joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029d00
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x101c
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebp
mov ebp, dword [esp + 0x1030]
lea eax, [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1028]
push edi
push 0x1000
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x800
mov edi, 0x20019
test ebp, ebp
je 0x10029d65
cmp dword [ebp], 0
mov edi, 0x100
mov eax, 0x200
cmovne edi, eax
or edi, 0x20019
cmp dword [esp + 0x1034], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
je 0x10029d8e
mov eax, 0x10042150
jmp 0x10029dab
push edi
push str.SOFTWAREJavaSoftJRE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.10003a10
test eax, eax
je 0x10029de8
mov eax, str.SOFTWAREJavaSoftJava_Runtime_Environment
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.10003a10
test eax, eax
je 0x10029de8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10029dce
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x101c
ret
push ebx
xor ebx, ebx
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x10029ecb
cmp dword [esp + 0x1038], 0
je 0x10029e60
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.1002a610
add esp, 8
test eax, eax
je 0x10029e40
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.1002ad90
add esp, 8
test eax, eax
jne 0x10029e60
push str.Ignore_invalid_deploy_version:
call fcn.10003ca0
lea eax, [esp + 0x2c]
push eax
call fcn.10003ca0
add esp, 8
xor eax, eax
mov word [esp + 0x28], ax
jmp 0x10029e98
cmp word [esp + 0x28], 0
je 0x10029e98
test ebx, ebx
je 0x10029e7e
lea eax, [esp + 0x28]
push esi
push eax
call fcn.10016410
add esp, 8
test eax, eax
jle 0x10029e98
lea eax, [esp + 0x28]
push eax
push 0x100406a0
push dword [esp + 0x103c]
push esi
call fcn.10005d50
add esp, 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0x800
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc ebx
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
je 0x10029e12
cmp dword [esp + 0x1038], 0
mov ecx, str.Latest_deploy_version:
mov eax, str.Latest_JRE_version:
cmovne eax, ecx
push eax
call fcn.10003ca0
push esi
call fcn.10003ca0
add esp, 8
pop ebx
test edi, edi
je 0x10029efc
cmp edi, 0x103
jne 0x10029f03
mov edx, 1
jmp 0x10029f05
xor edx, edx
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10029f10
mov eax, dword [esp + 0x10]
sub esi, ecx
sar esi, 1
mov esi, 0
cmovne esi, edx
test eax, eax
je 0x10029f36
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1024]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1003b4ee
add esp, 0x101c
ret
Function at 0x1002bb90
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
mov eax, 0x110c
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x1108], eax
lea eax, [esp]
push eax
push 0x1000
lea eax, [esp + 0xc]
push eax
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x1002bc32
mov eax, dword [esp]
shr eax, 2
push esi
xor esi, esi
mov dword [esp + 4], eax
test eax, eax
je 0x1002bc31
push ebx
mov ebx, dword [sym.imp.kernel32.dll_TerminateProcess]
push ebp
mov ebp, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
nop
push dword [esp + esi*4 + 0x14]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov edi, eax
lea eax, [esp + 0x1014]
push 0x104
push eax
push edi
call sub.psapi.dll_GetProcessImageFileNameA
lea eax, [esp + 0x1014]
push str.jp2launcher.exe
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x1002bc24
push 0
push edi
call ebx
push edi
call ebp
inc esi
cmp esi, dword [esp + 0x10]
jb 0x1002bbe0
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0x1108]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x110c
ret
Function at 0x1002e5c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x64
push eax
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
mov esi, 0x200
push SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1002e66c
call fcn.10030880
test eax, eax
je 0x1002e641
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push 4
push eax
call fcn.1003c33a
mov esi, dword [esp + 0x14]
add esp, 0x10
jmp 0x1002e649
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 0x18]
push eax
push 3
push 0
push str.EnableAutoUpdateCheck
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x214
ret

Function at 0x1002e720
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x202
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002e758
push str.EnableAutoUpdateCheck
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x1002e850
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x208], eax
lea eax, [esp]
mov dword [esp + 4], 0x200
push eax
push 0x201
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002e8d4
push esi
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.ITCONFIG
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1002e8d4
movzx eax, byte [esp + 8]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor eax, eax
xor ecx, esp
call fcn.1003b4ee
add esp, 0x20c
ret
Function at 0x1002ed20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x818]
mov ecx, dword [esp + 0x824]
push ebx
push ebp
mov ebp, dword [esp + 0x824]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x82c]
push edi
xor edi, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
test eax, eax
jne 0x1002ed98
lea eax, [esp + 0x10]
push eax
push 0x20219
push ebx
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002ed94
mov ecx, dword [esp + 0x14]
lea ebx, [edi + 1]
jmp 0x1002ed9c
xor eax, eax
jmp 0x1002ee09
mov dword [esp + 0x10], eax
push ecx
push esi
lea ecx, [esp + 0x24]
push ecx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test ebp, ebp
jne 0x1002edb8
lea edi, [eax + 1]
jmp 0x1002edf9
cmp ebp, 2
je 0x1002edf9
call dword [sym.imp.kernel32.dll_GetLastError]
push 0x800
mov esi, eax
lea eax, [esp + 0x24]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push ebp
push dword [esp + 0x2c]
lea eax, [esp + 0x38]
push str.RegQueryValueEx__s_:_Error:_d__ErrorCode:_d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x40]
push eax
call fcn.10033920
add esp, 0x24
test ebx, ebx
je 0x1002ee07
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x814
ret
Function at 0x1002f280
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1014
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x1010], eax
mov eax, dword [esp + 0x1020]
push ebx
push ebp
mov ebp, dword [esp + 0x1024]
push esi
push edi
mov edi, dword [esp + 0x1028]
xor esi, esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1034]
push 0x800
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push esi
push eax
mov dword [esp + 0x1c], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
jne 0x1002f32b
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.SoftwareJreMetrics
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1002f303
lea ebx, [edi + 1]
jmp 0x1002f335
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push ebp
lea eax, [esp + 0x2c]
push str.GetJreMetrics_____RegOpenKeyEx__s_:_Error:_d__ErrorCode:_d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x34]
push eax
call fcn.10033920
add esp, 0x18
jmp 0x1002f32f
mov dword [esp + 0x10], edi
xor ebx, ebx
test esi, esi
jne 0x1002f3ae
push dword [esp + 0x14]
lea eax, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push 0
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x1002f39c
cmp edi, 2
je 0x1002f39c
call dword [sym.imp.kernel32.dll_GetLastError]
push 0x800
mov esi, eax
lea eax, [esp + 0x824]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push edi
push ebp
lea eax, [esp + 0x838]
push str.GetJreMetrics_____RegQueryValueEx__s_:_Error:_d__ErrorCode:_d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x840]
push eax
call fcn.10033920
add esp, 0x24
test ebx, ebx
je 0x1002f3aa
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1002f3b0
mov eax, esi
mov ecx, dword [esp + 0x1020]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x1014
ret
Function at 0x1002f3d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x22c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [esp + 0x230]
lea ecx, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], eax
xor esi, esi
mov dword [esp + 0x2c], 0
xor edi, edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call fcn.10003a10
test eax, eax
je 0x1002f471
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002f4d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1002f603
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0x20019
push str.JavaSoft
push ebx
call fcn.10003a10
test eax, eax
je 0x1002f49e
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1002f4d2
push eax
jmp 0x1002f4d0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push 0x20019
push str.Java_Runtime_Environment
push ebp
call fcn.10003a10
test eax, eax
je 0x1002f4e0
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1002f4cb
push eax
call esi
test ebp, ebp
je 0x1002f4d2
push ebp
call esi
test ebx, ebx
je 0x1002f4d9
push ebx
call esi
xor eax, eax
jmp 0x1002f603
mov ebp, dword [esp + 0x2c]
xor eax, eax
push 0x80
mov word [esp + 0x13c], ax
lea eax, [esp + 0x3c]
push eax
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1002f5e2
nop dword [eax]
lea eax, [esp + 0x138]
inc esi
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x1002f5aa
mov ecx, 0x100415dc
lea eax, [esp + 0x38]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002f55a
test dx, dx
je 0x1002f556
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002f55a
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002f534
xor eax, eax
jmp 0x1002f55f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1002f5aa
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002f570
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x1002f5aa
xor eax, eax
nop word [eax + eax]
movzx ecx, word [esp + eax + 0x38]
lea eax, [eax + 2]
mov word [esp + eax + 0x136], cx
test cx, cx
jne 0x1002f590
mov edi, 1
push 0x80
lea eax, [esp + 0x3c]
push eax
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1002f510
test edi, edi
je 0x1002f5e2
lea eax, [esp + 0x138]
push eax
push 0x100406a0
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1002f5ef
push ebp
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002f5fa
push eax
call esi
test ebx, ebx
je 0x1002f601
push ebx
call esi
mov eax, edi
mov ecx, dword [esp + 0x238]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x22c
ret
Function at 0x100305b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x90
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
push 0x80
xor esi, esi
lea eax, [esp + 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x20219
push esi
push str.SOFTWAREJavaSoftAuto_Update
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003069f
lea eax, [esp + 8]
mov dword [esp + 8], 0x40
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 1
push eax
lea eax, [esp + 0x14]
push eax
push esi
push str.AUVersion
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030670
push 0x40
lea eax, [esp + 0x14]
push 0x10047ca4
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
js 0x1003067d
push dword [esp + 4]
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x90
ret
push str.GetRegAUVersion_failed_to_query_key.
call fcn.10033920
add esp, 4
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x90
ret
push str.RegOpenKeyEx_failed.
call fcn.10033920
mov ecx, dword [esp + 0x94]
add esp, 4
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x90
ret

Function at 0x100306d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x118
lea eax, [esp + 8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp], 0x11c
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
jne 0x10030737
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
jne 0x10030737
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x120
ret
cmp dword [esp + 0x10], 2
jne 0x10030766
mov eax, dword [esp + 4]
cmp eax, 6
jae 0x10030766
cmp eax, 4
jb 0x10030766
call fcn.10030b70
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
mov eax, 1
xor ecx, esp
call fcn.1003b4ee
add esp, 0x120
ret
Function at 0x10030780
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
xor edi, edi
mov dword [esp + 8], 0x200
call fcn.1002e850
test al, 0x10
jne 0x100307b1
call fcn.10030a20
test eax, eax
jne 0x100307cc
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x210
ret
lea eax, [esp + 4]
push eax
push 0x201
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10030855
push esi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.EnableAutoUpdateCheck
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10030855
mov dword [esp + 0xc], edi
call fcn.10030880
test eax, eax
je 0x10030846
push 4
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.1003c33a
mov eax, dword [esp + 0x1c]
add esp, 0x10
jmp 0x1003084a
mov eax, dword [esp + 0x10]
cmp eax, 0x64
mov ecx, 1
cmove edi, ecx
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x210
ret

Function at 0x10030880
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xfffffffffffffffe
push 0x1004b6e0
push 0x1003b8cc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100530a0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp], 0x114
push pe_nt_image_headers32
push edi
lea eax, [ebp + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [ebp + 0x10], 2
jne 0x10030936
cmp dword [ebp + 4], 5
jb 0x10030936
mov dword [ebp - 4], edi
push str.Crypt32.dll
call fcn.10003eb0
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x1003092a
push str.CryptProtectData
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.10030961
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.1003b4ee
lea esp, [ebp + 0x118]
pop ebp
ret
Function at 0x10030a20
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x118], eax
push pe_nt_image_headers32
lea eax, [esp + 0xc]
mov dword [esp + 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x114
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x10030ac7
mov eax, dword [esp + 8]
cmp eax, 6
je 0x10030aad
cmp eax, 5
jne 0x10030ac7
mov eax, dword [esp + 0xc]
cmp eax, 1
jae 0x10030aad
cmp word [esp + 0x18], 0
je 0x10030aa3
lea eax, [esp]
push eax
lea eax, [esp + 0x1c]
push str.Service_Pack__d
push eax
call fcn.10033b00
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x10030ac7
cmp dword [esp], 2
jb 0x10030ac7
mov eax, 1
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x11c
ret
mov ecx, dword [esp + 0x118]
xor eax, eax
xor ecx, esp
call fcn.1003b4ee
add esp, 0x11c
ret
Function at 0x10030b70
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x28
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
push str.advapi32.dll
call fcn.10003eb0
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
add esp, 4
mov ebp, eax
mov dword [esp + 0x1c], ebp
push 0x10048638
push ebp
call esi
push 0x10048654
push ebp
mov edi, eax
call esi
push 0x10048668
push ebp
mov ebx, eax
call esi
push str.EqualSid
push ebp
mov dword [esp + 0x28], eax
call esi
push 0x10048688
push ebp
mov dword [esp + 0x2c], eax
call esi
mov esi, eax
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x54]
mov word [esp + 0x58], 0x500
push eax
mov dword [esp + 0x44], 0
call edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 8
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call ebx
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 2
push dword [esp + 0x20]
mov dword [esp + 0x28], 0
call edi
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10030c85
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [esp + 0x18]
call esi
test ebp, ebp
je 0x10030c70
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x28
ret
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push 2
push dword [esp + 0x20]
call edi
xor esi, esi
cmp dword [ebx], esi
jbe 0x10030cbc
mov ebp, dword [esp + 0x24]
lea edi, [ebx + 4]
push dword [edi]
push dword [esp + 0x1c]
call ebp
test eax, eax
jne 0x10030cb8
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x10030ca4
mov ebp, dword [esp + 0x1c]
xor eax, eax
cmp esi, dword [ebx]
push ebx
setne al
mov dword [esp + 0x20], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [esp + 0x2c]
test ebp, ebp
je 0x10030cee
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x28
ret