joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d285
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push 0x20
push 2
push eax
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x47d301
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47d2de
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_allocate_sid:_0x_08x.
push str.kupdate::KProcessUtils::IsUserInGroup
push 0x1bd
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push 5
call fcn.0042f683
add esp, 0x18
xor al, al
jmp 0x47d35a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x47d349
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47d327
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_check_token_group:_0x_08x.
push str.kupdate::KProcessUtils::IsUserInGroup
push 0x1c3
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push 5
call fcn.0042f683
add esp, 0x18
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 0x10], ebx
setne al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret
Function at 0x47d368
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push edi
push 1
push dword [ebp + 8]
mov dword [ebp - 8], edi
call esi
push dword [ebp - 8]
call fcn.004912f9
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 1
push dword [ebp + 8]
call esi
test eax, eax
jne 0x47d3d7
push ebx
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x47d3c2
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.kupdate::KProcessUtils::IsSameUser
push 0x206
jmp 0x47d4e4
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x47d4b9
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x47d4b9
lea eax, [ebp - 8]
push eax
push edi
push edi
push 1
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
call esi
push dword [ebp - 8]
call fcn.004912f9
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 1
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x47d458
push edi
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x47d43c
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.kupdate::KProcessUtils::IsSameUser
push 0x219
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push 0
jmp 0x47d4ea
mov esi, dword [edi]
test esi, esi
je 0x47d48c
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x47d48c
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
push ebx
setne byte [ebp - 1]
call fcn.004926f3
push edi
call fcn.004926f3
mov al, byte [ebp - 1]
pop ecx
pop ecx
jmp 0x47d4f4
push edi
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x47d4a7
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSameUser
push 0x220
jmp 0x47d44c
push ebx
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x47d4d4
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSameUser
push 0x20d
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push edi
call fcn.0042f683
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47d76c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x120], 0x11c
call fcn.00492b40
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x47d7dc
xor eax, eax
inc eax
cmp byte [ebp - 6], al
jne 0x47d7c5
cmp dword [ebp - 0x118], eax
je 0x47d7d0
cmp dword [ebp - 0x118], 2
jae 0x47d7d0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004927bf
leave
ret
jbe 0x47d7ce
mov al, 1
jmp 0x47d7d0
Function at 0x47d9f9
Capabilities:
Compare security identifiers

Disassembly:
push 0x1c
mov eax, 0x4b966f
call fcn.004935c5
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jne 0x47da14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
push ecx
push 0x20008
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x47da57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47da42
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_open_process_token:_0x08x.
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1d3
jmp 0x47db8e
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
call esi
push dword [ebp - 0x24]
call fcn.004912f9
pop ecx
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push edi
push 1
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x47dabb
push edi
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47daa6
and eax, 0xffff
or eax, 0x80070000
push eax
push str.failed_get_token_infomation:
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1dd
jmp 0x47db8e
mov esi, dword [edi]
cmp esi, ebx
je 0x47db63
push esi
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x47db63
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x47db2a
push edi
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47db18
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_allocate_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1ef
jmp 0x47db8e
push dword [ebp - 0x28]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x28]
test eax, eax
setne byte [ebp - 0x1d]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push edi
call fcn.004926f3
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x47db5e
cmp dword [ebp - 0x1c], 0xffffffff
je 0x47db5e
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x1d]
jmp 0x47dbb2
push edi
call fcn.004926f3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47db7e
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_get_sid:_0x08x.
push str.kupdate::KProcessUtils::IsSystemProcess
push 0x1e4
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push ebx
call fcn.0042f683
add esp, 0x18
cmp dword [ebp - 0x1c], ebx
je 0x47dbb0
cmp dword [ebp - 0x1c], 0xffffffff
je 0x47dbb0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.00493648
ret
Function at 0x47df5f
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
push edi
push str.Restart_computer.
mov edi, str.kupdate::KProcessUtils::RestartComputer
push edi
push 0x2e1
mov esi, str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push esi
push 7
call fcn.0042f683
push 1
push str.SeShutdownPrivilege
call fcn.0047ddf0
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jns 0x47dfaf
push ebx
push str.Failed_ajust_privilege:_0x_08x.
push edi
push 0x2e5
push esi
push 0
call fcn.0042f683
add esp, 0x18
mov eax, ebx
jmp 0x47dfe3
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x47dfe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x47dfd1
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
push ebx
push str.Failed_exit_window:_0x_08x.
push edi
push 0x2eb
jmp 0x47dfa0
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x47e0cc
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp esi, ebx
je 0x47e1fa
cmp word [esi], bx
je 0x47e1fa
cmp edi, ebx
je 0x47e1fa
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.00492b40
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp eax, 0xffffffff
jne 0x47e169
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47e149
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x70
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push ebx
call fcn.0042f683
add esp, 0x18
jmp 0x47e214
lea ecx, [ebp - 0x230]
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47e1b3
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00495444
pop ecx
pop ecx
test eax, eax
jne 0x47e19b
lea eax, [ebp - 0x228]
push eax
mov ecx, edi
call fcn.00471cfb
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47e17a
jmp 0x47e1e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47e1c7
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x7d
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push ebx
call fcn.0042f683
add esp, 0x18
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
xor ecx, ecx
cmp eax, dword [edi + 4]
setne al
jmp 0x47e216
push str.Invalid_Args.
push str.kupdate::KProcessUtils::GetProcessPid
push 0x67
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push ebx
call fcn.0042f683
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret
Function at 0x47e499
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor esi, esi
cmp eax, dword [edi + 4]
je 0x47e5e9
cmp ebx, esi
je 0x47e5e9
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.00492b40
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
jne 0x47e533
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x47e510
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::IsProcessExists
push 0x93
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push esi
call fcn.0042f683
add esp, 0x18
jmp 0x47e606
lea ecx, [ebp - 0x230]
push ecx
push eax
mov byte [ebp - 0x231], 0
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47e5a3
mov esi, dword [edi]
jmp 0x47e571
cmp dword [esi + 0x14], 8
jb 0x47e559
mov eax, dword [esi]
jmp 0x47e55b
mov eax, esi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00495444
pop ecx
pop ecx
test eax, eax
je 0x47e578
add esi, 0x1c
cmp esi, dword [edi + 4]
jne 0x47e54f
jmp 0x47e58b
push 0xffffffffffffffff
push 0
push esi
mov ecx, ebx
mov byte [ebp - 0x231], 1
call fcn.0042e374
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x238]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47e54b
jmp 0x47e5d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x47e5b7
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::IsProcessExists
push 0xab
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push esi
call fcn.0042f683
add esp, 0x18
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x231]
jmp 0x47e608
push str.Invalid_Args.
push str.kupdate::KProcessUtils::IsProcessExists
push 0x8a
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push esi
call fcn.0042f683
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret
Function at 0x47e639
Capabilities:
Get process image filename

Disassembly:
push 0x214
mov eax, 0x4b978b
call fcn.004935c5
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x220], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.0047b7a6
test al, al
jne 0x47e6db
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.00492b40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x47e6db
lea eax, [ebp - 0x21c]
push eax
call fcn.00493091
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call fcn.0042e40f
test esi, esi
je 0x47e6d7
cmp esi, 0xffffffff
je 0x47e6d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x47e6ed
test esi, esi
je 0x47e6eb
cmp esi, 0xffffffff
je 0x47e6eb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.00493648
ret
Function at 0x47eaa4
Capabilities:
Check os version

Disassembly:
push 0x128
mov eax, 0x4b9866
call fcn.004935c5
mov edi, dword [ebp + 8]
xor esi, esi
push str.win98
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], esi
call fcn.0042e48d
push 0x118
lea eax, [ebp - 0x128]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x12c], 0x11c
call fcn.00492b40
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 5
jne 0x47eb37
mov eax, dword [ebp - 0x124]
sub eax, esi
je 0x47eb30
dec eax
je 0x47eb29
mov esi, str.2003
jmp 0x47eb73
mov esi, 0x4d0c14
jmp 0x47eb73
mov esi, str.2000
jmp 0x47eb73
cmp dword [ebp - 0x128], 6
jne 0x47eb6c
cmp byte [ebp - 0x12], 1
je 0x47eb4d
mov esi, str.2008
jmp 0x47eb73
cmp dword [ebp - 0x124], esi
jne 0x47eb5c
mov esi, str.vista
jmp 0x47eb73
cmp dword [ebp - 0x124], 1
jne 0x47eb6e
mov esi, str.win7
jmp 0x47eb73
jbe 0x47eb83
mov esi, str.win8
push esi
call fcn.00493091
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0042e40f
cmp dword [edi + 0x14], 8
jb 0x47eb8d
mov eax, dword [edi]
jmp 0x47eb8f
mov eax, edi
push eax
push str.OS_Version_Result:__s.
push str.kupdate::KProcessUtils::GetWinVersion
push 0x352
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push 7
call fcn.0042f683
add esp, 0x18
mov eax, edi
call fcn.00493648
ret
Function at 0x47ebb6
Capabilities:
Enumerate processes

Disassembly:
push 0x258
mov eax, 0x4b9896
call fcn.004935c5
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x264], eax
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jne 0x47ebfd
push str.Invalid_Args.
push str.kupdate::KProcessUtils::IsProcessExists
push 0xb8
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push 0
call fcn.0042f683
add esp, 0x14
xor al, al
jmp 0x47ed5a
push 0x228
xor ebx, ebx
lea eax, [ebp - 0x254]
push ebx
push eax
mov dword [ebp - 0x258], 0x22c
call fcn.00492b40
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x260], eax
cmp eax, 0xffffffff
jne 0x47ec65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47ec45
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_CreateToolhelp32Snapshot:_0x_08x.
push str.kupdate::KProcessUtils::IsProcessExists
push 0xc1
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push ebx
call fcn.0042f683
add esp, 0x18
jmp 0x47ebf6
lea ecx, [ebp - 0x258]
push ecx
push eax
mov byte [ebp - 0x259], bl
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47ed16
mov esi, dword [edi]
jmp 0x47eca6
cmp dword [esi + 0x14], 8
jb 0x47ec8e
mov eax, dword [esi]
jmp 0x47ec90
mov eax, esi
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00495444
pop ecx
pop ecx
test eax, eax
je 0x47ecad
add esi, 0x1c
cmp esi, dword [edi + 4]
jne 0x47ec84
jmp 0x47ecfa
xor eax, eax
mov byte [ebp - 0x259], 1
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x250]
mov dword [ebp - 4], ebx
call fcn.0047e639
pop ecx
pop ecx
test al, al
je 0x47eceb
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x2c]
push eax
call fcn.0043d617
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042e109
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x260]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47ec80
jmp 0x47ed48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x47ed2a
and eax, 0xffff
or eax, 0x80070000
push eax
push str.Failed_Process32First:_0x_08x.
push str.kupdate::KProcessUtils::IsProcessExists
push 0xdd
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKProcessUtils.cpp
push ebx
call fcn.0042f683
add esp, 0x18
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x259]
call fcn.00493648
ret
Function at 0x47f488
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x20c], eax
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
xor esi, esi
lea eax, [ebp - 0x202]
push esi
push eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], 0x100
call fcn.00492b40
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x10008
push esi
push dword [ebp - 0x20c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x47f4fc
xor eax, eax
jmp 0x47f575
cmp eax, esi
jne 0x47f575
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x210], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, 0x103
je 0x47f553
cmp ebx, esi
jne 0x47f567
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.0047f488
mov ebx, eax
pop ecx
pop ecx
cmp ebx, esi
je 0x47f500
jmp 0x47f567
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret
Function at 0x47f7ff
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x48
mov eax, 0x4b9972
call fcn.004935c5
mov edi, dword [ebp + 0x24]
xor eax, eax
xor esi, esi
push 0xffffffffffffffff
mov word [ebp - 0x2c], ax
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
call fcn.0042e374
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.0047f583
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0047f742
add esp, 0xc
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
mov dword [ebp - 0x4c], esi
jae 0x47f864
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push ecx
push 0x20219
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x47f8cd
jle 0x47f886
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push str.Failed_RegOpenKeyEx:_0x_08x.
push str.kupdate::KRegistry::ReadStr
push 0x69
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKRegistry.cpp
push 5
call fcn.0042f683
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0042e109
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042e109
push esi
push 1
lea ecx, [ebp + 8]
call fcn.0042e109
mov eax, edi
call fcn.00493648
ret
mov eax, dword [ebp + 0x28]
add eax, eax
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], esi
jae 0x47f8e4
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x54]
push ecx
push edi
lea ecx, [ebp - 0x50]
push ecx
push esi
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x47f927
jle 0x47f915
and edi, 0xffff
or edi, 0x80070000
push edi
push str.Failed_RegQueryValueEx:_0x_08x.
push str.kupdate::KRegistry::ReadStr
push 0x74
jmp 0x47f895
xor edi, edi
jmp 0x47f8a4
Function at 0x47f92e
Capabilities:
Set registry value

Disassembly:
push 0x44
mov eax, 0x4b99af
call fcn.004935c5
mov edi, dword [ebp + 0x24]
xor eax, eax
xor esi, esi
push 0xffffffffffffffff
mov word [ebp - 0x2c], ax
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
call fcn.0042e374
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.0047f583
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0047f742
add esp, 0xc
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
jae 0x47f996
lea eax, [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x50]
push ecx
push esi
push 0x20206
push esi
push esi
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x47fa05
jle 0x47f9bc
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push str.Failed_RegCreateKeyEx:_0x_08x.
push str.kupdate::KRegistry::WriteStr
push 0x89
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKRegistry.cpp
push 5
call fcn.0042f683
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0042e109
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042e109
push esi
push 1
lea ecx, [ebp + 8]
call fcn.0042e109
mov eax, edi
jmp 0x47fa8e
cmp dword [ebp - 0x34], 8
mov ebx, dword [ebp - 0x48]
jae 0x47fa11
lea ebx, [ebp - 0x48]
push edi
call fcn.00493091
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push esi
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x50]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x47fa6a
jle 0x47fa48
and edi, 0xffff
or edi, 0x80070000
push edi
push str.Failed_RegSetValueEx:_0x_08x.
push str.kupdate::KRegistry::WriteStr
push 0x93
push str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdateutilKRegistry.cpp
push 5
mov dword [ebp - 0x4c], edi
call fcn.0042f683
add esp, 0x18
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0042e109
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042e109
push esi
push 1
lea ecx, [ebp + 8]
call fcn.0042e109
mov eax, dword [ebp - 0x4c]
call fcn.00493648
ret