joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1018e600]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x56
or esi, 0xffffffff
call edi
test eax, eax
jne 0x1000b032
push 0x57
call edi
test eax, eax
je 0x1000b0bd
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftActive_SetupInstalled_ComponentsFDC11A6F_17D1_48f9_9EA3_9051954BAA24
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0x104
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b0a2
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b0b4
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
push eax
jmp 0x1000b133
lea ecx, [ebp - 0x210]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftActive_SetupInstalled_Components78705f0d_e8db_4b2d_8193_982bdda15ecd
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x218], 0x104
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b0a2
lea edx, [ebp - 0x218]
push edx
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b12c
mov eax, dword [ebp - 0x210]
push eax
jmp 0x1000b09c
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x20c]
push 0x2c
push edx
call fcn.1010fe1d
add esp, 8
test eax, eax
je 0x1000b0a2
add eax, 2
push eax
call fcn.1010db5c
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
pop esi
call fcn.1010d913
mov esp, ebp
pop ebp
ret

Function at 0x1000b170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b1d3
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b1dc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b1f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push ebx
push esi
push str.Kernel32.dll
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000b24b
push str.GetNativeSystemInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b240
lea ecx, [ebp - 0x24]
push ecx
call eax
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
jne 0x1000b255
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
pop esi
pop ebx
test eax, eax
je 0x1000b27f
cmp eax, 6
je 0x1000b276
xor ecx, ecx
cmp eax, 9
setne cl
lea eax, [ecx - 1]
and eax, 4
mov esp, ebp
pop ebp
ret
mov eax, 2
mov esp, ebp
pop ebp
ret
mov eax, 8
mov esp, ebp
pop ebp
ret
Function at 0x1000b290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1018e600]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x210]
push ecx
xor edi, edi
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x21c], edi
xor ebx, ebx
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x220], 0x104
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b3b8
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
push ecx
push ebx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b32d
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000b3b8
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x20c]
push 0x101681a8
push eax
call fcn.1010fe4b
add esp, 0xc
test eax, eax
je 0x1000b3b8
or esi, 0xffffffff
lea esp, [esp]
inc esi
cmp esi, 3
ja case.default.0x1000b366
jmp dword [esi*4 + 0x1000b410]
push eax
call fcn.1010db5c
mov edi, eax
jmp 0x1000b39b
push eax
call fcn.1010db5c
mov ebx, eax
jmp 0x1000b39b
push eax
call fcn.1010db5c
mov dword [ebp - 0x218], eax
jmp 0x1000b39b
push eax
call fcn.1010db5c
mov dword [ebp - 0x214], eax
add esp, 4
lea ecx, [ebp - 0x21c]
push ecx
push 0x101681a8
push 0
call fcn.1010fe4b
add esp, 0xc
test eax, eax
jne 0x1000b360
mov eax, dword [ebp + 0x10]
cmp edi, eax
jle 0x1000b3d4
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d913
mov esp, ebp
pop ebp
ret 0x18
jne 0x1000b3f9
mov eax, dword [ebp + 0x14]
cmp ebx, eax
jg 0x1000b3bf
jne 0x1000b3f9
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x218]
cmp ecx, eax
jg 0x1000b3bf
jne 0x1000b3f9
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp + 0x1c]
jge 0x1000b3bf
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.1010d913
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000b440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1018e600]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoft.NETFrameworkPolicy_v1.0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0x104
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b4c3
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0x101681ac
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b4d3
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.1010d913
mov esp, ebp
pop ebp
ret

Function at 0x1000b4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v1.1.4322
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b569
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push ebx
push str.Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b555
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 8], eax
je 0x1000b56b
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v2.0.50727
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b5e9
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push ebx
push str.Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b5d5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 8], eax
je 0x1000b5eb
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0Setup
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b658
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.InstallSuccess
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b65f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x1000b658
push 0x1a
push 0x119a
push 0
push 3
push str.Version
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.0Setup
mov ecx, esi
call sym.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapPrereqCheck::CheckNetfxBuildNumber_wchar_t_const___wchar_t_const___int__int__int__int_
test al, al
je 0x1000b658
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000b6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.5
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b708
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b70f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x1000b708
push 8
push 0x521e
push 5
push 3
push str.Version
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v3.5
mov ecx, esi
call sym.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapPrereqCheck::CheckNetfxBuildNumber_wchar_t_const___wchar_t_const___int__int__int__int_
test al, al
je 0x1000b708
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Client
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b7c9
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push ebx
push str.Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b7b5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 8], eax
je 0x1000b7cb
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b7d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftNET_Framework_SetupNDP_v4Full
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b849
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push ebx
push str.Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b835
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
cmp dword [ebp - 8], eax
je 0x1000b84b
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b89a
mov ecx, dword [ebp + 0x18]
lea eax, [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000b8a0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ebp
ret 0x18
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ebp
ret 0x18
Function at 0x1000d710
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x1018e600]
xor eax, esp
mov dword [esp + 0x44], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1000d751
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x44]
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.1010d913
mov esp, ebp
pop ebp
ret

Function at 0x1000d770
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000d7ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1000d920
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x11c
mov dword [ebp - 4], ecx
call fcn.1001ee4b
mov esi, eax
add esp, 4
test esi, esi
je 0x1000d94f
push 0x11c
push 0
push esi
call fcn.10111520
add esp, 0xc
jmp 0x1000d951
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
mov dword [esi], 0x11c
call ebx
mov edi, dword [esi + 0x10]
push esi
call fcn.1001ee85
add esp, 4
cmp edi, 2
jne 0x1000d9d6
push 0x11c
call fcn.1001ee4b
mov esi, eax
add esp, 4
test esi, esi
je 0x1000d996
push 0x11c
push 0
push esi
call fcn.10111520
add esp, 0xc
jmp 0x1000d998
xor esi, esi
push esi
mov dword [esi], 0x11c
call ebx
mov edi, dword [esi + 4]
push esi
call fcn.1001ee85
add esp, 4
cmp edi, 6
jl 0x1000d9d6
mov esi, dword [ebp - 4]
mov ecx, esi
call sym.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSMinorVersion_void_
cmp eax, 1
jl 0x1000d9d6
mov ecx, esi
call sym.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSProductType_void_
cmp eax, 1
je 0x1000d9d6
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d9e0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1018e600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x200
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call esi
test eax, eax
jne 0x1000da32
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x20]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1000da20
lea ecx, [ebp - 0x14]
push ecx
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000da8e
call esi
cmp eax, 0x3f0
jne 0x1000da20
lea edx, [ebp - 0x14]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000da20
mov ecx, dword [ebp - 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push ecx
call edi
test eax, eax
jne 0x1000dacb
call esi
cmp eax, 0x7a
je 0x1000dacb
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call fcn.1001ee7a
mov edx, dword [ebp - 0x18]
add esp, 4
lea ecx, [ebp - 0x18]
push ecx
push edx
mov esi, eax
mov eax, dword [ebp - 0x14]
push esi
push 2
push eax
call edi
test eax, eax
jne 0x1000db14
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1001ee85
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0xd], bl
cmp dword [esi], ebx
jbe 0x1000db50
lea edi, [esi + 4]
mov edi, edi
mov edx, dword [edi]
mov eax, dword [ebp - 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000db4c
mov ecx, dword [edi]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000db4c
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x1000db20
jmp 0x1000db50
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_FreeSid]
push eax
call edi
mov ecx, dword [ebp - 0x1c]
push ecx
call edi
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1001ee85
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0xd]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010d913
mov esp, ebp
pop ebp
ret
Function at 0x10014be0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0x20006
push 0
push str.SoftwareHewlett_PackardCSIBootstrap
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10014c4f
mov esi, dword [esi]
mov ecx, dword [esp + 8]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10014c3c
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.DeleteRebootFlag_failed_deleting_registry_value._n
call fcn.10003a30
call sym.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____
add esp, 4
xor bl, bl
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.DeleteRebootFlag_failed_opening_registry_key._n
call fcn.10003a30
call sym.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____
add esp, 4
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1018e600]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareHewlett_PackardCSIBootstrap
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov bl, 1
mov dword [esp + 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10014d09
mov esi, dword [esi]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10014ceb
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.IsRebootFlagSet_failed_reading_registry_value._n
call fcn.10003a30
call sym.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____
add esp, 4
xor bl, bl
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1010d913
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.IsRebootFlagSet_failed_opening_registry_key._n
call fcn.10003a30
call sym.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____
mov ecx, dword [esp + 0x28]
add esp, 4
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.1010d913
mov esp, ebp
pop ebp
ret