Function at 0x1003734
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push 0x1001898
push 0
call dword [sym.imp.msvcrt.dll_setlocale]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
pop ecx
pop ecx
lea eax, [ebp - 0x11c]
push eax
dec ebx
add esi, 4
mov dword [ebp - 0x11c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100378f
cmp dword [ebp - 0x118], 5
jne 0x100378f
cmp dword [ebp - 0x114], 0
jne 0x100378f
mov dword [0x1008318], 1
call fcn.01005e86
test eax, eax
jne 0x10037ab
push 0x4000277f
call fcn.01005d09
xor eax, eax
pop ecx
inc eax
jmp 0x1003843
test ebx, ebx
push edi
jne 0x10037b4
xor esi, esi
jmp 0x10037d7
push dword [esi]
push 0x1008298
call fcn.0100370b
mov edi, eax
test edi, edi
jne 0x10037e4
push dword [esi]
push 0x400027ab
call fcn.01005d09
pop ecx
xor esi, esi
pop ecx
inc esi
push 0
push 0
call fcn.01006564
mov eax, esi
jmp 0x1003842
dec ebx
add esi, 4
test ebx, ebx
jne 0x1003802
push 0x1001894
push dword [edi + 4]
call fcn.0100370b
push esi
push ebx
call dword [eax + 4]
xor eax, eax
jmp 0x1003842
push dword [esi]
push dword [edi + 4]
call fcn.0100370b
test eax, eax
jne 0x1003839
push dword [esi]
push 0x400027ab
call fcn.01005d09
pop ecx
pop ecx
push 0x1001894
push dword [edi + 4]
call fcn.0100370b
add esi, 4
push esi
dec ebx
push ebx
call dword [eax + 4]
xor eax, eax
inc eax
jmp 0x1003842
add esi, 4
push esi
dec ebx
push ebx
call dword [eax + 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10042bc
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
mov ecx, dword [eax]
add ecx, eax
mov dword [ebx], ecx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov ecx, dword [eax]
add ecx, eax
mov dword [edi], ecx
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 0xc]
push ecx
mov dword [eax + 4], 0x44
mov eax, dword [ebx]
lea ecx, [ebp - 0x104]
push ecx
lea ecx, [eax + 4]
push ecx
add eax, 0x28
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], 0x100
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100431f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x1004390
mov ecx, dword [ebx]
or eax, 0xffffffff
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebx]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov eax, dword [ebx]
push esi
add eax, 0x28
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov ecx, dword [ebx]
mov dword [ecx + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, 7
and ecx, 0xfffffff8
add ecx, 0x28
mov dword [eax], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov edi, dword [edi]
lea esi, [eax + 0x28]
mov eax, ecx
shr ecx, 2
add edi, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 7
and ecx, 0xfffffff8
add ecx, 8
mov dword [eax], ecx
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 0xc