joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b34f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.0041b2ad
push 0x41b3f8
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x545c10], 2
mov ebx, eax
je 0x41b380
call fcn.0041c6ea
mov eax, dword [0x545c14]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x41b3cc
push 0xc
call fcn.00422256
mov esi, eax
pop ecx
test esi, esi
je 0x41b3ae
and dword [esi], 0
and dword [esi + 4], 0
and dword [esi + 8], 0
jmp 0x41b3b0
xor esi, esi
cmp dword [0x545c10], 2
je 0x41b3be
call fcn.0041c6ea
mov eax, dword [0x545c14]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp eax, dword [esi + 8]
je 0x41b3e5
mov dword [eax], ebx
mov dword [eax + 4], edi
add dword [esi + 4], 8
jmp 0x41b3f1
lea ecx, [ebp - 8]
push ecx
push eax
mov ecx, esi
call fcn.0041c744
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41b721
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x24
mov eax, 0x4ecdfc
call fcn.0045be5a
mov ebx, ecx
mov eax, dword [ebx]
call dword [eax + 8]
cmp dword [0x545c18], 2
mov dword [ebp - 0x10], eax
je 0x41b745
call fcn.0041c690
mov eax, dword [0x545c1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x41b7af
push 8
call fcn.00422256
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x41b78d
push 0x18
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.004076e0
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
jmp 0x41b78f
mov esi, eax
or dword [ebp - 4], 0xffffffff
cmp dword [0x545c18], 2
je 0x41b7a1
call fcn.0041c690
mov eax, dword [0x545c1c]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041cc47
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x10]
cmp byte [eax + 0xd], 0
jne 0x41b7d7
cmp edi, dword [eax + 0x10]
jb 0x41b7d7
cmp eax, dword [esi]
je 0x41b7d7
xor al, al
jmp 0x41b7f5
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
push ecx
mov ecx, esi
call fcn.0041ce19
push edi
call dword [sym.imp.USER32.dll_SetCapture]
mov al, 1
call fcn.0045be28
ret
Function at 0x41b7fb
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x545c18], 2
push ebx
push esi
push edi
mov edi, ecx
jne 0x41b8bb
mov eax, dword [0x545c1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x41b8bb
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
mov ebx, eax
mov ecx, esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041cc47
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0xd], 0
jne 0x41b8bb
cmp ebx, dword [ecx + 0x10]
jb 0x41b8bb
cmp ecx, dword [esi]
je 0x41b8bb
cmp dword [ecx + 0x14], edi
jne 0x41b8bb
push ecx
mov ecx, esi
call fcn.0041c942
push 0x18
push eax
call fcn.00407aa0
cmp dword [esi + 4], 0
pop ecx
pop ecx
jne 0x41b8a2
mov ecx, esi
call fcn.0041c64f
push 8
push esi
call fcn.0045b5e1
cmp dword [0x545c18], 2
pop ecx
pop ecx
je 0x41b893
call fcn.0041c690
mov eax, dword [0x545c1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp byte [ebp + 8], 0
je 0x41b8ad
xor eax, eax
inc eax
jmp 0x41b8bd
call dword [sym.imp.USER32.dll_ReleaseCapture]
neg eax
sbb eax, eax
neg eax
jmp 0x41b8bd
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41b8c4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x545c18], 2
push esi
mov dword [ebp - 4], ecx
jne 0x41b913
mov eax, dword [0x545c1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x41b913
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041cc47
mov eax, dword [ebp - 8]
cmp byte [eax + 0xd], 0
jne 0x41b913
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x10]
jb 0x41b913
cmp eax, dword [esi]
je 0x41b913
mov eax, dword [eax + 0x14]
jmp 0x41b915
xor eax, eax
pop esi
leave
ret

Function at 0x41c690
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
mov edx, 0x545c18
inc ecx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41c6df
push esi
push 4
call fcn.00422256
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x41c6c2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
jmp 0x41c6c4
xor esi, esi
mov dword [0x545c1c], esi
mov dword [0x545c18], 2
pop esi
leave
ret
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x545c18], 2
jne 0x41c6d7
leave
ret

Function at 0x41c6ea
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
mov edx, 0x545c10
inc ecx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41c739
push esi
push 4
call fcn.00422256
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x41c71c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
jmp 0x41c71e
xor esi, esi
mov dword [0x545c14], esi
mov dword [0x545c10], 2
pop esi
leave
ret
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x545c10], 2
jne 0x41c731
leave
ret
Function at 0x41f03e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.0041f3bf
test al, al
jne 0x41f052
mov ecx, esi
pop esi
jmp fcn.0041b2ad
pop esi
ret

Function at 0x41fb79
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x53e01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x5c
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call fcn.004beec0
add esp, 0xc
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push esi
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x118
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.004beec0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x11c], 6
jne 0x41fbef
cmp byte [ebp - 6], cl
jne 0x41fbfc
mov bl, cl
cmp dword [ebp - 0x11c], 6
movzx ebx, bl
cmova ebx, ecx
mov ecx, str.Tahoma
test bl, bl
mov eax, 0x52b69c
cmove eax, ecx
push eax
lea eax, [esi + 0x1c]
push 0x20
push eax
call fcn.004d0e66
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.0045b5b0
leave
ret

Function at 0x420e4a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x28], ebx
je case.default.0x420eae
mov edx, dword [ebp + 0x10]
movzx eax, dx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
shr edx, 0x10
mov dword [ebp - 4], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.00420f56
mov edi, eax
test edi, edi
jne 0x420e9d
push esi
push 0x4210fc
call dword [sym.imp.USER32.dll_EnumWindows]
jmp case.default.0x420eae
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [edi - 1]
cmp eax, 7
ja case.default.0x420eae
jmp dword [eax*4 + 0x420f36]
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
cmp edi, 2
setne al
add eax, 0xf001
jmp 0x420f1c
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0xf006
cmp edi, 1
lea ecx, [eax - 3]
jmp 0x420f19
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0xf008
cmp edi, 5
lea ecx, [eax - 4]
jmp 0x420f19
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0xf007
cmp edi, 6
lea ecx, [eax - 2]
cmove eax, ecx
push ebx
push eax
push 0x112
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x42227d
Capabilities:
Check if file exists

Disassembly:
push 0x8c
mov eax, 0x4ed444
call fcn.0045be8d
mov esi, ecx
test esi, esi
je 0x4223d5
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4223d5
xor ebx, ebx
mov dword [ebp - 0x24], 0xaac56b
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], 0x11d0cd44
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
push ecx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.00423a80
pop ecx
test al, al
je 0x4223c9
push 0x52bc58
lea ecx, [ebp - 0x54]
call fcn.00403e20
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.0042394b
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00407b20
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x422337
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4223c2
push str.WinVerifyTrust
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x42234f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4223b9
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], 0x10
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x60], esi
push ecx
push ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x98], 0x34
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x8c], 2
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 0x100
mov dword [ebp - 0x6c], ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
test esi, esi
sete bl
lea ecx, [ebp - 0x3c]
call fcn.00407b20
mov eax, ebx
jmp 0x4223d7
xor eax, eax
call fcn.0045be3c
ret
Function at 0x422ac8
Capabilities:
Check if file exists
Get file version info

Disassembly:
push 0x280
mov eax, 0x4ed4c8
call fcn.0045be8d
mov dword [ebp - 0x284], edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x288], eax
test esi, esi
je 0x422cff
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422cff
lea eax, [ebp - 0x26c]
xor ebx, ebx
push eax
push esi
mov dword [ebp - 0x26c], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x422cff
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
lea eax, [ebp - 0x25d]
mov dword [ebp - 4], ebx
push eax
lea eax, [edi + 1]
mov byte [ebp - 0x25d], bl
push eax
lea ecx, [ebp - 0x27c]
call fcn.004231b0
push dword [ebp - 0x27c]
push edi
push dword [ebp - 0x26c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x422cf0
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], ebx
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x27c]
mov dword [ebp - 0x280], ebx
call esi
test eax, eax
je 0x422cf0
mov ecx, dword [ebp - 0x270]
push 0x52bda8
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004232fb
add esp, 0x1c
mov dword [ebp - 0x264], ebx
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x27c]
call esi
test eax, eax
je 0x422cf0
cmp dword [ebp - 0x264], ebx
je 0x422cf0
push dword [ebp - 0x264]
lea ecx, [ebp - 0x25c]
call fcn.00403e20
inc ebx
lea ecx, [ebp - 0x25c]
push 0x52be04
mov byte [ebp - 4], bl
call fcn.00403d90
xorps xmm0, xmm0
xor edi, edi
and dword [ebp - 0x268], edi
movlpd qword [ebp - 0x20], xmm0
push edi
push 0x52be04
lea ecx, [ebp - 0x25c]
call fcn.00403d50
mov esi, eax
cmp esi, 0xffffffff
je 0x422ce3
push ecx
mov ecx, esi
lea eax, [ebp - 0x25c]
sub ecx, edi
push ecx
push edi
push eax
lea ecx, [ebp - 0x244]
call fcn.00423228
cmp dword [ebp - 0x230], 8
lea eax, [ebp - 0x244]
cmovae eax, dword [ebp - 0x244]
push eax
call fcn.004c359f
pop ecx
mov ecx, dword [ebp - 0x268]
mov word [ebp + ecx*2 - 0x20], ax
lea ecx, [ebp - 0x244]
call fcn.00407b20
mov eax, dword [ebp - 0x268]
lea edi, [esi + 1]
inc eax
mov dword [ebp - 0x268], eax
cmp eax, 4
jl 0x422c3c
movzx ecx, word [ebp - 0x20]
movzx eax, word [ebp - 0x1e]
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 0x284]
mov dword [eax], ecx
movzx ecx, word [ebp - 0x1a]
movzx eax, word [ebp - 0x18]
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 0x288]
mov dword [eax], ecx
jmp 0x422ce5
xor ebx, ebx
lea ecx, [ebp - 0x25c]
call fcn.00407b20
lea ecx, [ebp - 0x27c]
call fcn.00423205
mov eax, ebx
jmp 0x422d01
xor eax, eax
call fcn.0045be3c
ret
Function at 0x422d07
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x53e01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x53fb1c]
push esi
xor esi, esi
push edi
mov edi, 0xfffffc18
cmp eax, 0xffffffff
jne 0x422e85
push 0x110
lea eax, [ebp - 0x324]
mov dword [0x53fb1c], edi
push esi
push eax
mov dword [ebp - 0x328], 0x114
call fcn.004beec0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x422e7b
cmp dword [ebp - 0x318], 2
jne 0x422e7b
cmp dword [ebp - 0x324], 5
jne 0x422e10
mov eax, dword [ebp - 0x320]
test eax, eax
jne 0x422d95
inc eax
jmp 0x422f0b
cmp eax, 1
jne 0x422e01
push 0x7f
lea eax, [ebp - 0x314]
push eax
push 0x52be08
call fcn.004d0fde
add esp, 0xc
test eax, eax
jne 0x422dbb
push 3
jmp 0x422f0a
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_2
call fcn.004d0fde
add esp, 0xc
test eax, eax
jne 0x422ddc
push 4
jmp 0x422f0a
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_3
call fcn.004d0fde
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
jmp 0x422f0b
cmp eax, 2
jne 0x422e7b
push 6
pop eax
mov dword [0x53fb1c], eax
jmp 0x422e80
cmp dword [ebp - 0x324], 6
jne 0x422e7b
cmp dword [ebp - 0x320], esi
jne 0x422e67
push 0x7f
lea eax, [ebp - 0x314]
push eax
push 0x52be08
call fcn.004d0fde
add esp, 0xc
test eax, eax
jne 0x422e42
push 8
jmp 0x422f0a
push 0x7f
lea eax, [ebp - 0x314]
push eax
push str.Service_Pack_2
call fcn.004d0fde
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 9
jmp 0x422f0b
cmp dword [ebp - 0x320], 1
mov eax, dword [0x53fb1c]
push 0xa
pop ecx
cmove eax, ecx
jmp 0x422e09
mov eax, dword [0x53fb1c]
cmp eax, 0xffffffff
je 0x422e8d
cmp eax, edi
jne 0x422f29
push 0x208
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004beec0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.kernel32.dll
lea eax, [ebp - 0x210]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x330]
mov dword [ebp - 0x32c], esi
push eax
lea edx, [ebp - 0x32c]
mov dword [ebp - 0x330], esi
lea ecx, [ebp - 0x210]
call fcn.00422ac8
pop ecx
test eax, eax
je 0x422f24
mov eax, dword [ebp - 0x32c]
cmp eax, 0x60002
jne 0x422f01
push 0xb
jmp 0x422f0a
cmp eax, 0x60003
jne 0x422f12
push 0xc
pop eax
mov dword [0x53fb1c], eax
jmp 0x422f29
cmp eax, 0xa0000
je 0x422f20
cmp eax, 0x60004
jne 0x422f24
push 0xd
jmp 0x422f0a
mov eax, dword [0x53fb1c]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045b5b0
leave
ret
Function at 0x422f37
Capabilities:
Check os version

Disassembly:
push 0x12c
mov eax, 0x4ed524
call fcn.0045be8d
mov esi, ecx
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x134], esi
xor edi, edi
mov dword [ebp - 0x130], edi
xor eax, eax
mov dword [esi], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
xor ebx, ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x114
inc ebx
push eax
mov dword [ebp - 0x130], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x42312c
sub eax, ebx
je 0x4230d2
sub eax, ebx
je 0x422fb4
push str.Unknown
jmp 0x423131
mov eax, dword [ebp - 0x124]
cmp eax, 5
jne 0x423022
mov eax, dword [ebp - 0x120]
cmp eax, 2
jne 0x422fe7
push str.Windows_2003
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, 5
jne 0x423022
mov eax, dword [ebp - 0x120]
cmp eax, ebx
jne 0x423008
push str.Windows_XP
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, 5
jne 0x423022
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x423138
push str.Windows_2000
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, 4
ja 0x423039
push str.Windows_NT
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
push 6
pop edi
cmp eax, edi
jne 0x4230c6
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x42306a
push str.Windows_Vista
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, edi
jne 0x4230c6
mov eax, dword [ebp - 0x120]
cmp eax, ebx
jne 0x42308a
push str.Windows_7
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, edi
jne 0x4230c6
mov eax, dword [ebp - 0x120]
cmp eax, 2
jne 0x4230ab
push str.Windows_8
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, edi
jne 0x4230c6
mov eax, dword [ebp - 0x120]
cmp eax, 3
jne 0x423138
push str.Windows_8.1
mov ecx, esi
call fcn.00403dc0
mov eax, dword [ebp - 0x124]
cmp eax, 0xa
jne 0x423138
push str.Windows_10
jmp 0x423131
cmp dword [ebp - 0x124], 4
jne 0x423138
mov eax, dword [ebp - 0x120]
test eax, eax
jne 0x423100
push str.Windows_95
mov ecx, esi
call fcn.00403dc0
cmp dword [ebp - 0x124], 4
jne 0x423138
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
jne 0x423120
push str.Windows_98
mov ecx, esi
call fcn.00403dc0
cmp dword [ebp - 0x124], 4
jne 0x423138
mov eax, dword [ebp - 0x120]
cmp eax, 0x5a
jne 0x423138
push str.Windows_ME
jmp 0x423131
push str.Windows_Win32s
mov ecx, esi
call fcn.00403dc0
lea ecx, [ebp - 0x12c]
call fcn.004175e0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x12c]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push str.__build_d._d._d_
push eax
call fcn.00417b40
add esp, 0x14
cmp word [ebp - 0x114], 0
je 0x423190
push 0x52bff4
mov ecx, esi
call fcn.00403d90
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00403d90
push dword [ebp - 0x12c]
mov ecx, esi
call fcn.00403d90
lea ecx, [ebp - 0x12c]
call fcn.004175c0
mov eax, esi
call fcn.0045be3c
ret
Function at 0x423334
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x53e01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x10
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x423373
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x78
neg eax
sbb eax, eax
inc eax
jmp 0x4233da
lea eax, [ebp - 0x34]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x423396
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4233da
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 1
push eax
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ecx
push eax
push esi
push dword [ebp - 0x28]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4233cf
xor esi, esi
inc esi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045b5b0
leave
ret

Function at 0x4233e7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
jne 0x423402
xor eax, eax
jmp 0x4234af
cmp byte [0x545e04], 0
jne 0x423417
call fcn.00423334
mov byte [0x545e04], 1
push esi
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x423443
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push ecx
push ebx
push esi
push eax
push 0xc
pop edx
call fcn.0042e630
add esp, 0x14
jmp 0x4233fb
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x423475
cmp dword [esp + 0x10], 0x103
je 0x423475
push ecx
push ecx
push ebx
push esi
push dword [esp + 0x20]
push 0xf
pop edx
call fcn.0042e630
add esp, 0x14
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x42349c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push ecx
push ebx
push esi
push eax
push 0xd
pop edx
call fcn.0042e630
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret