joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10159344
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x102159fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
test edi, edi
je 0x101594a5
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101594a5
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.101640e0
add esp, 0xc
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10159491
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1015946b
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.101640e0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015945f
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.101648f3
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x10159499
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x20c]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x101593d6
push dword [ebp - 0x418]
call ebx
mov eax, esi
jmp 0x101594a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1014bb85
leave
ret 4
Function at 0x10159fe4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102159fc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x1015a009
xor eax, eax
jmp 0x1015a09c
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push esi
push eax
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push esi
push str.SYSTEMCurrentControlSetServices_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1015a09a
push ebx
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, esi
push eax
push esi
jmp 0x1015a078
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.10179159
pop ecx
pop ecx
test eax, eax
je 0x1015a08a
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1015a057
jmp 0x1015a08d
xor esi, esi
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1014bb85
leave
ret 4
Function at 0x1015a45c
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x83c
mov eax, 0x1018d5b8
call fcn.101892bd
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x628]
push 0x208
xor edi, edi
push edi
push eax
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x628]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x848]
call fcn.10002790
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
mov dword [ebp - 4], edi
call fcn.10178900
pop ecx
push eax
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea ecx, [ebp - 0x848]
call fcn.10004210
push esi
call fcn.10178900
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.10004210
mov esi, str..lnk
push esi
call fcn.10178900
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.10004210
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x1015a5dc
push 0x208
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.101640e0
push 0x208
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.101640e0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.10178aeb
add esp, 0x20
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.10158c28
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.10178900
pop ecx
test eax, eax
jne 0x1015a5cc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10178aeb
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x1015a5dc
xor edi, edi
inc edi
lea ecx, [ebp - 0x848]
call fcn.10001e10
mov eax, edi
call fcn.10189278
ret 4

Function at 0x1015a5f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102159fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x10219f98]
test bl, bl
jne 0x1015a688
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1015a682
lea eax, [ebp - 0x20c]
push eax
call fcn.10178cb6
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.101648f3
pop ecx
pop ecx
test eax, eax
jne 0x1015a67a
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.101648f3
pop ecx
pop ecx
test eax, eax
je 0x1015a682
mov byte [0x10219f98], bl
jmp 0x1015a688
mov bl, byte [0x10219f98]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1014bb85
leave
ret
Function at 0x1015b0ff
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102159fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1015b16a
lea eax, [ebp - 0x20c]
push 0x1018fa34
push eax
call fcn.10179103
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.1015a697
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1014bb85
leave
ret 4
Function at 0x1015b513
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov edi, 0xf01ff
mov dword [ebp - 8], ebx
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1015b662
lea eax, [ebp - 0x10]
push eax
push 1
push 1
push ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1015b662
push str.Kernel32.dll
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1015b5ad
push str.WTSGetActiveConsoleSessionId
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1015b5a6
call eax
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0xc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1015b662
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Wtsapi32.dll
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1015b687
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1015b5f9
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push ecx
push dword [ebp - 0x14]
call eax
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push dword [ebp - 0xc]
test eax, eax
jne 0x1015b5f7
call esi
jmp 0x1015b662
call esi
push 0x44
pop edi
push edi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.101640e0
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.101640e0
add esp, 0x18
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x60], str.WinSta0Default
mov dword [ebp - 0x3c], 1
push 5
pop eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp - 4]
push 0x430
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1015b662
cmp dword [ebp - 4], ebx
je 0x1015b660
push dword [ebp - 4]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov bl, 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1015b671
cmp eax, 0xffffffff
je 0x1015b671
push eax
call esi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1015b680
cmp ecx, 0xffffffff
je 0x1015b680
push ecx
call esi
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
push ebx
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x1015b5f9
push dword [ebp - 8]
jmp 0x1015b5f3
Function at 0x1015b6a4
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x1018d746
call fcn.101892bd
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x28c], esi
test eax, eax
je 0x1015b7f8
push eax
lea ecx, [ebp - 0x40]
call fcn.10002790
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.1014faf2
mov dword [esp], 0x22c
lea eax, [ebp - 0x284]
push ebx
push eax
call fcn.101640e0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1015b7ee
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1015b7e7
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002790
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.1014faf2
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.1014df34
test al, al
jne 0x1015b77e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1014f2e3
pop ecx
pop ecx
or esi, 1
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x28c], esi
call fcn.1014df34
mov byte [ebp - 0x285], bl
test al, al
je 0x1015b785
mov byte [ebp - 0x285], 1
mov eax, dword [ebp - 0x28c]
test al, 1
je 0x1015b7a0
and eax, 0xfffffffe
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x28c], eax
call fcn.10001e10
cmp byte [ebp - 0x285], 0
jne 0x1015b7d0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.10001e10
lea eax, [ebp - 0x284]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1015b7e7
mov esi, dword [ebp - 0x28c]
jmp 0x1015b726
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
call fcn.10001e10
jmp 0x1015b7ee
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.10001e10
mov eax, ebx
call fcn.10189278
ret

Function at 0x1015bc8c
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x1015c4e6
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push edi
push str.kernel32.dll
mov esi, ecx
call ebx
mov dword [esi], eax
test eax, eax
je 0x1015c567
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101fbff8
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push 0x101fd328
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x1015c567
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push eax
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
jmp 0x1015c569
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x1015c724
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x1015c7f1
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x101fc474
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x101fc474
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x101fc474
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x101fc474
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.10174c40
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x1015c7cd
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.10174c40
pop ecx
pop ecx
test eax, eax
je 0x1015c80e
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x1015c757
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.10178a20
pop ecx
test eax, eax
je 0x1015c80e
push ebx
mov ecx, edi
call fcn.1015c676
mov al, 1
jmp 0x1015c810
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1015cff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102159fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 0x114
push edi
push ebx
xor edi, edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.101640e0
add esp, 0xc
mov dword [ebp - 0x118], ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1015d051
mov ecx, esi
call fcn.1015cadd
jmp 0x1015d066
mov ebx, edi
test edi, edi
jne 0x1015d066
mov ecx, esi
call fcn.1015c9ba
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x1015d053
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1014bb85
leave
ret

Function at 0x101600e8
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x1018dc5a
call fcn.101892bd
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push ebx
push eax
mov dword [ebp - 0x24c], ebx
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x218]
mov edi, ebx
push 0x104
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x101601d8
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x101601ca
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.10002790
and dword [ebp - 4], 0
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.1014fc81
pop ecx
pop ecx
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.10001e10
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push dword [ebp - 0x250]
call fcn.1015b8ff
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10002840
push 0x104
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push esi
call ebx
test eax, eax
je 0x1016013a
call fcn.10189278
ret

Function at 0x10160520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.10161ce0
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.10161c90
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.10161d30
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x1016055c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x101605b0
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x101605a0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x101605a0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x10160bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018dd96
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x102159fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x10160c4a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x10160c67
mov eax, dword [esi + 0x20]
jmp 0x10160c6a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x10160c84
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x10160c9e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x10160cb8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.1016847f
push eax
call fcn.10178fae
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.101640e0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x10160d77
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.101640e0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x10160d68
test eax, eax
je 0x10160d68
add eax, eax
cmp eax, 0x412
jae 0x10160d63
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x10160d6e
call fcn.1014c066
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.10160f20
mov eax, dword [esi + 0x30]
test eax, eax
je 0x10160da3
cmp dword [esi + 0x34], 8
jb 0x10160d89
mov ecx, dword [esi + 0x20]
jmp 0x10160d8c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x10160da3
push 1
push 0x101fd64c
lea ecx, [esi + 0x20]
call fcn.10161fd0
cmp dword [esi + 0x30], 0
jne 0x10160db8
push 3
push 0x101fd650
lea ecx, [esi + 0x20]
call fcn.10160850
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014bb85
mov esp, ebp
pop ebp
ret
Function at 0x10160de0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x10160dfc
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x10160df5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x10160e19
push eax
call fcn.1014bbc2
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x10160e2f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10160950
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10160e45
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x10160e60
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10160950
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10160e76
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x10160e91
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10160950
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10160ea7
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x10160ec2
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10160950
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10160ed8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x10160ef2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.10160950
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x10160f11
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x10162b40
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x10162b7e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x10162b7e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x1017dcea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1017db69

Function at 0x1018013e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1017fdfe