov ecx, esi
inc bl
call fcn.004029ae
mov al, bl
jmp 0x473f8f
push 0x52655c
push edi
xor eax, eax
lea esi, [ebp - 0x98]
call fcn.0047ea49
push 1
push 0
push edi
push ebx
mov ecx, esi
call fcn.0047eb8a
mov ebx, eax
test ebx, ebx
je 0x473f77
cmp byte [0x5283d4], 0
je 0x473f77
lea eax, [ebp - 0xc]
push eax
call fcn.0045f0c0
pop ecx
push dword [eax]
lea eax, [ebp - 4]
push str.Downloading_of_updates_failed._Error:
push eax
call fcn.0047845f
push eax
call fcn.0047846f
push eax
call fcn.0047846f
push eax
mov eax, 0x5283a4
call fcn.00477894
lea ecx, [ebp - 4]
call fcn.004029ae
lea ecx, [ebp - 0xc]
call fcn.004029ae
lea esi, [ebp - 0x98]
call fcn.0047eae9
lea ecx, [ebp - 8]
call fcn.004029ae
test ebx, ebx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x475250
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x30]
push esi
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
jne 0x475270
mov al, 1
jmp 0x47545d
call fcn.0045e600
test al, al
je 0x47535e
push 0x3c
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.004b4140
add esp, 0xc
push str.kernel32.dll
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.GlobalMemoryStatusEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x5c]
push ecx
call eax
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x30]
call fcn.0045efd0
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
fild qword [ebp - 0x1c]
mov dword [ebp - 0xc], edi
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x504600]
fldz
fcom st(1)
fnstsw ax
fld st(1)
test ah, 5
jp 0x47531b
call fcn.004d0a60
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld st(2)
fsubrp st(1)
fcompp
fnstsw ax
test ah, 0x41
jne 0x475340
fadd qword [0x504588]
jmp 0x475339
call fcn.004d0a60
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld st(2)
fsubrp st(1)
fcompp
fnstsw ax
test ah, 5
jp 0x475340
fsub qword [0x504588]
call fcn.004d0a60
jmp 0x475345
mov eax, dword [ebp - 8]
fstp st(0)
cdq
mov ebx, eax
mov edi, edx
test esi, esi
je 0x4753f9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4753f9
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x30]
call fcn.0045efd0
fild dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
test eax, eax
jge 0x475397
fadd qword [0x504580]
fmul qword [0x504600]
fldz
fcom st(1)
fnstsw ax
fld st(1)
test ah, 5
jp 0x4753ca
call fcn.004d0a60
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld st(2)
fsubrp st(1)
fcompp
fnstsw ax
test ah, 0x41
jne 0x4753ef
fadd qword [0x504588]
jmp 0x4753e8
call fcn.004d0a60
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld st(2)
fsubrp st(1)
fcompp
fnstsw ax
test ah, 5
jp 0x4753ef
fsub qword [0x504588]
call fcn.004d0a60
jmp 0x4753f4
mov eax, dword [ebp - 8]
fstp st(0)
cdq
mov ebx, eax
mov edi, edx
cmp byte [0x5283d4], 0
je 0x475431
push edi
push ebx
push str.Detected_RAM_amount:
lea eax, [ebp - 8]
push eax
call fcn.0047845f
push eax
call fcn.0047846f
push eax
call fcn.00478564
push eax
mov eax, 0x5283a4
call fcn.00477894
lea ecx, [ebp - 8]
call fcn.004029ae
mov eax, dword [ebp - 0x10]
cdq
cmp edi, edx
jb 0x475447
ja 0x475269
cmp ebx, eax
jae 0x475269
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
add eax, 0x30
push eax
push 0xd4
call fcn.0047558d
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4