Function at 0x10008191
Capabilities:
Check if file exists
Check os version
Create directory
Get common file path
Get hostname
Get mac address on windows
Initialize winsock library
Query or enumerate registry value
Resolve dns
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1a6c
call fcn.10139950
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x108]
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x100089c6
cmp dword [eax + 4], esi
je 0x100089c6
test byte [eax + 0x10], 4
je 0x100089c6
lea eax, [ebx - 4]
mov dword [esp + 0x30], eax
call fcn.1000997f
test eax, eax
jne 0x100081ec
push 0xe00b1002
mov eax, 0x1018aa4c
jmp 0x100089d0
cmp dword [ebp + 0xc], esi
jne 0x10008200
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x100089d0
mov eax, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x2c], esi
call dword [eax + 0x38]
cmp word [esp + 0x24], si
jne 0x10008225
push 0xe00b100c
mov eax, 0x1018a9a8
jmp 0x100089d0
cmp dword [ebp + 0x14], 3
ja 0x100081f1
mov dword [esp + 0x3c], esi
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0xc]
push str.1.2.840.113549.1.1.1
push dword [eax + 0x38]
call fcn.101343f0
pop ecx
pop ecx
test eax, eax
jne 0x10008265
cmp dword [ebp + 0x14], 1
jg 0x100081f1
cmp dword [ebp + 0x14], esi
setne al
add eax, 5
mov dword [esp + 0x3c], eax
jmp 0x100082aa
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0xc]
push str.1.2.840.10045.2.1
push dword [eax + 0x38]
call fcn.101343f0
pop ecx
pop ecx
test eax, eax
jne 0x100082aa
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x100082a2
cmp eax, 2
je 0x100082a2
cmp eax, esi
je 0x10008298
cmp eax, 3
jne 0x100081f1
mov dword [esp + 0x3c], 0x80020102
jmp 0x100082aa
mov dword [esp + 0x3c], 0x80020101
lea eax, [esp + 0x94]
push eax
mov eax, dword [ebx + 0x10]
call fcn.1001c89c
mov dword [esp + 0xc], eax
cmp eax, esi
jne 0x1000892b
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
cmp dword [eax + 0x40], esi
jne 0x100082e2
mov edi, dword [esp + 0x30]
call fcn.100099d3
cmp eax, esi
jne 0x100089df
lea edi, [ebx + 0x34]
mov eax, dword [edi]
cmp eax, esi
jne 0x1000831d
mov ecx, dword [ebx + 0x10]
push edi
push 3
push dword [ebx + 0x2c]
call fcn.1001cd01
test eax, eax
jne 0x10008303
mov eax, dword [edi]
cmp eax, esi
jne 0x1000831d
mov dword [esp + 0xc], 0x60
push dword [esp + 0x30]
mov esi, dword [esp + 0x10]
call fcn.1000a24e
jmp 0x100089df
push eax
lea eax, [esp + 0x40]
push eax
mov eax, dword [ebx + 0x10]
call fcn.1001cb08
mov dword [esp + 0xc], eax
cmp eax, esi
jne 0x1000892b
push dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
push dword [ebp + 0xc]
call fcn.1001cb3b
mov dword [esp + 0xc], eax
cmp eax, esi
jne 0x1000892b
push dword [ebp + 0x1c]
mov eax, dword [ebx + 0x10]
push dword [ebp + 0x18]
call fcn.1001cb6e
mov dword [esp + 0xc], eax
xor eax, eax
push 0x40e
mov word [esp + 0x924], ax
lea eax, [esp + 0x926]
push esi
push eax
call fcn.10131950
add esp, 0xc
push str.SOFTWAREHebcaUSBKey
lea eax, [esp + 0x924]
push 0x1018b7e8
push eax
call fcn.10131892
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0x20019
push esi
lea eax, [esp + 0x92c]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push esi
lea eax, [esp + 0x40]
push eax
push esi
push str.SignLog
push dword [esp + 0x40]
call edi
test eax, eax
jne 0x1000892b
push 4
pop eax
cmp dword [esp + 0x38], eax
jne 0x1000892b
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x40]
push eax
push esi
push str.SignLog
push dword [esp + 0x40]
call edi
cmp dword [esp + 0x48], 1
jne 0x1000892b
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebp + 0x1c]
push dword [ebp + 0x18]
mov edi, dword [eax]
call fcn.10011bc6
xor eax, eax
push 0x206
mov word [esp + 0x1ac], ax
lea eax, [esp + 0x1ae]
push esi
push eax
call fcn.10131950
add esp, 0xc
push 0x208
lea eax, [esp + 0x1ac]
push esi
push eax
call fcn.10131950
add esp, 0xc
lea eax, [esp + 0x808]
push eax
mov dword [esp + 0x80c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x80c], 6
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
lea eax, [esp + 0x1ac]
jb 0x100084a8
push 0x28
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.AppDataLocalLow
lea eax, [esp + 0x1ac]
push eax
push eax
call edi
jmp 0x100084b2
push 0x1c
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.hebcap11log
lea eax, [esp + 0x1ac]
push eax
push eax
call edi
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100084e3
push esi
lea eax, [esp + 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x5a]
push eax
movzx eax, word [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x62]
push eax
movzx eax, word [esp + 0x64]
push eax
push str._d_02d_02d_02d_02d_02d_03d
lea eax, [esp + 0x728]
push 0x80
push eax
call fcn.1013192a
lea eax, [esp + 0x730]
push eax
lea eax, [esp + 0x1d4]
push eax
push str._s_s.log
push eax
call fcn.10131892
mov eax, dword [ebx]
add esp, 0x38
lea ecx, [esp + 0x14]
push ecx
push ebx
mov dword [esp + 0x1c], esi
call dword [eax + 0x5c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
call dword [ecx + 0x1c]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0xd34]
push eax
mov dword [esp + 0x68], 0x1f4
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x1c], 0x1018a0dc
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 3
pop eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x88], esi
push ecx
mov word [esp + 0x84], ax
mov eax, dword [ebx]
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call dword [eax + 0x40]
test eax, eax
je 0x100085d5
mov dword [esp + 0x18], 0x1018a0dc
xor eax, eax
push 0xc6
mov word [esp + 0x3b4], ax
xor edi, edi
lea eax, [esp + 0x3b6]
push edi
push eax
call fcn.10131950
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push edi
mov dword [esp + 0x24], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x10008620
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10008619
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x100089df
push dword [esp + 0x1c]
call fcn.101317de
mov esi, eax
pop ecx
lea eax, [esp + 0x1c]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x1000866d
push esi
call fcn.101317e9
pop ecx
jmp 0x1000866d
lea eax, [esi + 0x10c]
push 0x1018b864
push eax
call fcn.10133e90
pop ecx
pop ecx
test eax, eax
ja 0x10008673
mov eax, dword [esi + 0x1a0]
cmp eax, 0x47
je 0x10008673
cmp eax, 6
je 0x10008673
mov esi, dword [esi]
cmp esi, edi
jne 0x10008644
jmp 0x100086c2
mov dword [esp + 0x10], edi
cmp dword [esi + 0x190], edi
jbe 0x100086c2
mov eax, dword [esp + 0x10]
movzx eax, byte [esi + eax + 0x194]
push eax
push str._02X
lea eax, [esp + 0x6c]
push 0xa
push eax
call fcn.1013192a
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x3c4]
push eax
call fcn.10131845
add esp, 0x18
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x190]
jb 0x1000867f
xor eax, eax
mov esi, 0xc6
push esi
mov word [esp + 0x644], ax
lea eax, [esp + 0x646]
push edi
push eax
call fcn.10131950
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x47c], ax
lea eax, [esp + 0x47e]
push edi
push eax
call fcn.10131950
add esp, 0xc
lea eax, [esp + 0x1118]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10008869
push 0xfe
mov byte [esp + 0x544], al
lea eax, [esp + 0x545]
push edi
push eax
call fcn.10131950
add esp, 0xc
push 0xff
lea eax, [esp + 0x544]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0x540]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
lea eax, [esp + 0xa8]
mov dword [esp + 0xa4], eax
push 3
lea eax, [esp + 0x544]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.1000d5be
push dword [esp + 0xa4]
lea eax, [esp + 0x644]
push eax
call fcn.10131873
lea eax, [esp + 0xb0]
pop ecx
pop ecx
cmp dword [esp + 0xa4], eax
je 0x100087b2
push dword [esp + 0xa4]
call fcn.10133c16
pop ecx
cmp esi, edi
je 0x10008863
mov eax, dword [esi + 0xc]
push 4
push dword [eax]
lea eax, [esp + 0x18]
push eax
call fcn.10131ca0
add esp, 0xc
push edi
lea ecx, [esp + 0x68]
mov dword [esp + 0x80], 0xf
call fcn.1000dcdd
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0x68]
call fcn.1000c694
cmp dword [esp + 0x7c], 0x10
mov eax, dword [esp + 0x68]
jae 0x10008806
lea eax, [esp + 0x68]
push 3
push eax
lea eax, [esp + 0xac]
lea ecx, [esp + 0xb0]
push eax
mov dword [esp + 0xb0], ecx
call fcn.1000d5be
push dword [esp + 0xa4]
lea eax, [esp + 0x47c]
push eax
call fcn.10131873
lea eax, [esp + 0xb0]
pop ecx
pop ecx
cmp dword [esp + 0xa4], eax
je 0x10008857
push dword [esp + 0xa4]
call fcn.10133c16
pop ecx
push edi
push 1
lea ecx, [esp + 0x6c]
call fcn.1000d489
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0xd34]
push eax
lea eax, [esp + 0x3b8]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x718]
push eax
push dword [esp + 0x2c]
lea eax, [esp + 0x12c0]
push dword [esp + 0x4c]
push 0x1018b868
push eax
call fcn.10131892
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 0x24
push dword [esp + 0x34]
call esi
push dword [esp + 0x18]
call esi
push dword [esp + 0x28]
call esi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
lea eax, [esp + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000860b
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x12b0]
push eax
mov dword [esp + 0x2c], edi
call fcn.101319ca
pop ecx
add eax, eax
push eax
lea eax, [esp + 0x12b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10008929
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
cmp dword [esp + 0xc], 0xb3
je 0x10008943
cmp dword [esp + 0xc], 0x82
jne 0x1000830b
lea eax, [esp + 0x20]
push eax
mov eax, dword [ebx + 0x10]
lea edi, [ebx + 0x2c]
mov dword [ebx + 0x34], esi
mov dword [edi], esi
mov dword [esp + 0x24], esi
push esi
mov esi, dword [eax + 8]
call fcn.1001e5c8
mov eax, dword [ebx + 0x10]
push 0
push 0
call fcn.1001c808
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1000830b
mov eax, dword [ebx + 0x10]
call fcn.1001d141
test eax, eax
jne 0x10008990
push 0xe00b1009
mov eax, 0x1018a9d8
jmp 0x100089d0
mov eax, dword [ebx + 0x18]
push edi
push dword [ebx + 0x1c]
push dword [ebx + 0x10]
call fcn.1001cfcd
mov ecx, dword [ebx + 0x10]
lea eax, [ebx + 0x34]
push eax
push 3
push dword [edi]
call fcn.1001cd01
push dword [ebp + 0x1c]
mov eax, dword [ebx]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [eax + 0x68]
jmp 0x100089df
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018aefc
push 0x1018af7c
call fcn.10004ead
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18