joyce8/EMBER2024-capa huggingface dataset:
Function at 0x37f88d3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
or edi, 0xffffffff
cmp dword [ebp - 4], ebx
jne 0x37f88d66
cmp dword [0x37fe5e00], ebx
je 0x37f88d75
mov dword [ebp - 0xc], 2
jmp 0x37f88d82
cmp dword [ebp - 4], 1
jne 0x37f88d75
call fcn.37f87b2b
test eax, eax
je 0x37f88d7f
test byte [esi + 0xc], 0x10
je 0x37f88e72
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x18]
call fcn.37f87d47
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.37f88002
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x37f88e68
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x37f88dcf
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.37f87bc4
pop ecx
test eax, eax
je 0x37f88e34
push 0x796d746c
xor edi, edi
push edi
call fcn.37f8b39e
push ebx
mov ecx, 0x37fe5b08
call fcn.37f87fa4
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], edi
call fcn.37f88002
mov edi, eax
add esp, 0x14
test edi, edi
je 0x37f88dbb
jmp 0x37f88e68
push ebx
mov ecx, 0x37fe5b08
call fcn.37f87eac
test edi, edi
jne 0x37f88e68
movzx eax, word [esi + 0xc]
mov ecx, eax
and ecx, 0xf
cmp dword [ebp - 0x14], ecx
je 0x37f88e86
cmp dword [ebp - 0x14], 3
jne 0x37f88e65
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 4
jne 0x37f88e65
and al, 0xf
cmp al, 4
je 0x37f88e86
push 2
pop edi
lea ecx, [ebp - 0x18]
call fcn.37f87d6b
xor ebx, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x37f88d4d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x18]
mov dword [eax], 1
call fcn.37f87d6b
xor eax, eax
jmp 0x37f88e81
Function at 0x37f890bb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x37f890d3
xor eax, eax
jmp 0x37f89230
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.37f87b2b
mov eax, dword [esi]
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x37f890f0
push eax
call fcn.37f99ddb
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
push ebx
or ebx, 0xffffffff
cmp dword [ebp - 8], edi
jne 0x37f8910d
cmp dword [0x37fe5e00], edi
je 0x37f8911c
mov dword [ebp - 0x18], 2
jmp 0x37f89129
cmp dword [ebp - 8], 1
jne 0x37f8911c
call fcn.37f87b2b
test eax, eax
je 0x37f89126
test byte [esi + 0xc], 0x10
je 0x37f891dc
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], edi
call fcn.37f87d47
jmp 0x37f89193
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x37f89142
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov ebx, eax
jae 0x37f8916d
cmp dword [ebp - 0x10], 1
je 0x37f8916a
cmp dword [ebp - 0x10], 2
jne 0x37f8916d
push 2
pop ebx
push ebx
call fcn.37f87bc4
pop ecx
test eax, eax
je 0x37f891c3
push 0x796d746f
push edi
call fcn.37f8b39e
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87fa4
mov dword [ebp + 8], edi
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], edi
call fcn.37f88002
mov ebx, eax
add esp, 0x14
cmp ebx, edi
je 0x37f89136
jmp 0x37f891d4
push dword [ebp + 8]
mov ecx, 0x37fe5b08
call fcn.37f87eac
cmp ebx, edi
je 0x37f891eb
lea ecx, [ebp - 0x1c]
call fcn.37f87d6b
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x37f890f4
jmp 0x37f891f3
lea ecx, [ebp - 0x1c]
call fcn.37f87d6b
cmp ebx, edi
jne 0x37f89212
cmp dword [ebp - 0x10], 2
je 0x37f89206
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x37f89212
push dword [ebp - 4]
call fcn.37f89419
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], edi
je 0x37f8921f
push dword [ebp - 0x14]
call fcn.37f8acc0
cmp ebx, edi
pop ebx
je 0x37f8922d
push esi
call fcn.37f897f5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x37f89236
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.37f890bb
Function at 0x37f899e1
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x37fe57f0]
sub esp, 0x18
push ebx
push esi
push edi
mov dword [0x37fe5e20], eax
mov eax, dword [0x37fe5e0c]
xor edi, edi
cmp eax, edi
je 0x37f89a1d
push eax
call fcn.37f89885
push dword [0x37fe57f0]
mov dword [0x37fe5e20], eax
push dword [0x37fe5e0c]
call fcn.37f89434
jmp 0x37f89a93
mov eax, dword [0x37fe5e10]
cmp eax, edi
je 0x37f89a93
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 8]
push ecx
push 0x2001f
push eax
push SysReAllocString
mov dword [ebp - 0x18], 4
call fcn.37f98279
test eax, eax
jne 0x37f89a93
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov esi, 0x37f625ec
push esi
push dword [ebp - 8]
call fcn.37f8b414
test eax, eax
jne 0x37f89a8a
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x18]
mov dword [0x37fe5e20], eax
mov eax, dword [0x37fe57f0]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp - 8]
call fcn.37f8b432
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x37fb194c], edi
je 0x37f89aac
call fcn.37f899c0
push eax
push dword [0x37fb194c]
call fcn.37f89434
call fcn.37f899c0
mov esi, eax
call fcn.37f8999f
mov ebx, eax
cmp esi, ebx
je 0x37f89bc2
movzx eax, si
push eax
call fcn.37fa142f
test eax, eax
jne 0x37f89ae0
movzx eax, bx
push eax
call fcn.37fa142f
test eax, eax
je 0x37f89bc2
lea eax, [ebp - 4]
push eax
push 0x20019
push 0x37f62200
call fcn.37f89366
test eax, eax
jne 0x37f89bc2
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x37f89bc2
imul eax, eax, 0x104
push eax
lea eax, [ebp - 0xc]
mov esi, 0x104
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
call fcn.37f8ae96
test eax, eax
jne 0x37f89b4a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x37f89bc2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x37f89b96
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x37f89b96
add dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 8]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
add ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x37f89b68
mov ebx, dword [ebp - 8]
cmp ebx, edi
jle 0x37f89bb1
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add edi, esi
dec ebx
jne 0x37f89b9d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.37f8acc0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x37f8a875
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x37f8a896
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x37f8a896
cmp edx, eax
jb 0x37f8a896
add eax, 0x10000
cmp eax, ecx
jae 0x37f8a8c1
mov eax, dword [0x37fb1958]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.37f8b30c
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
ret

Function at 0x37f8afc4
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 4]
push eax
push 1
push ecx
xor esi, esi
push edx
mov dword [esp + 0x14], esi
call fcn.37f982a0
test eax, eax
jne 0x37f8b02e
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x37f8b02e
cmp dword [esp + 0x10], 4
jne 0x37f8b02e
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x37f8b045
push eax
mov dword [esp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x37f8b5c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x414], ecx
test esi, esi
jne 0x37f8b600
xor eax, eax
jmp 0x37f8b770
and dword [esi], 0
push ebx
push edi
mov edi, dword [ebp + 0x20]
xor ebx, ebx
inc ebx
push ebx
push edi
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x420], ebx
call fcn.37f8ea37
and dword [ebp - 0x410], 0
and dword [ebp - 0x418], 0
shr edi, 0x1a
not edi
mov dword [ebp - 0x408], eax
and edi, ebx
cmp dword [ebp - 0x408], 0
je 0x37f8b665
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x17
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [esi], eax
cmp dword [esi], 0
jne 0x37f8b701
test edi, edi
je 0x37f8b701
and dword [ebp - 0x40c], 0
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.37f8e8f9
test eax, eax
je 0x37f8b6e7
mov eax, dword [ebp + 0x20]
push dword [ebp - 0x408]
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x20]
call fcn.37f8e680
cmp dword [ebp - 0x40c], 5
jne 0x37f8b6e7
cmp dword [ebp - 0x418], 0
jne 0x37f8b6e7
mov dword [ebp - 0x418], ebx
jmp 0x37f8b640
cmp dword [esi], 0
je 0x37f8b701
xor eax, eax
cmp dword [ebp - 0x40c], 0xb7
setne al
mov dword [ebp - 0x410], eax
mov eax, dword [esi]
xor ecx, ecx
cmp eax, ecx
je 0x37f8b70e
cmp eax, 0xffffffff
jne 0x37f8b72d
cmp edi, ecx
je 0x37f8b71d
push ecx
push 0x787a6c65
call fcn.37f8b30c
xor ecx, ecx
mov dword [esi], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x420], ecx
pop edi
pop ebx
cmp dword [ebp - 0x41c], ecx
je 0x37f8b758
mov eax, dword [ebp - 0x408]
cmp eax, ecx
jne 0x37f8b746
mov eax, 0x37f61df4
push dword [ebp + 0x14]
push dword [ebp - 0x41c]
push eax
call fcn.37f894bd
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x37f8b76a
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.37facac9
leave
ret 0x1c
Function at 0x37f8c414
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x30]
push eax
call fcn.37f8b531
test eax, eax
jne 0x37f8c431
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
push edi
push eax
push 0x11
call fcn.37f84bee
push dword [ebp - 0x1c]
push 0x12
call fcn.37f84bee
push 0x37f62b88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp eax, edi
je 0x37f8c532
push esi
push 0x37f62b68
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x37f8c531
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x37f8c531
push dword [ebp - 4]
call fcn.37f8ab5b
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x37f8c529
lea ecx, [ebp - 4]
push ecx
push eax
call esi
test eax, eax
je 0x37f8c529
mov eax, dword [ebp - 4]
push 0x18
xor edx, edx
pop ecx
div ecx
xor esi, esi
mov dword [ebp - 8], edi
cmp eax, edi
jbe 0x37f8c529
mov edx, dword [ebp - 0xc]
push ebx
mov ebx, eax
mov eax, dword [edx + 4]
sub eax, 0
je 0x37f8c4e0
dec eax
dec eax
jne 0x37f8c4f1
push dword [edx]
call fcn.37f8be32
pop ecx
cmp edi, eax
ja 0x37f8c4f1
mov edi, eax
jmp 0x37f8c4f1
push dword [edx]
inc dword [ebp - 8]
call fcn.37f8be32
pop ecx
cmp esi, eax
ja 0x37f8c4f1
mov esi, eax
add edx, 0x18
dec ebx
jne 0x37f8c4c4
pop ebx
test esi, esi
je 0x37f8c507
push esi
push 0x19e1
call fcn.37f84bee
test edi, edi
je 0x37f8c516
push edi
push 0x19e2
call fcn.37f84bee
cmp dword [ebp - 8], 0
je 0x37f8c529
push dword [ebp - 8]
push 0x19e0
call fcn.37f84bee
push dword [ebp - 0xc]
call fcn.37f8ab8f
pop esi
pop edi
leave
ret

Function at 0x37f8c598
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x37f8c5ba
xor esi, esi
jmp 0x37f8c63f
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x37f8c5b3
push esi
call fcn.37f8ab5b
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x37f8c5e1
push ebx
push 0x33753468
jmp 0x37f8c62a
push eax
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x37f8c5f8
push ebx
push 0x33753469
jmp 0x37f8c62a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x37f61c4c
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x37f8c624
cmp dword [ebp - 4], 0x34
jne 0x37f8c624
mov esi, dword [ebp - 8]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
jmp 0x37f8c631
push ebx
push 0x3375346a
call fcn.37f8b30c
xor esi, esi
cmp dword [ebp + 0xc], ebx
je 0x37f8c63f
push dword [ebp + 0xc]
call fcn.37f83ace
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x37f8c846
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x37f62bf0
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x118
lea eax, [ebp - 0x138]
push ebx
push eax
mov dword [ebp - 0x140], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x13c], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
push 1
push ebx
push 0x37f62bc4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x37f8c8ff
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
push 0x37f62bb4
push dword [ebp - 0x144]
mov dword [ebp - 0x14c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x37f8c8f1
push dword [ebp - 0x148]
push 0x22df
call fcn.37f84bee
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x37f8c90a
push ebx
push 0x66397234
call fcn.37f8b30c
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x37f8c994
push dword [ebp - 0x130]
push 0x1a
call fcn.37f84bee
movzx eax, word [ebp - 0x28]
movzx ecx, word [ebp - 0x26]
shl eax, 0x10
or eax, ecx
push eax
push 0x43
call fcn.37f84bee
movzx eax, word [ebp - 0x24]
push eax
push 0x3a5
call fcn.37f84bee
push dword [ebp - 0x138]
push 0x22e1
call fcn.37f84bee
push dword [ebp - 0x134]
push 0x22e2
call fcn.37f84bee
movzx eax, word [ebp - 0x28]
push eax
push 0x22e4
call fcn.37f84bee
movzx eax, word [ebp - 0x26]
push eax
push 0x22e5
call fcn.37f84bee
call fcn.37f97e00
test eax, eax
je 0x37f8ca27
lea eax, [ebp - 0x20]
push eax
call fcn.37f83e17
mov esi, eax
cmp esi, ebx
jne 0x37f8c9b8
push ebx
push 0x38317137
jmp 0x37f8ca05
push 0x37f62ba4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x37f8c9d0
push ebx
push 0x38317138
jmp 0x37f8ca05
lea ecx, [ebp - 0x140]
push ecx
movzx ecx, word [ebp - 0x26]
push ecx
movzx ecx, word [ebp - 0x28]
push ecx
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call eax
test eax, eax
jne 0x37f8ca0c
push 0xffffffffffffffff
push 0x1af7
call fcn.37f84bee
push ebx
push 0x38317139
call fcn.37f8b30c
jmp 0x37f8ca1c
push dword [ebp - 0x140]
push 0x1af7
call fcn.37f84bee
cmp esi, ebx
je 0x37f8ca27
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.37facac9
leave
ret
Function at 0x37f8cdca
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x37f8ce3a
push esi
lea eax, [ebp - 4]
push eax
call fcn.37f8ae96
test eax, eax
je 0x37f8ce3a
push dword [ebp - 4]
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x37f8ce32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x37f61c4c
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x37f8ce32
cmp dword [ebp - 8], ebx
je 0x37f8ce32
mov esi, dword [ebp - 0xc]
push edi
mov edi, dword [ebp + 0xc]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov bl, 1
pop edi
push dword [ebp - 4]
call fcn.37f8acc0
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x37f8d5d6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [0x37fe57f0]
mov edi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.37f8d251
add esp, 0x10
call fcn.37f8d5bc
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.37f8d251
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.37f8d251
call fcn.37f89bc7
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push edi
push esi
call fcn.37f8d251
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.37f8d1f7
add esp, 0x30
pop edi
pop esi
pop ebp
ret

Function at 0x37f90e94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x37fb1e9c], 0xffffffff
jne 0x37f90f10
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [0x37fb1e94]
mov dword [0x37fb1e9c], 1
push SysReAllocString
call fcn.37f98279
test eax, eax
jne 0x37f90f10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x37fb1e98]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x37f90f07
cmp dword [ebp - 0xc], 4
jne 0x37f90f07
cmp dword [ebp - 0x10], eax
je 0x37f90f07
mov dword [0x37fb1e9c], 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x37fb1e9c]
leave
ret
Function at 0x37f97e0d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x37f97ee0
cmp dword [ebp - 0x90], 2
mov ecx, dword [ebp - 0x98]
mov al, byte [ebp - 6]
push esi
mov dword [0x37fe8484], ecx
mov byte [0x37fe848a], al
jne 0x37f97ecc
mov eax, dword [ebp - 0x9c]
mov dx, word [ebp - 0xc]
mov dword [0x37fe8480], eax
mov word [0x37fe8488], dx
cmp eax, 5
jne 0x37f97eae
mov esi, 0x37f61df4
cmp ecx, 1
jae 0x37f97e90
push 0
push esi
push 0x3535796e
push esi
call fcn.37f8cdaa
cmp dword [ebp - 0x98], 1
jne 0x37f97eae
cmp word [ebp - 0xc], 1
ja 0x37f97eae
push 0
push esi
push 0x3535796f
push esi
call fcn.37f8cdaa
movzx eax, word [ebp - 8]
mov ecx, eax
and ecx, 0x110
and eax, 0x100
mov dword [0x37fe8490], ecx
mov dword [0x37fe8494], eax
jmp 0x37f97edf
push 0
mov esi, 0x37f61df4
push esi
push 0x31343461
push esi
call fcn.37f8cdaa
pop esi
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
xor ecx, ebp
mov dword [0x37fe848c], eax
call fcn.37facac9
leave
ret

Function at 0x37f97fda
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x37f97ff4
test al, 0x10
je 0x37f97ff4
xor eax, eax
inc eax
jmp 0x37f97ff6
xor eax, eax
pop ebp
ret 4

Function at 0x37f980a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x37f6d4f0
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x37f9811c
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x37f6d4d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x37f98113
cmp dword [ebp - 8], 1
jne 0x37f98113
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x37f62a68
call esi
test eax, eax
jne 0x37f98110
push 0x37f62a54
call esi
test eax, eax
je 0x37f98113
xor edi, edi
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x37f98122
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x37f7d24c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x224], esi
call fcn.37f97f0b
test eax, eax
je 0x37f9823d
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
mov ebx, 0x37f6d570
push ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x37f9823b
lea eax, [ebp - 0x214]
push eax
push 0x20119
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x37f9822f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x37f6d55c
push edi
push dword [ebp - 0x218]
mov ebx, 0x20a
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x37f98223
cmp dword [ebp - 0x21c], 1
jne 0x37f98223
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
call esi
test eax, eax
jne 0x37f98223
xor esi, esi
inc esi
cmp dword [ebp - 0x21c], esi
jne 0x37f98223
call fcn.37f980a6
test eax, eax
jne 0x37f98223
mov dword [ebp - 0x224], esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
xor ecx, ebp
pop esi
call fcn.37facac9
leave
ret