joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ae17
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, 0x80004005
je 0x101ae4c
lea eax, [ebp - 4]
push eax
lea edi, [esi + 0x2040]
push edi
push dword [ebp + 0xc]
call fcn.0101ad73
test al, al
je 0x101aef9
cmp byte [esi + 0x2c], 1
mov dword [esi + 0x2038], 8
lea edi, [esi + 0x2040]
mov ecx, esi
jne 0x101ae88
push 0x101a6a6
push dword [ebp - 4]
push dword [edi]
push dword [ebp + 8]
call fcn.0101abe4
mov ebx, eax
test ebx, ebx
jl 0x101aef9
mov dword [esi + 0x2038], 0x10
jmp 0x101aef5
push 0
push dword [ebp - 4]
push dword [edi]
push dword [ebp + 8]
call fcn.0101abe4
test eax, eax
jl 0x101aeeb
push 0
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x101aeeb
push dword [edi]
call fcn.0100ecc6
and dword [edi], 0
pop ecx
mov ecx, esi
mov dword [esi + 0x2038], 0x10
call fcn.0101a3b0
test eax, eax
jl 0x101aeeb
mov ecx, esi
mov dword [esi + 0x2038], 0x20
call fcn.0101a931
test eax, eax
jl 0x101aeeb
mov dword [esi + 0x2038], 0x80
xor ebx, ebx
mov dword [esi + 0x2038], 0x100
test ebx, ebx
jge 0x101af30
push dword [edi]
call fcn.0100ecc6
and dword [edi], 0
pop ecx
mov dword [esi + 0x2038], 0x200
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x24], eax
test eax, eax
jle 0x101af25
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x101af30
mov ebx, 0x80004005
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x101af3e
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x30]
push ebx
push dword [ebp + 0xc]
mov edi, 0x80004005
mov dword [esi + 0x2038], 8
call fcn.0101a143
test eax, eax
jl 0x101b053
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1000
push dword [ebp + 0xc]
call fcn.01007c15
mov edi, eax
test edi, edi
jl 0x101b053
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
inc eax
push eax
lea eax, [esi + 0x34]
push eax
call fcn.0101a7ea
mov edi, eax
test edi, edi
jl 0x101b053
cmp byte [esi + 0x2c], 1
mov ecx, esi
jne 0x101afd5
push 0x101a6a6
push 0
push 0
push dword [ebp + 8]
call fcn.0101abe4
mov edi, eax
test edi, edi
jl 0x101b053
mov dword [esi + 0x2038], 0x10
jmp 0x101b04f
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call fcn.0101abe4
mov edi, eax
test edi, edi
jl 0x101b03a
push 0
push dword [esi + 0xc]
mov dword [esi + 0x2038], 0x10
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x101b035
mov ecx, esi
call fcn.0101a3b0
mov edi, eax
test edi, edi
jl 0x101b03a
push dword [ebx]
mov ecx, esi
mov dword [esi + 0x2038], 0x20
call fcn.0101a4c1
mov edi, eax
test edi, edi
jl 0x101b03a
mov dword [esi + 0x2038], 0x80
xor edi, edi
jmp 0x101b03a
mov edi, 0x80004005
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx], 0xffffffff
mov dword [esi + 0x2038], 0x100
test edi, edi
jge 0x101b08d
mov ebx, 0x80004005
mov dword [esi + 0x2038], 0x200
cmp edi, ebx
jne 0x101b085
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x24], eax
test eax, eax
jle 0x101b07d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x101b085
mov edi, ebx
push dword [ebp + 0xc]
call fcn.0101a19b
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x101d8e2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x101d943
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0100b6a9
xor eax, eax
jmp 0x101d948
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100f31b
leave
ret 8
Function at 0x101e387
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x102fcfa
call fcn.0100f48e
xor ebx, ebx
push ebx
push 0x1004bf4
push 0x1004b78
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x101e505
mov dword [ebp - 0x224], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x228]
push ecx
push 4
lea ecx, [ebp - 0x230]
push ecx
push esi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
call dword [eax + 0xc]
cmp eax, ebx
jl 0x101e505
cmp dword [ebp - 0x228], 4
jne 0x101e505
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x21c]
push eax
push 0x1006110
push ebx
push 0x1006100
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
cmp eax, ebx
mov eax, dword [ebp - 0x21c]
jl 0x101e50d
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
cmp eax, ebx
jl 0x101e530
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
lea edx, [ebp - 0x220]
push edx
push 0x1004ec8
push eax
mov byte [ebp - 4], 1
call dword [ecx]
cmp eax, ebx
jl 0x101e51d
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x101e4cb
lea eax, [ebp - 0x218]
push eax
push 0x1004b70
call dword [sym.imp.msvcrt.dll_wprintf]
sub esp, 0x14
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
call fcn.0100b48a
call fcn.0101dc45
cmp al, bl
jne 0x101e538
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e4de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e4f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], 0xa
jl 0x101e3be
xor al, al
call fcn.0100f520
ret
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e505
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101e505
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e530
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
jmp 0x101e50d
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e54b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e55f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
jmp 0x101e507
Function at 0x101e568
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x102fcfa
call fcn.0100f48e
xor ebx, ebx
push ebx
push 0x1004bf4
push 0x1004b78
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x101e6e6
mov dword [ebp - 0x224], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x228]
push ecx
push 4
lea ecx, [ebp - 0x230]
push ecx
push esi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
call dword [eax + 0xc]
cmp eax, ebx
jl 0x101e6e6
cmp dword [ebp - 0x228], 4
jne 0x101e6e6
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x21c]
push eax
push 0x1006110
push ebx
push 0x1006100
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
cmp eax, ebx
mov eax, dword [ebp - 0x21c]
jl 0x101e6ee
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
cmp eax, ebx
jl 0x101e711
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
lea edx, [ebp - 0x220]
push edx
push 0x1004ec8
push eax
mov byte [ebp - 4], 1
call dword [ecx]
cmp eax, ebx
jl 0x101e6fe
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x101e6ac
lea eax, [ebp - 0x218]
push eax
push 0x1004b70
call dword [sym.imp.msvcrt.dll_wprintf]
sub esp, 0x14
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
call fcn.0100b48a
call fcn.0101ddfd
cmp al, bl
jne 0x101e719
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e6bf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e6d3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], 0xa
jl 0x101e59f
xor al, al
call fcn.0100f520
ret
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e6e6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101e6e6
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e711
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
jmp 0x101e6ee
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e72c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e740
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
jmp 0x101e6e8
Function at 0x101e749
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x102fcfa
call fcn.0100f48e
xor ebx, ebx
push ebx
push 0x1004bf4
push 0x1004b78
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x101e8c7
mov dword [ebp - 0x224], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x228]
push ecx
push 4
lea ecx, [ebp - 0x230]
push ecx
push esi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
call dword [eax + 0xc]
cmp eax, ebx
jl 0x101e8c7
cmp dword [ebp - 0x228], 4
jne 0x101e8c7
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x21c]
push eax
push 0x1006110
push ebx
push 0x1006100
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
cmp eax, ebx
mov eax, dword [ebp - 0x21c]
jl 0x101e8cf
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
cmp eax, ebx
jl 0x101e8f2
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
lea edx, [ebp - 0x220]
push edx
push 0x1004ec8
push eax
mov byte [ebp - 4], 1
call dword [ecx]
cmp eax, ebx
jl 0x101e8df
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
add esp, 0xc
push ebx
push ebx
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jl 0x101e88d
lea eax, [ebp - 0x218]
push eax
push 0x1004b70
call dword [sym.imp.msvcrt.dll_wprintf]
sub esp, 0x14
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
call fcn.0100b48a
call fcn.0101dd23
cmp al, bl
jne 0x101e8fa
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e8a0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e8b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], 0xa
jl 0x101e780
xor al, al
call fcn.0100f520
ret
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e8c7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101e8c7
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e8f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
jmp 0x101e8cf
mov eax, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x101e90d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e921
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
jmp 0x101e8c9
Function at 0x101e92a
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x102fd3f
call fcn.0100f41b
push 0x1004c18
lea ecx, [ebp - 0x14]
call fcn.0100c7ee
xor ebx, ebx
push 0x1038044
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0101672d
lea eax, [ebp - 0x10]
push eax
push 0xb
mov byte [ebp - 4], 1
call fcn.0101d8e2
cmp eax, ebx
jl 0x101e99f
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.01008d1d
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.01008d1d
mov byte [ebp - 4], 1
call fcn.0101e149
mov bl, al
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100744d
mov al, bl
call fcn.0100f507
ret

Function at 0x101e9c2
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x102fd3f
call fcn.0100f41b
push 0x1004c18
lea ecx, [ebp - 0x14]
call fcn.0100c7ee
xor ebx, ebx
push 0x1038044
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0101672d
lea eax, [ebp - 0x10]
push eax
push 0xb
mov byte [ebp - 4], 1
call fcn.0101d8e2
cmp eax, ebx
jl 0x101ea37
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.01008d1d
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.01008d1d
mov byte [ebp - 4], 1
call fcn.0101e055
mov bl, al
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100744d
mov al, bl
call fcn.0100f507
ret

Function at 0x101ea5a
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x102fd3f
call fcn.0100f41b
push 0x1004c2c
lea ecx, [ebp - 0x14]
call fcn.0100c7ee
xor ebx, ebx
push 0x1038044
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0101672d
lea eax, [ebp - 0x10]
push eax
push 2
mov byte [ebp - 4], 1
call fcn.0101d8e2
cmp eax, ebx
jl 0x101eae9
push 0x1001f30
lea ecx, [ebp - 0x10]
call fcn.0100b683
push 0x1004c24
lea ecx, [ebp - 0x10]
call fcn.0100b683
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.01008d1d
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.01008d1d
mov byte [ebp - 4], 1
call fcn.0101e055
mov bl, al
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100744d
mov al, bl
call fcn.0100f507
ret
Function at 0x101eb0c
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x102fd3f
call fcn.0100f41b
push 0x1004c2c
lea ecx, [ebp - 0x14]
call fcn.0100c7ee
xor ebx, ebx
push 0x1038044
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0101672d
lea eax, [ebp - 0x10]
push eax
push 2
mov byte [ebp - 4], 1
call fcn.0101d8e2
cmp eax, ebx
jl 0x101eb9b
push 0x1001f30
lea ecx, [ebp - 0x10]
call fcn.0100b683
push 0x1004c24
lea ecx, [ebp - 0x10]
call fcn.0100b683
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.01008d1d
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.01008d1d
mov byte [ebp - 4], 1
call fcn.0101e149
mov bl, al
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100744d
mov al, bl
call fcn.0100f507
ret
Function at 0x10208e4
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 5
push 0
push 0
push 0x1001cc4
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push dword [ebp + 8]
call fcn.0100c7ee
lea eax, [ebp + 0xc]
push eax
call fcn.010207c4
add esp, 0x10
push dword [eax]
push 0x1004e94
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0100744d
mov al, 1
pop ebp
ret 8

Function at 0x10280be
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x214], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x1028102
xor al, al
jmp 0x10281e4
push edi
push ebx
call fcn.0100ed46
mov edi, eax
pop ecx
test edi, edi
jne 0x1028117
xor al, al
jmp 0x10281e3
push edi
push ebx
push dword [ebp - 0x214]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
mov esi, eax
test esi, esi
je 0x10281d7
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1005610
push edi
call sub.VERSION.dll_VerQueryValueW
mov esi, eax
test esi, esi
je 0x10281d7
mov eax, dword [ebp - 0x218]
movzx esi, word [eax]
movzx eax, word [eax + 2]
and dword [ebp - 0x210], 0
shl esi, 0x10
or esi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
push 0x10055f0
push esi
push 0x10055c0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01027ced
add esp, 0x20
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
mov esi, eax
test esi, esi
je 0x10281d7
push dword [ebp - 0x210]
mov ecx, dword [ebp - 0x21c]
call fcn.0100c285
push edi
call fcn.0100ecc6
test esi, esi
pop ecx
setne al
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f31b
leave
ret 8

Function at 0x10281f9
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x1030bc2
call fcn.0100f48e
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
xor ebx, ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
jbe 0x102828a
push 0x1038044
lea ecx, [ebp - 0x21c]
call fcn.0101672d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push 0x1005644
push eax
mov dword [ebp - 4], ebx
call fcn.0100bd31
add esp, 0xc
push esi
mov esi, dword [ebp - 0x21c]
push esi
call fcn.010280be
test al, al
je 0x1028282
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.0100744d
mov al, bl
call fcn.0100f520
ret 4
Function at 0x102849b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10284b2
xor eax, eax
jmp 0x10284b5
and eax, 0x10
pop ebp
ret 4

Function at 0x10287d1
Capabilities:
Query environment variable

Disassembly:
push 0xc
mov eax, 0x1030c51
call fcn.0100f453
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x10287ee
mov eax, 0x80070057
jmp 0x1028878
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x18], eax
mul edx
seto cl
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
push ecx
call fcn.0100ed46
or dword [ebp - 4], 0xffffffff
pop ecx
mov esi, eax
jmp 0x102882a
cmp esi, ebx
jne 0x1028835
mov edi, 0x8007000e
jmp 0x1028876
push dword [ebp - 0x18]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x102885e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102885a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x102886b
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0100c285
xor esi, esi
xor edi, edi
cmp esi, ebx
je 0x1028876
push esi
call fcn.0100ecc6
pop ecx
mov eax, edi
call fcn.0100f507
ret 8

Function at 0x1028885
Capabilities:
Get file attributes

Disassembly:
push 4
mov eax, 0x102f2c8
call fcn.0100f41b
push 0x1038044
lea ecx, [ebp - 0x10]
call fcn.0101672d
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.010287d1
test eax, eax
jge 0x10288ba
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
jmp 0x10288fc
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x10288f9
cmp eax, 0xffffffff
je 0x10288f9
push 0
push 0
push 3
push 0
push 3
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10288f9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.0100744d
xor eax, eax
inc eax
jmp 0x1028903
lea ecx, [esi - 0x10]
call fcn.0100744d
xor eax, eax
call fcn.0100f507
ret 4

Function at 0x10291f5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 6
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1029255
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0100b6a9
xor eax, eax
jmp 0x102925a
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100f31b
leave
ret 4
Function at 0x102a336
Capabilities:
Enumerate processes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
mov dword [ebp - 0x230], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x102a3c5
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x102a3ae
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x228]
je 0x102a3b4
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x102a396
jmp 0x102a3be
mov eax, dword [ebp - 0x218]
mov bl, 1
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0100f31b
leave
ret 8

Function at 0x102ab3e
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x10310cd
call fcn.0100f41b
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x14]
xor esi, esi
push eax
xor edi, edi
mov dword [ebp - 0x14], esi
call fcn.0102a897
cmp dword [ebp - 0x14], esi
ja 0x102ab6c
call fcn.01028299
cmp eax, 8
jbe 0x102ab6f
xor edi, edi
inc edi
mov ebx, 0x80004005
cmp edi, esi
jne 0x102abe2
push 0x1038044
lea ecx, [ebp - 0x10]
call fcn.0101672d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0xd8]
mov ebx, eax
cmp ebx, esi
jl 0x102abd7
push 0x1005f8c
lea ecx, [ebp - 0x10]
call fcn.0100b683
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.01007c88
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp + 8], esi
push 0x102aa9c
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
mov eax, ebx
call fcn.0100f507
ret 4

Function at 0x102d193
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x102d1e9
cmp dword [ebp + 0xc], ebx
je 0x102d1e9
cmp dword [ebp + 0x10], ebx
je 0x102d1e9
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.01006ea5
test eax, eax
jne 0x102d1dd
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x102d1dd
mov bl, 1
lea ecx, [ebp - 0xc]
call fcn.01006e32
mov al, bl
jmp 0x102d1eb
xor al, al
pop ebx
leave
ret 0x10