joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x10029b50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10029b50
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x10029b55
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x10029b3b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x10029b62
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x10034730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x10034771
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10034773
mov esi, edi
test esi, esi
je 0x100347e8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100347dd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x100347dd
cmp dword [esp + 0x1c], eax
jbe 0x100347ae
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100347dd
cmp esi, edi
je 0x100347cf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x100347e8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x10034800
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x10034865
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x10034865
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x10034865
cmp dword [esp + 0x18], eax
jbe 0x1003484b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x10034869
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x10034b00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1007da4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1009a7ec]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x10034b6b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10034b6d
mov esi, edi
test esi, esi
je 0x10034c37
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10034c2c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x10034baf
cmp eax, 2
je 0x10034baf
cmp eax, 6
je 0x10034baf
cmp eax, 7
jne 0x10034c2c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.1006fb58
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x10034c12
lea ecx, [esp + 0x14]
call fcn.1006f610
cmp esi, dword [esp + 0x14]
je 0x10034c07
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.1006fb81
add esp, 4
jmp 0x10034c49
call fcn.1006fb81
add esp, 4
lea ecx, [esp + 0x10]
push 0x100a4a8c
call fcn.1006f610
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x10034c37
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x10034c49
push eax
lea ecx, [esp + 0x14]
call fcn.1006f610
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.1006f1fc
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.1006f487
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x10034d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x10034dc7
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10034dca
mov esi, dword [ebp + 8]
test esi, esi
je 0x10034f7b
call fcn.1003e220
test eax, eax
je 0x10034eb4
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10034deb
mov dword [ebp + 0x10], eax
jmp 0x10034e1e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.1000ea70
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10034f6f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x10034e58
cmp eax, 2
je 0x10034e58
cmp eax, 6
je 0x10034e58
cmp eax, 7
jne 0x10034f6f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.1006fb58
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x10034f5a
mov ecx, dword [ebp + 0x18]
call fcn.10025dc0
cmp esi, dword [ebp + 8]
je 0x10034f44
jmp 0x10034f3d
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10034f6f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x10034eee
cmp eax, 2
je 0x10034eee
cmp eax, 6
je 0x10034eee
cmp eax, 7
jne 0x10034f6f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.1006fb58
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x10034f5a
mov ecx, dword [ebp + 0x18]
call fcn.10025e90
cmp esi, dword [ebp + 8]
je 0x10034f44
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.1006fb81
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1006fb81
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x100a4a8c
call fcn.10025e90
cmp esi, dword [ebp + 8]
je 0x10034f7b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100359c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1007db18
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x10035a16
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10035a19
mov esi, dword [ebp + 8]
test esi, esi
je 0x10035aff
call fcn.1003e220
test eax, eax
je 0x10035a9a
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10035a35
xor ebx, ebx
jmp 0x10035a65
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.1000ea70
mov eax, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [ebp + 0x18]
push edi
call fcn.1000e8fa
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10035af3
cmp esi, dword [ebp + 8]
je 0x10035a93
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10035b01
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.1001f960
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10035ae4
cmp esi, dword [ebp + 8]
je 0x10035ace
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.10020170
mov eax, 1
jmp 0x10035b01
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.10020170
cmp esi, dword [ebp + 8]
je 0x10035aff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038bd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x1009e878
push ecx
call fcn.1000f6cc
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10038caa
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x10038c90
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.1006fb58
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x10038c90
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x10038cc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x1009e878
push ecx
call fcn.1000f6cc
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10038d59
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x10038f80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1003901a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x10039004
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.1006fb58
mov esi, eax
add esp, 4
test esi, esi
je 0x10039004
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x100391b0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1007de4b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x100a7ce8
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x100a7cec
call fcn.10038f80
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x10039201
push ebp
call fcn.1000e8fa
add esp, 4
test eax, eax
jne 0x10039244
push ebp
call fcn.1006fb81
add esp, 4
push 0x1009e8b0
call fcn.1000e8fa
inc eax
lea esi, [eax + eax]
push esi
call fcn.1006fb58
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x10039388
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x1009e8b0
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.1000e8d5
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.1000f6cc
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push 0x1009e884
push eax
call fcn.1000f6cc
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1003937f
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x1008d91c
push eax
call edi
test eax, eax
je 0x10039368
lea ecx, [esp + 0x40]
push 0x1008d918
push ecx
call edi
test eax, eax
je 0x10039368
test byte [esp + 0x14], 0x10
jne 0x10039368
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.1006f547
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.1006df26
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.1006f487
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10039304
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.1006fb81
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x10039940
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x100a8070]
sub esp, 0x114
test eax, eax
jne 0x10039a8d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x100a7f08
mov dword [0x100a8070], 1
mov dword [0x100a7f08], 0x94
call esi
mov edx, dword [0x100a7f18]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x1009e990], eax
je 0x10039a68
push ebx
push 0x100a7fa0
mov dword [0x100a7fa0], 0x9c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x100a8064], eax
call edi
mov dword [0x100a8068], eax
mov eax, dword [0x100a8064]
test eax, eax
push 0x100a8040
je 0x100399e4
call eax
jmp 0x100399ea
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100a7fa4]
cmp eax, 6
jae 0x10039a02
cmp eax, 5
jne 0x10039a16
cmp dword [0x100a7fa8], 2
jb 0x10039a16
cmp word [0x100a8040], 9
jne 0x10039a16
mov dword [0x100a7efc], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x10039a34
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x100a806c], edx
jmp 0x10039a3a
mov edx, dword [0x100a806c]
test edx, edx
je 0x10039a68
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x10039a68
mov ecx, dword [esp + 0x14]
mov dword [0x100a7f14], ecx
push 0x100a7f10
push 0x100a7f0c
call fcn.10039e30
add esp, 8
call fcn.10039aa0
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x1003ace0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082fb0
push 0x10013d4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x100a8074]
xor ebx, ebx
cmp eax, ebx
jne 0x1003ae40
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1003ae3b
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push str._s_s
lea edx, [ebp - 0x224]
push edx
call fcn.1000ea9f
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
push eax
call fcn.1006fb58
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x1003ae3b
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1003ae32
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1003ae32
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x100a8074], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1003ae32
push esi
call fcn.1006fb81
add esp, 4
mov eax, dword [0x100a8074]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x1003b641
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1003b643
mov esi, edi
test esi, esi
je 0x1003b6b8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003b6ad
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x1003b6ad
cmp dword [esp + 0x1c], eax
jbe 0x1003b67e
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003b6ad
cmp esi, edi
je 0x1003b69f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x1003b6b8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x1003b6d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx]
push edi
test esi, esi
mov dword [esp + 0xc], 0
je 0x1003b735
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x1003b735
mov ecx, dword [esp + 0x10]
mov eax, 4
cmp ecx, eax
jne 0x1003b735
cmp dword [esp + 0x18], eax
jbe 0x1003b71b
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push edi
push esi
call ebx
test eax, eax
mov eax, dword [esp + 0xc]
je 0x1003b739
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x1003b950
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [ecx]
test esi, esi
push edi
je 0x1003b9c4
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003b9c4
cmp dword [esp + 0x10], 3
jne 0x1003b9c4
mov edx, dword [esp + 0x18]
push edx
call fcn.1006fb58
mov edi, eax
add esp, 4
test edi, edi
je 0x1003b9c4
lea eax, [esp + 0x18]
push eax
push edi
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x1003b9bb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8
push edi
call fcn.1006fb81
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8