joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d1f
Capabilities:
Create directory

Disassembly:
push 0x40
mov eax, 0x50526e
call fcn.004dead8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406d28
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0044086a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00406d59
push edi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00406991
push 0x5c
push 0x2f
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004400b3
add esp, 0x10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00406d59
push edi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00406991
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x440da3
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00440495
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00406d59
push edi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00406991
or dword [ebp - 0x4c], 0xffffffff
push 2
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004089bb
mov ebx, eax
mov esi, 0x5168ec
push esi
mov byte [ebp - 4], 4
call fcn.004df380
pop ecx
push eax
push esi
push dword [ebx + 0x10]
mov ecx, ebx
push edi
call fcn.004086e6
mov ebx, eax
neg ebx
sbb bl, bl
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00406991
inc bl
je 0x440e54
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
jbe 0x440e39
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040fc83
cmp word [eax], 0x5c
jne 0x440e36
inc ebx
cmp ebx, dword [ebp - 0x1c]
jb 0x440e1f
jmp 0x440e39
mov dword [ebp - 0x4c], ebx
mov ebx, 0x50bac0
push ebx
call fcn.004df380
pop ecx
push eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
push ebx
call fcn.004068f2
jmp 0x440e57
mov eax, dword [ebp - 0x4c]
push esi
inc eax
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c], 0x5c
call fcn.004068f2
mov ebx, eax
cmp ebx, 0xffffffff
je 0x440ed8
mov dword [ebp - 0x4c], 0x5c
push ebx
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004089bb
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x440e95
lea eax, [ebp - 0x48]
push eax
call fcn.0043fdf3
pop ecx
test al, al
jne 0x440eb8
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x440eac
lea eax, [ebp - 0x48]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x440edc
push edi
push esi
lea ecx, [ebp - 0x48]
call fcn.00406991
push esi
inc ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004068f2
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x440e7b
xor ebx, ebx
jmp 0x440efc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x440ef0
and eax, 0xffff
or eax, 0x80070000
push edi
push esi
lea ecx, [ebp - 0x48]
mov ebx, eax
call fcn.00406991
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.00406991
mov eax, ebx
call fcn.004deb5b
ret
Function at 0x44138b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5493b1], 0
jne 0x4413ed
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.004de430
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov byte [0x5493b1], 1
sbb al, al
inc al
mov byte [0x5493b0], al
jmp 0x4413f2
mov al, byte [0x5493b0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dea60
leave
ret

Function at 0x4413fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x828], eax
test esi, esi
je 0x441581
cmp word [esi], 0
je 0x441581
push esi
push str.RunProcess:__s.
mov ebx, str.kupdate::KProcessUtils::RunProcess
push ebx
push 0x15c
mov edi, str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push edi
push 7
call fcn.004081cf
push 0x820
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004de430
push esi
lea eax, [ebp - 0x824]
push 0x40f
push eax
call fcn.004e3228
lea eax, [ebp - 0x824]
push str._fromminisite
push eax
call fcn.004e07eb
push 0x38
xor esi, esi
lea eax, [ebp - 0x864]
push esi
push eax
mov dword [ebp - 0x868], 0x3c
call fcn.004de430
add esp, 0x44
mov dword [ebp - 0x864], 0x500
cmp dword [ebp - 0x828], esi
je 0x4414c9
mov dword [ebp - 0x864], 0x540
lea eax, [ebp - 0x824]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x868]
push eax
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x860], esi
mov dword [ebp - 0x85c], str.open
mov dword [ebp - 0x84c], 1
mov dword [ebp - 0x848], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x441549
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x44152c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x516a74
push ebx
push 0x16f
push edi
push 0
call fcn.004081cf
add esp, 0x18
mov eax, esi
jmp 0x4415a4
cmp dword [ebp - 0x828], esi
je 0x44157d
push 0xffffffffffffffff
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x828]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4415a4
push str.Invalid_Arg.
push str.kupdate::KProcessUtils::RunProcess
push 0x158
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push 0
call fcn.004081cf
add esp, 0x14
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dea60
leave
ret
Function at 0x4415b3
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push 0x20
push 2
push eax
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x44162f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x44160c
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_allocate_sid:_0x_08x.
push str.kupdate::KProcessUtils::IsUserInGroup
push 0x1aa
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push 5
call fcn.004081cf
add esp, 0x18
xor al, al
jmp 0x441688
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x441677
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x441655
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_check_token_group:_0x_08x.
push str.kupdate::KProcessUtils::IsUserInGroup
push 0x1b0
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push 5
call fcn.004081cf
add esp, 0x18
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 0x10], ebx
setne al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004dea60
leave
ret
Function at 0x441696
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push edi
push 1
push dword [ebp + 8]
mov dword [ebp - 8], edi
call esi
push dword [ebp - 8]
call fcn.004dc6d3
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 1
push dword [ebp + 8]
call esi
test eax, eax
jne 0x441705
push ebx
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x4416f0
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.kupdate::KProcessUtils::IsSameUser
push 0x1f3
jmp 0x441812
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x4417e7
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4417e7
lea eax, [ebp - 8]
push eax
push edi
push edi
push 1
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
call esi
push dword [ebp - 8]
call fcn.004dc6d3
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 1
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x441786
push edi
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44176a
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.kupdate::KProcessUtils::IsSameUser
push 0x206
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push 0
jmp 0x441818
mov esi, dword [edi]
test esi, esi
je 0x4417ba
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x4417ba
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
push ebx
setne byte [ebp - 1]
call fcn.004de5b0
push edi
call fcn.004de5b0
mov al, byte [ebp - 1]
pop ecx
pop ecx
jmp 0x441822
push edi
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4417d5
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSameUser
push 0x20d
jmp 0x44177a
push ebx
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x441802
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSameUser
push 0x1fa
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push edi
call fcn.004081cf
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x441a9a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.004de430
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x441b0a
xor eax, eax
inc eax
cmp byte [ebp - 6], al
jne 0x441af3
cmp dword [ebp - 0x118], eax
je 0x441afe
cmp dword [ebp - 0x118], 2
jae 0x441afe
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dea60
leave
ret
jbe 0x441afc
mov al, 1
jmp 0x441afe
Function at 0x441c44
Capabilities:
Compare security identifiers

Disassembly:
push 0x1c
mov eax, 0x505416
call fcn.004dead8
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jne 0x441c5f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0x20008
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x441ca2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x441c8d
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_open_process_token:_0x08x.
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1c0
jmp 0x441dd9
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
call esi
push dword [ebp - 0x24]
call fcn.004dc6d3
pop ecx
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push edi
push 1
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x441d06
push edi
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x441cf1
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1ca
jmp 0x441dd9
mov esi, dword [edi]
cmp esi, ebx
je 0x441dae
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x441dae
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x441d75
push edi
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x441d63
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_allocate_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1dc
jmp 0x441dd9
push dword [ebp - 0x28]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x28]
test eax, eax
setne byte [ebp - 0x1d]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push edi
call fcn.004de5b0
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x441da9
cmp dword [ebp - 0x1c], 0xffffffff
je 0x441da9
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x1d]
jmp 0x441dfd
push edi
call fcn.004de5b0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x441dc9
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1d1
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push ebx
call fcn.004081cf
add esp, 0x18
cmp dword [ebp - 0x1c], ebx
je 0x441dfb
cmp dword [ebp - 0x1c], 0xffffffff
je 0x441dfb
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.004deb5b
ret
Function at 0x44203b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp esi, ebx
je 0x442169
cmp word [esi], bx
je 0x442169
cmp edi, ebx
je 0x442169
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.004de430
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp eax, 0xffffffff
jne 0x4420d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4420b8
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x6f
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push ebx
call fcn.004081cf
add esp, 0x18
jmp 0x442183
lea ecx, [ebp - 0x230]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x442122
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004e2ef7
pop ecx
pop ecx
test eax, eax
jne 0x44210a
lea eax, [ebp - 0x228]
push eax
mov ecx, edi
call fcn.0042ae0e
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4420e9
jmp 0x442151
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x442136
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x7c
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push ebx
call fcn.004081cf
add esp, 0x18
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
xor ecx, ecx
cmp eax, dword [edi + 4]
setne al
jmp 0x442185
push 0x5163c8
push str.kupdate::KProcessUtils::GetProcessPid
push 0x66
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push ebx
call fcn.004081cf
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dea60
leave
ret
Function at 0x4423b9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor esi, esi
cmp eax, dword [edi + 4]
je 0x442509
cmp ebx, esi
je 0x442509
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.004de430
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
jne 0x442453
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x442430
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::IsProcessExists
push 0x92
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push esi
call fcn.004081cf
add esp, 0x18
jmp 0x442526
lea ecx, [ebp - 0x230]
push ecx
push eax
mov byte [ebp - 0x231], 0
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4424c3
mov esi, dword [edi]
jmp 0x442491
cmp dword [esi + 0x14], 8
jb 0x442479
mov eax, dword [esi]
jmp 0x44247b
mov eax, esi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004e2ef7
pop ecx
pop ecx
test eax, eax
je 0x442498
add esi, 0x1c
cmp esi, dword [edi + 4]
jne 0x44246f
jmp 0x4424ab
push 0xffffffffffffffff
push 0
push esi
mov ecx, ebx
mov byte [ebp - 0x231], 1
call fcn.00406c0f
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x238]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x44246b
jmp 0x4424f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x4424d7
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::IsProcessExists
push 0xaa
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push esi
call fcn.004081cf
add esp, 0x18
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x231]
jmp 0x442528
push 0x5163c8
push str.kupdate::KProcessUtils::IsProcessExists
push 0x89
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push esi
call fcn.004081cf
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dea60
leave
ret
Function at 0x442537
Capabilities:
Get process image filename

Disassembly:
push 0x214
mov eax, 0x5054ae
call fcn.004dead8
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x220], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.004087da
test al, al
jne 0x4425d9
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004de430
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4425d9
lea eax, [ebp - 0x21c]
push eax
call fcn.004df380
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.00406caa
test esi, esi
je 0x4425d5
cmp esi, 0xffffffff
je 0x4425d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4425eb
test esi, esi
je 0x4425e9
cmp esi, 0xffffffff
je 0x4425e9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.004deb5b
ret

Function at 0x4425f1
Capabilities:
Check os version

Disassembly:
push 0x128
mov eax, 0x5054f8
call fcn.004dead8
mov edi, dword [ebp + 8]
xor esi, esi
push str.win98
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], esi
call fcn.00406d28
push 0x118
lea eax, [ebp - 0x128]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x12c], 0x11c
call fcn.004de430
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 5
jne 0x442684
mov eax, dword [ebp - 0x124]
sub eax, esi
je 0x44267d
dec eax
je 0x442676
mov esi, str.2003
jmp 0x4426c0
mov esi, 0x5169a0
jmp 0x4426c0
mov esi, str.2000
jmp 0x4426c0
cmp dword [ebp - 0x128], 6
jne 0x4426b9
cmp byte [ebp - 0x12], 1
je 0x44269a
mov esi, str.2008
jmp 0x4426c0
cmp dword [ebp - 0x124], esi
jne 0x4426a9
mov esi, str.vista
jmp 0x4426c0
cmp dword [ebp - 0x124], 1
jne 0x4426bb
mov esi, str.win7
jmp 0x4426c0
jbe 0x4426d0
mov esi, str.win8
push esi
call fcn.004df380
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00406caa
cmp dword [edi + 0x14], 8
jb 0x4426da
mov eax, dword [edi]
jmp 0x4426dc
mov eax, edi
push eax
push str.OS_Version_Result:__s.
push str.kupdate::KProcessUtils::GetWinVersion
push 0x33f
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKProcessUtils.cpp
push 7
call fcn.004081cf
add esp, 0x18
mov eax, edi
call fcn.004deb5b
ret
Function at 0x443160
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x48
mov eax, 0x50561d
call fcn.004dead8
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406d28
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00442ee4
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004430a3
add esp, 0xc
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c], edi
jae 0x4431ae
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push ecx
push 0x20019
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x44320c
jle 0x4431d0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push str.Failed_RegOpenKeyEx:_0x_08x.
push str.kupdate::KRegistry::ReadStr
push 0x69
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKRegistry.cpp
push 5
call fcn.004081cf
add esp, 0x18
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00406991
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406991
mov eax, esi
call fcn.004deb5b
ret
mov eax, dword [ebp + 0x10]
add eax, eax
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], edi
jae 0x443223
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x54]
push ecx
push esi
lea ecx, [ebp - 0x50]
push ecx
push edi
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x443266
jle 0x443254
and esi, 0xffff
or esi, 0x80070000
push esi
push str.Failed_RegQueryValueEx:_0x_08x.
push str.kupdate::KRegistry::ReadStr
push 0x74
jmp 0x4431df
xor esi, esi
jmp 0x4431ee
Function at 0x44326a
Capabilities:
Set registry value

Disassembly:
push 0x44
mov eax, 0x5025bf
call fcn.004dead8
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406d28
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00442ee4
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004430a3
add esp, 0xc
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
jae 0x4432bb
lea eax, [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x50]
push ecx
push esi
push 0x20006
push esi
push esi
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x44331c
jle 0x4432e1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push str.Failed_RegCreateKeyEx:_0x_08x.
push str.kupdate::KRegistry::WriteStr
push 0x89
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKRegistry.cpp
push 5
call fcn.004081cf
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00406991
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406991
mov eax, edi
jmp 0x44339a
cmp dword [ebp - 0x34], 8
mov ebx, dword [ebp - 0x48]
jae 0x443328
lea ebx, [ebp - 0x48]
push edi
call fcn.004df380
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x50]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x443381
jle 0x44335f
and edi, 0xffff
or edi, 0x80070000
push edi
push str.Failed_RegSetValueEx:_0x_08x.
push str.kupdate::KRegistry::WriteStr
push 0x93
push str.D:_fun_pow_4_20190808Coding_supportminisite_srcutilKRegistry.cpp
push 5
mov dword [ebp - 0x4c], edi
call fcn.004081cf
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.00406991
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406991
mov eax, dword [ebp - 0x4c]
call fcn.004deb5b
ret