joyce8/EMBER2024-capa huggingface dataset:
Function at 0x966530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x1d]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x24], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x125]
push ebx
push ecx
mov byte [esp + 0x12c], bl
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [esp + 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea esi, [esp + 0x120]
call fcn.00960950
call fcn.009663b0
test eax, eax
je 0x966635
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SoftwareKasperskyLabComponents102Tasks0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x966635
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push str.ReportFileFolder
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x18], bl
je 0x966631
xor ecx, ecx
lea edi, [esp + 0x18]
call fcn.0095a6d0
test eax, eax
je 0x966631
mov edx, edi
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, ebp
call fcn.00960950
jmp 0x9666e9
mov byte [esp + 0x18], bl
lea ebx, [esp + 0x18]
call fcn.009541a0
cmp byte [esp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x96669a
xor ecx, ecx
lea edi, [esp + 0x18]
call fcn.0095a6d0
test eax, eax
je 0x96669a
mov eax, edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, ebp
call fcn.00960950
xor ecx, ecx
mov edi, ebp
call fcn.0095a6d0
test eax, eax
je 0x96669a
push str.LOG
push ebp
call ebx
xor ecx, ecx
call fcn.0095a6d0
test eax, eax
jne 0x9666e9
mov ecx, 0xaa1543
call fcn.0095e7e0
cmp eax, 1
je 0x9666e9
lea ecx, [esp + 0x120]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ecx, ecx
mov edi, ebp
call fcn.0095a6d0
test eax, eax
je 0x9666e9
push str.LOG
push ebp
call ebx
xor ecx, ecx
call fcn.0095a6d0
test eax, eax
jne 0x9666e9
mov ecx, 0xaa1543
mov esi, ebp
call fcn.0095e7e0
cmp eax, 1
je 0x9666e9
lea edx, [esp + 0x120]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x220
ret
Function at 0x966890
Capabilities:
Get disk information

Disassembly:
cmp dword [0xbfc984], 0
push ebx
push esi
push edi
mov edi, eax
jne 0x9668ce
xor eax, eax
mov dword [0xbfc984], 1
mov dword [0xc0e9ec], eax
mov dword [0xc0e9f0], eax
mov dword [0xc0e9f4], eax
mov dword [0xc0e9f8], eax
mov dword [0xc0e9fc], eax
mov dword [0xc0ea00], eax
mov word [0xc0ea04], ax
movsx eax, byte [edi]
push eax
xor esi, esi
call fcn.00a7c649
mov bl, al
mov cl, bl
sub cl, 0x41
add esp, 4
cmp cl, 0x19
ja 0x966912
movsx esi, bl
sub esi, 0x41
cmp byte [esi + 0xc0e9ec], 1
jne 0x966912
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
cmp edi, 3
jne 0x966909
pop edi
pop esi
pop ebx
ret
mov byte [esi + 0xc0e9ec], 0
jmp 0x96691b
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
cmp edi, 3
jne 0x966965
mov dl, bl
sub dl, 0x41
cmp dl, 0x19
ja 0x966965
cmp byte [esi + 0xc0e9ec], 0
jne 0x966947
mov cl, bl
call fcn.00989270
test eax, eax
setne al
inc al
mov byte [esi + 0xc0e9ec], al
mov al, byte [esi + 0xc0e9ec]
cmp al, 1
jne 0x96695c
mov edi, 3
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp al, 2
jne 0x966965
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x967cc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x14c], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push edi
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x967dcc
cmp byte [ebx], 0
je 0x967dcc
push 0
lea edi, [esp + 0x14]
call fcn.009834f0
cmp eax, 1
jne 0x967d3b
test esi, esi
je 0x967d10
mov ecx, dword [esp + 0x30]
mov dword [esi], ecx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x967d25
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [eax], edx
mov dword [eax + 4], ecx
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
push 0x80
push 3
push 1
push 0x80000000
mov edi, ebx
call fcn.0094db00
mov edi, eax
add esp, 0x10
mov dword [esp + 8], edi
cmp edi, 0xffffffff
je 0x967d7c
mov edx, dword [esp + 0xc]
push edx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x967da0
lea eax, [esp + 8]
push eax
call fcn.00985290
push 1
push 0
mov edx, esi
mov ecx, ebx
call fcn.0095a0f0
add esp, 8
pop edi
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x967daf
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
lea ecx, [esp + 8]
push ecx
call fcn.00985290
test esi, esi
je 0x967d25
cmp dword [esi], 0xffffffff
jne 0x967d25
jmp 0x967d7c
mov ecx, dword [esp + 0x154]
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00a78f21
mov esp, ebp
pop ebp
ret

Function at 0x9682c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov dword [esp + 0x10], 0
mov byte [esp + 0x1c], 0
call fcn.00a7ffb0
call fcn.00968110
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0x1c]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and esi, 0x100
push ecx
add esi, 0x20019
call fcn.00a78f30
add esp, 0x14
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push 0x80000002
call fcn.0097eda0
pop esi
test eax, eax
jne 0x968365
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 4]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push 0xaeb5f0
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x110]
mov eax, dword [esp]
xor ecx, esp
call fcn.00a78f21
add esp, 0x114
ret
Function at 0x968380
Capabilities:
Check os version

Disassembly:
sub esp, 0xac
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xa8], eax
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [esp + 4], 0x9c
test esi, esi
je 0x9683b7
mov byte [esi], 0
cmp dword [0xbfc9d0], 0
jne 0x9683ef
mov dword [0xbfc9d0], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x9683ef
cmp al, 6
jb 0x9683ef
lea edx, [esp + 4]
xor ecx, ecx
mov dword [0xbfc9d4], 1
call fcn.0094c480
jmp 0x968410
cmp dword [0xbfc9d4], 0
je 0x968405
lea edx, [esp + 4]
xor ecx, ecx
call fcn.0094c480
jmp 0x968410
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x96857f
test esi, esi
je 0x9684d0
mov eax, dword [esp + 8]
cmp eax, 4
ja 0x96844d
movzx edx, word [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
push str.Version__u._u__s__Build__u_
push esi
call fcn.00a78f30
add esp, 0x18
jmp 0x9684d0
call fcn.00968d70
test eax, eax
je 0x96849a
cmp byte [esp + 0x18], 0
je 0x96847e
call fcn.009682c0
push eax
movzx eax, word [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push str._s__Build__u._u_
push esi
call fcn.00a78f30
add esp, 0x14
jmp 0x9684d0
call fcn.009682c0
movzx edx, word [esp + 0x10]
push eax
push edx
push str.Build__u._u
push esi
call fcn.00a78f30
add esp, 0x10
jmp 0x9684d0
cmp byte [esp + 0x18], 0
je 0x9684bc
movzx eax, word [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str._s__Build__u_
push esi
call fcn.00a78f30
add esp, 0x10
jmp 0x9684d0
movzx edx, word [esp + 0x10]
push edx
push str.Build__u
push esi
call fcn.00a78f30
add esp, 0xc
cmp dword [esp + 0x14], 2
jne 0x96857f
cmp dword [esp + 8], 5
jb 0x96857f
cmp byte [esp + 0x9e], 1
mov eax, dword [esp + 0x9c]
jne 0x968518
and eax, 0x200
neg eax
sbb eax, eax
add eax, 2
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00a78f21
add esp, 0xac
ret
test al, al
jns 0x968536
mov eax, 4
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00a78f21
add esp, 0xac
ret
test al, 2
je 0x968554
mov eax, 5
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00a78f21
add esp, 0xac
ret
xor edx, edx
mov ecx, 0x400
cmp ax, cx
setne dl
dec edx
and edx, 3
add edx, 3
mov eax, edx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00a78f21
add esp, 0xac
ret
mov ecx, dword [esp + 0xa8]
xor ecx, esp
xor eax, eax
call fcn.00a78f21
add esp, 0xac
ret
Function at 0x9685a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc990], 0
je 0x9685d7
mov eax, dword [0xbfc994]
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc990], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 2
cmp dword [esp + 0x10], ecx
jne 0x96864c
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x96864c
jbe 0x968641
mov dword [0xbfc994], 1
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
cmp eax, 5
jne 0x96864c
cmp dword [esp + 8], ecx
jae 0x96861d
mov ecx, dword [esp + 0x94]
xor ecx, esp
mov dword [0xbfc994], 0
xor eax, eax
call fcn.00a78f21
add esp, 0x98
ret

Function at 0x9686d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc998], 0
je 0x968707
mov eax, dword [0xbfc99c]
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
push esi
push 0x90
lea eax, [esp + 0xc]
push 0
mov esi, 1
push eax
mov dword [0xbfc998], esi
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
jne 0x968775
mov eax, dword [esp + 8]
cmp eax, 5
jb 0x968775
ja 0x968757
cmp eax, 5
jne 0x968775
cmp dword [esp + 0xc], esi
jb 0x968775
mov dword [0xbfc99c], esi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
mov ecx, dword [esp + 0x98]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00a78f21
add esp, 0x98
ret

Function at 0x9687b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc9a0], 0
jne 0x968823
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9a0], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 2
cmp dword [esp + 0x10], ecx
jne 0x968823
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x968819
jne 0x968823
cmp dword [esp + 8], ecx
jb 0x968823
mov dword [0xbfc9a4], 1
mov ecx, dword [esp + 0x94]
mov eax, dword [0xbfc9a4]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
Function at 0x968840
Capabilities:
Check os version

Disassembly:
sub esp, 0x13c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x138], eax
cmp dword [0xbfc9a8], 0
jne 0x96890a
push 0x90
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [0xbfc9a8], 1
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 2
cmp dword [esp + 0x14], ecx
jne 0x96890a
mov eax, dword [esp + 8]
cmp eax, 6
ja 0x9688ae
jne 0x96890a
cmp dword [esp + 0xc], ecx
jb 0x96890a
push 0x90
lea edx, [esp + 0xa4]
push 0
push edx
mov dword [esp + 0xa8], 0
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0x9c]
call fcn.0094c480
cmp eax, 1
jne 0x96890a
mov eax, dword [esp + 0xa0]
cmp eax, 6
jne 0x9688fb
cmp dword [esp + 0xa4], 3
jae 0x968900
jmp 0x96890a
cmp eax, 0xa
jb 0x96890a
mov dword [0xbfc9ac], 1
mov ecx, dword [esp + 0x138]
mov eax, dword [0xbfc9ac]
xor ecx, esp
call fcn.00a78f21
add esp, 0x13c
ret

Function at 0x968930
Capabilities:
Check os version

Disassembly:
sub esp, 0x13c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x138], eax
cmp dword [0xbfc9b0], 0
jne 0x9689fa
push 0x90
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [0xbfc9b0], 1
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 2
cmp dword [esp + 0x14], ecx
jne 0x9689fa
mov eax, dword [esp + 8]
cmp eax, 6
ja 0x96899e
jne 0x9689fa
cmp dword [esp + 0xc], ecx
jb 0x9689fa
push 0x90
lea edx, [esp + 0xa4]
push 0
push edx
mov dword [esp + 0xa8], 0
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0x9c]
call fcn.0094c480
cmp eax, 1
jne 0x9689fa
mov eax, dword [esp + 0xa0]
cmp eax, 6
jne 0x9689eb
cmp dword [esp + 0xa4], 4
jae 0x9689f0
jmp 0x9689fa
cmp eax, 0xa
jb 0x9689fa
mov dword [0xbfc9b4], 1
mov ecx, dword [esp + 0x138]
mov eax, dword [0xbfc9b4]
xor ecx, esp
call fcn.00a78f21
add esp, 0x13c
ret

Function at 0x968a20
Capabilities:
Check os version

Disassembly:
sub esp, 0x13c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x138], eax
push 0x90
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
jne 0x968b10
cmp dword [esp + 8], 6
jne 0x968b10
call fcn.00963620
cmp eax, 2
jle 0x968b10
mov eax, dword [esp + 8]
cmp eax, 6
ja 0x968a91
jne 0x968af6
cmp dword [esp + 0xc], 2
jb 0x968af6
push 0x90
lea edx, [esp + 0xa4]
push 0
push edx
mov dword [esp + 0xa8], 0
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0x9c]
call fcn.0094c480
cmp eax, 1
jne 0x968af6
mov eax, dword [esp + 0xa4]
test eax, eax
jne 0x968afa
cmp dword [esp + 0xa8], 0x44c0
sbb eax, eax
add eax, 6
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.00a78f21
add esp, 0x13c
ret
mov eax, dword [esp + 0xc]
inc eax
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.00a78f21
add esp, 0x13c
ret
mov ecx, dword [esp + 0x138]
xor ecx, esp
xor eax, eax
call fcn.00a78f21
add esp, 0x13c
ret
Function at 0x968b30
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc9b8], 0
jne 0x968ba0
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9b8], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x968ba0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x968b96
jne 0x968ba0
cmp dword [esp + 8], 1
jb 0x968ba0
mov dword [0xbfc9bc], 1
mov ecx, dword [esp + 0x94]
mov eax, dword [0xbfc9bc]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret

Function at 0x968bc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc9c0], 0
jne 0x968c2c
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9c0], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x968c2c
cmp dword [esp + 4], 6
jne 0x968c2c
cmp dword [esp + 8], 0
jne 0x968c2c
mov dword [0xbfc9c4], 1
mov ecx, dword [esp + 0x94]
mov eax, dword [0xbfc9c4]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret

Function at 0x968c50
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x98], eax
cmp dword [0xbfc9c8], 0
je 0x968c87
mov eax, dword [0xbfc9cc]
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00a78f21
add esp, 0x9c
ret
cmp dword [0xbfc9d0], 0
push edi
mov edi, 1
mov dword [0xbfc9c8], edi
jne 0x968cb8
mov dword [0xbfc9d0], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x968cb8
cmp al, 6
jb 0x968cb8
mov dword [0xbfc9d4], edi
jmp 0x968cc5
cmp dword [0xbfc9d4], 0
je 0x968d4d
push 0x90
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 6
jne 0x968d30
cmp dword [esp + 0x10], 0
jne 0x968d30
push esi
lea esi, [esp + 8]
call fcn.00968670
cmp word [esp + 8], di
pop esi
sbb eax, eax
inc eax
mov dword [0xbfc9cc], eax
pop edi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00a78f21
add esp, 0x9c
ret
mov eax, edi
mov dword [0xbfc9cc], eax
pop edi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00a78f21
add esp, 0x9c
ret
mov ecx, dword [esp + 0x9c]
mov eax, dword [0xbfc9cc]
pop edi
xor ecx, esp
call fcn.00a78f21
add esp, 0x9c
ret

Function at 0x968db0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc9d8], 0
jne 0x968e1c
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9d8], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x968e1c
cmp dword [esp + 4], 5
jne 0x968e1c
cmp dword [esp + 8], 0
jne 0x968e1c
mov dword [0xbfc9dc], 1
mov ecx, dword [esp + 0x94]
mov eax, dword [0xbfc9dc]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
Function at 0x968e40
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfc9e0], 0
jne 0x968ebf
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9e0], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x968ebf
cmp dword [esp + 4], 5
jne 0x968ebf
cmp dword [esp + 8], 0
jne 0x968ebf
call fcn.00963620
cmp eax, 2
jg 0x968eb5
call fcn.00963540
test eax, eax
je 0x968ebf
mov dword [0xbfc9e4], 1
mov ecx, dword [esp + 0x94]
mov eax, dword [0xbfc9e4]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret

Function at 0x968f30
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp dword [0xbfc9f0], 0
jne 0x968fc5
push 0x98
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9f0], 1
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
cmp eax, 5
jb 0x968fbe
jne 0x968fc5
cmp ecx, 1
jne 0x968f9e
cmp word [esp + 0x94], 2
jae 0x968fc5
jmp 0x968fbe
cmp ecx, 2
jne 0x968fbe
cmp word [esp + 0x94], cx
jb 0x968fbe
call fcn.00963620
cmp eax, 2
mov byte [0xb4c314], 1
jle 0x968fc5
mov byte [0xb4c314], 0
mov ecx, dword [esp + 0x9c]
mov al, byte [0xb4c314]
xor ecx, esp
call fcn.00a78f21
add esp, 0xa0
ret

Function at 0x968fe0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp dword [0xbfc9f4], 0
jne 0x96906d
push 0x98
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfc9f4], 1
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 4], 5
jne 0x96906d
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x96904a
cmp word [esp + 0x94], 2
jb 0x96906d
jmp 0x969063
cmp eax, 2
jne 0x96906d
cmp word [esp + 0x94], ax
jb 0x96906d
call fcn.00963620
cmp eax, 2
jg 0x96906d
mov dword [0xbfc9f8], 1
mov ecx, dword [esp + 0x9c]
mov eax, dword [0xbfc9f8]
xor ecx, esp
call fcn.00a78f21
add esp, 0xa0
ret

Function at 0x969130
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0xbfca04], 0
jne 0x9691ad
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0xbfca04], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x9691ad
cmp dword [esp + 4], 5
jne 0x9691ad
mov eax, dword [esp + 8]
cmp eax, 1
je 0x9691a3
cmp eax, 2
jne 0x9691ad
call fcn.00963620
cmp eax, 2
jg 0x9691ad
mov dword [0xbfca08], 1
mov ecx, dword [esp + 0x94]
mov eax, dword [0xbfca08]
xor ecx, esp
call fcn.00a78f21
add esp, 0x98
ret
Function at 0x9691d0
Capabilities:
Check os version

Disassembly:
sub esp, 0xb4
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xbc]
push ebp
mov ebp, dword [esp + 0xd0]
push esi
mov esi, dword [esp + 0xc0]
push edi
mov edi, dword [esp + 0xe0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xcc]
push 0x90
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xd8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
call fcn.00a7ffb0
add esp, 0xc
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
cmp eax, 2
sete cl
mov dword [esi], ecx
test edi, edi
je 0x969298
mov dword [edi], 0
cmp eax, 2
jne 0x969298
cmp edx, 6
jne 0x969290
cmp dword [esp + 0x30], eax
jae 0x969292
jmp 0x969298
jbe 0x969298
mov dword [edi], 1
test ebp, ebp
je 0x9692bb
mov dword [ebp], 0
cmp eax, 2
jne 0x9692bb
cmp edx, 6
jne 0x9692bb
cmp dword [esp + 0x30], 1
jne 0x9692bb
mov dword [ebp], 1
test ebx, ebx
je 0x9692dc
mov dword [ebx], 0
cmp eax, 2
jne 0x9692dc
cmp edx, 6
jne 0x9692dc
cmp dword [esp + 0x30], 0
jne 0x9692dc
mov dword [ebx], 1
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x96932b
mov dword [esi], 0
cmp eax, 2
jne 0x96932b
cmp edx, 6
jne 0x96932b
call fcn.00963620
cmp eax, 2
jle 0x969323
mov dword [esi], 1
test ebx, ebx
je 0x96930e
mov dword [ebx], 0
test ebp, ebp
je 0x969319
mov dword [ebp], 0
test edi, edi
je 0x969323
mov dword [edi], 0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x969361
mov dword [esi], 0
cmp eax, 2
jne 0x969361
cmp edx, 5
jne 0x969361
cmp dword [esp + 0x30], eax
jne 0x969361
call fcn.00963620
mov edx, dword [esp + 0x2c]
cmp eax, 2
mov eax, dword [esp + 0x38]
jle 0x969361
mov dword [esi], 1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x96939e
mov dword [esi], 0
cmp eax, 2
jne 0x96939e
cmp edx, 5
jne 0x96939e
mov ecx, dword [esp + 0x30]
cmp ecx, 1
je 0x969398
cmp ecx, eax
jne 0x96939e
call fcn.00963620
mov edx, dword [esp + 0x2c]
cmp eax, 2
mov eax, dword [esp + 0x38]
jg 0x96939e
mov dword [esi], 1
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x9693c6
mov dword [ecx], 0
cmp eax, 2
jne 0x9693c6
cmp edx, 5
jne 0x9693c6
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x9693ca
mov dword [ecx], 1
jmp 0x9693ca
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x9693e9
mov dword [ecx], 0
cmp eax, 1
jne 0x9693e9
cmp edx, 4
jne 0x9693e9
cmp esi, 0xa
jne 0x9693e9
mov dword [ecx], eax
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x969408
mov dword [ecx], 0
cmp eax, 1
jne 0x969408
cmp edx, 4
jne 0x969408
cmp esi, 0x5a
jne 0x969408
mov dword [ecx], eax
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x969426
mov dword [ecx], 0
cmp eax, 1
jne 0x969426
cmp edx, 4
jne 0x969426
test esi, esi
jne 0x969426
mov dword [ecx], eax
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00a78f21
add esp, 0xb4
ret