joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a2313
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x230
mov eax, 0x10dfefb
call fcn.010a0cd3
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x230], ebx
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a235b
test byte [eax + 0x1c], 1
je 0x10a235b
cmp byte [eax + 0x19], 5
jb 0x10a235b
push ebx
push dword [esi]
push 0x100a078
push 0x59
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059cca
lea eax, [ebp - 0x21c]
xor edi, edi
push eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x21c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x21c], edi
je 0x10a24d1
push 0x100a098
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp eax, edi
je 0x10a24df
push 0x100a0b4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x22c], eax
cmp eax, edi
je 0x10a24c3
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], edi
mov eax, dword [esi]
push 0x2011f
push ebx
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], edi
call fcn.010292e8
mov dword [ebp - 0x214], eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a2434
test byte [eax + 0x1c], 2
je 0x10a2434
mov edx, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10a2434
push ebx
push dword [esi]
push dword [ebp - 0x214]
push 0x100a078
push 0x5a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106656b
cmp dword [ebp - 0x214], edi
jne 0x10a24b8
mov ebx, 0x100
jmp 0x10a2460
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.010a2313
mov dword [ebp - 0x214], eax
cmp eax, edi
jne 0x10a248f
lea eax, [ebp - 0x23c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x228]
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10a2443
lea ecx, [ebp - 0x228]
call fcn.010292ca
cmp dword [ebp - 0x214], edi
jne 0x10a24b8
push edi
push ebx
push dword [ebp - 0x230]
push dword [esi]
call dword [ebp - 0x22c]
mov dword [ebp - 0x214], eax
lea ecx, [ebp - 0x228]
call fcn.010292ca
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10a24df
push ebx
mov ecx, esi
call fcn.010a221f
mov dword [ebp - 0x214], eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a2521
test byte [eax + 0x1c], 1
je 0x10a2521
mov edx, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10a2521
push dword [ebp - 0x214]
push 0x100a078
push 0x5b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, dword [ebp - 0x214]
call fcn.010a0d65
ret 8
Function at 0x10a3c99
Capabilities:
Get user security identifier

Disassembly:
push 0xe0
mov eax, 0x10e0042
call fcn.010a0cd3
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe0], eax
call fcn.0102e0f1
test ebx, ebx
je 0x10a3e22
and dword [ebp - 0xd8], 0
and dword [ebp - 4], 0
mov esi, 0x80
push esi
lea ecx, [ebp - 0xd8]
call fcn.010a25aa
mov ecx, dword [ebp - 0xd8]
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push ecx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0xe0]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xdc], 0x44
mov dword [ebp - 0xe8], esi
call ebx
test eax, eax
jne 0x10a3d9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10a3e02
cmp dword [ebp - 0xdc], 0x44
jbe 0x10a3d4d
push 0x80004005
call fcn.01027b0b
mov eax, dword [ebp - 0xe8]
cmp eax, esi
jbe 0x10a3d71
add eax, eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.010a25ce
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe4], eax
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xe4]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xe0]
call ebx
test eax, eax
je 0x10a3e02
lea eax, [ebp - 0x54]
push eax
lea eax, [edi + 4]
push eax
push dword [ebp - 0xdc]
mov byte [edi + 0x48], 1
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x10a3e02
push dword [ebp - 0xe4]
lea ecx, [edi + 0x54]
call fcn.01028b27
push dword [ebp - 0xec]
lea ecx, [edi + 0x50]
call fcn.01028b27
push dword [ebp - 0xe0]
lea ecx, [edi + 0x5c]
call fcn.01028b27
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x10a3dfe
lea ecx, [ebp - 0xd8]
call fcn.010a21c6
mov al, 1
jmp 0x10a3e24
mov ecx, edi
call fcn.0102e0f1
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x10a3e22
lea ecx, [ebp - 0xd8]
call fcn.010a21c6
xor al, al
call fcn.010a0d65
ret 8
Function at 0x10a3e95
Capabilities:
Get session user name

Disassembly:
push 0x6c
mov eax, 0x10e0097
call fcn.010a0cd3
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
cmp eax, esi
je 0x10a3ed6
test byte [eax + 0x1c], 1
je 0x10a3ed6
cmp byte [eax + 0x19], 5
jb 0x10a3ed6
push 0x100a078
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, 0x7fff
push eax
mov ecx, edi
mov dword [ebp - 0x78], eax
call fcn.010286c1
lea ecx, [ebp - 0x78]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
movzx ebx, al
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3f1d
test byte [eax + 0x1c], 2
je 0x10a3f1d
cmp byte [eax + 0x19], 4
jb 0x10a3f1d
push ebx
push 0x100a078
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
push 0xffffffffffffffff
mov ecx, edi
call fcn.0102f2bd
lea ecx, [ebp - 0x70]
call fcn.010a2641
and dword [ebp - 4], 0
cmp ebx, 1
jne 0x10a3fe2
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3f64
test byte [eax + 0x1c], 2
je 0x10a3f64
cmp byte [eax + 0x19], 4
jb 0x10a3f64
push dword [edi]
push 0x100a078
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
mov edi, dword [edi]
push 0
push edi
lea ecx, [ebp - 0x70]
call fcn.010a3c99
movzx ebx, al
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3fa1
test byte [eax + 0x1c], 2
je 0x10a3fa1
cmp byte [eax + 0x19], 4
jb 0x10a3fa1
push ebx
push 0x100a078
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, dword [0x10ed030]
cmp ebx, 1
jne 0x10a3fe7
lea ecx, [ebp - 0x70]
call fcn.010a3e31
mov edi, dword [ebp - 0x74]
push eax
mov ecx, edi
call fcn.01028b27
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a400a
test byte [eax + 0x1c], 2
je 0x10a3fe7
cmp byte [eax + 0x19], 4
jb 0x10a3fe7
push dword [edi]
push 0x100a078
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a400a
test byte [eax + 0x1c], 1
je 0x10a400a
cmp byte [eax + 0x19], 5
jb 0x10a400a
push ebx
push 0x100a078
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
lea ecx, [ebp - 0x70]
call fcn.010307d2
mov eax, ebx
call fcn.010a0d65
ret 8
Function at 0x10a4160
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x1c
mov eax, 0x10e00c9
call fcn.010a0c60
mov eax, dword [0x10ed030]
mov edi, 0x10ed030
cmp eax, edi
je 0x10a4198
test byte [eax + 0x1c], 1
je 0x10a4198
cmp byte [eax + 0x19], 5
jb 0x10a4198
push 0x100a078
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push esi
push esi
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a41ec
test byte [eax + 0x1c], 2
je 0x10a41ec
cmp byte [eax + 0x19], 4
jb 0x10a41ec
push ebx
push 0x100a078
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, dword [0x10ed030]
inc dword [ebp - 0x14]
cmp ebx, esi
jne 0x10a4306
push 0x10f1178
lea ecx, [ebp - 0x10]
call fcn.0102847f
mov dword [ebp - 4], esi
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a4231
test byte [eax + 0x1c], 2
je 0x10a4231
cmp byte [eax + 0x19], 4
jb 0x10a4231
push dword [ebp - 0x1c]
push 0x100a078
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x1c], esi
jbe 0x10a42f6
cmp ebx, esi
jne 0x10a42f6
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.01032267
push eax
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a4299
test byte [eax + 0x1c], 2
je 0x10a4299
cmp byte [eax + 0x19], 4
jb 0x10a4299
push ebx
push 0x100a078
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
call fcn.0102f2bd
cmp ebx, esi
jne 0x10a42e7
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.01033792
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a42e7
test byte [eax + 0x1c], 2
je 0x10a42e7
cmp byte [eax + 0x19], 4
jb 0x10a42e7
push dword [ebp - 0x10]
push 0x100a078
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jb 0x10a423d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01028079
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a4337
test byte [eax + 0x1c], 1
je 0x10a4337
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10a4337
push ebx
push 0x100a078
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, ebx
call fcn.010a0d4c
ret 8
Function at 0x10a43ae
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov eax, dword [0x10ed030]
mov ebx, 0x100a1f0
cmp eax, 0x10ed030
je 0x10a43e8
test byte [eax + 0x1c], 1
je 0x10a43e8
cmp byte [eax + 0x19], 5
jb 0x10a43e8
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
push esi
push edi
mov esi, 0x80
xor edi, edi
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 8], edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], 4
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a443e
test byte [eax + 0x1c], 2
je 0x10a443e
cmp byte [eax + 0x19], 5
jb 0x10a443e
push dword [ebp + 8]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov edi, eax
xor edx, edx
cmp edi, edx
je 0x10a44c7
jg 0x10a4460
mov dword [ebp - 4], edi
jmp 0x10a4471
mov ecx, edi
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], edx
jl 0x10a447d
mov dword [ebp - 4], 0x80004005
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10a4540
test byte [ecx + 0x1c], 2
je 0x10a4540
movzx eax, byte [ecx + 0x19]
xor edx, edx
cmp dword [ebp - 4], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x10a4540
push edi
push dword [ebp - 4]
push ebx
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cb22
jmp 0x10a4540
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
cmp ecx, esi
jbe 0x10a4504
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a44fb
test byte [eax + 0x1c], 2
je 0x10a44fb
cmp byte [eax + 0x19], 2
jb 0x10a44fb
push edx
push esi
push edx
push ecx
push ebx
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cdb0
mov dword [ebp - 4], 0x80004005
jmp 0x10a4540
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a452c
test byte [eax + 0x1c], 2
je 0x10a452c
cmp byte [eax + 0x19], 5
jb 0x10a452c
push edx
push ecx
push ebx
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cd84
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
push dword [eax + 0x18]
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, dword [0x10ed030]
pop edi
pop esi
cmp eax, 0x10ed030
je 0x10a4596
test byte [eax + 0x1c], 1
je 0x10a4596
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp dword [ebp - 4], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x10a4596
cmp dword [ebp - 4], 0
jl 0x10a4581
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx]
jmp 0x10a4584
or ecx, 0xffffffff
push ecx
push dword [ebp - 4]
push ebx
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104eb71
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8
Function at 0x10a58cc
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x40c], eax
mov ecx, dword [0x10ed030]
mov ebx, 0x10ed030
cmp ecx, ebx
je 0x10a5927
test byte [ecx + 0x1c], 1
je 0x10a5927
cmp byte [ecx + 0x19], 5
jb 0x10a5927
push dword [ebp + 0xc]
push esi
push 0x100a1f0
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cb22
mov ecx, dword [0x10ed030]
movzx eax, word [esi]
push 2
pop edx
xor edi, edi
cmp dx, ax
je 0x10a5946
push 0x17
pop edx
cmp dx, ax
je 0x10a5946
mov edi, 0x80070057
jmp 0x10a5a11
push 2
push 0
push 0
push 0x401
lea eax, [ebp - 0x408]
push eax
push 0x80
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x10a59b8
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edi, eax
test eax, eax
jle 0x10a5980
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x10a5989
mov edi, 0x80004005
mov ecx, dword [0x10ed030]
cmp ecx, ebx
je 0x10a5a4b
test byte [ecx + 0x1c], 2
je 0x10a5a11
cmp byte [ecx + 0x19], 2
jb 0x10a5a11
push eax
push 0x100a1f0
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010294b2
jmp 0x10a5a0b
cmp dword [ebp + 0xc], edi
je 0x10a59f9
push 0x17
pop eax
cmp ax, word [esi]
jne 0x10a59f9
lea eax, [ebp - 0x408]
push 0x25
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x10a59dd
mov byte [eax], 0
lea eax, [ebp - 0x408]
push eax
push 0x100a2c8
push dword [ebp - 0x40c]
call fcn.0102ad35
add esp, 0xc
jmp 0x10a5a0b
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
call fcn.0104bcd1
mov ecx, dword [0x10ed030]
cmp ecx, ebx
je 0x10a5a4b
test byte [ecx + 0x1c], 1
je 0x10a5a4b
movzx eax, byte [ecx + 0x19]
xor edx, edx
test edi, edi
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x10a5a4b
mov eax, dword [ebp - 0x40c]
push dword [eax]
push edi
push 0x100a1f0
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01059cca
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0c4b
leave
ret 0xc
Function at 0x10a97b2
Capabilities:
Delete registry value

Disassembly:
push 0x14
mov eax, 0x10e0678
call fcn.010a0c60
mov dword [ebp - 0x14], ecx
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
mov ebx, 0x100a5a8
cmp eax, esi
je 0x10a97f4
test byte [eax + 0x1c], 1
je 0x10a97f4
cmp byte [eax + 0x19], 5
jb 0x10a97f4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0x7a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102c7ee
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.01028b87
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0104bd22
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
call fcn.010a7653
mov dword [ebp + 8], eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a9856
test byte [eax + 0x1c], 2
je 0x10a9856
cmp byte [eax + 0x19], 4
jb 0x10a9856
push dword [ebp + 8]
push ebx
push 0x7b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, dword [0x10ed030]
cmp dword [ebp + 8], edi
jne 0x10a98ba
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 8], eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a9898
test byte [eax + 0x1c], 2
je 0x10a9898
cmp byte [eax + 0x19], 4
jb 0x10a9898
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push 0x7c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
mov eax, dword [0x10ed030]
cmp dword [ebp + 8], 2
jne 0x10a98ea
mov dword [ebp + 8], 0x490
cmp eax, esi
je 0x10a991a
test byte [eax + 0x1c], 2
je 0x10a98ea
cmp byte [eax + 0x19], 4
jb 0x10a98ea
push ebx
push 0x7d
jmp 0x10a98da
cmp dword [ebp + 8], 2
jne 0x10a98ea
mov dword [ebp + 8], 0x490
cmp eax, esi
je 0x10a991a
test byte [eax + 0x1c], 2
je 0x10a98ea
cmp byte [eax + 0x19], 4
jb 0x10a98ea
push ebx
push 0x7e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a991a
test byte [eax + 0x1c], 1
je 0x10a991a
mov edx, dword [ebp + 8]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10a991a
push dword [ebp + 8]
push ebx
push 0x7f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.01028079
lea ecx, [ebp - 0x20]
call fcn.010292ca
mov eax, dword [ebp + 8]
call fcn.010a0d4c
ret 8

Function at 0x10aefb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10aefc7
xor eax, eax
jmp 0x10aefca
and eax, 0x10
pop ebp
ret 4
Function at 0x10aefd3
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0x1e
jbe 0x10af018
mov edi, 0xa1
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10af094
test byte [eax + 0x1c], 1
je 0x10af094
push dword [ebp + 8]
push 0x100abe0
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
jmp 0x10af094
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10af098
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10af098
push esi
push 0x5c
push ebx
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10af04c
push 3
jmp 0x10af088
xor eax, eax
inc edi
push edi
push dword [ebp + 0xc]
mov word [esi], ax
push ebx
call fcn.010aefd3
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
jl 0x10af093
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10af091
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x10af091
call esi
push eax
call fcn.010ae4eb
mov edi, eax
jmp 0x10af093
xor edi, edi
pop esi
mov eax, edi
jmp 0x10af09a
xor eax, eax
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x10af0c4
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10af13e
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10af13a
test byte [eax + 0x1c], 1
je 0x10af13a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x10ed030]
push 0x100abe0
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
xor eax, eax
jmp 0x10af148
cmp dword [ebp - 0x114], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010a0c4b
leave
ret
Function at 0x10af798
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0x80070057
test edi, edi
je 0x10af835
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x98
jbe 0x10af834
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10af834
and dword [eax], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0x10
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x10af85e
mov eax, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 0xc], eax
lea edx, [edi + 0x3d0]
push dword [edx]
push esi
call fcn.010af76c
mov dword [esi + 8], eax
mov ebx, dword [edi + 8]
shl ebx, 5
push ebx
push dword [edx]
push esi
call fcn.010af735
test eax, eax
je 0x10af83d
mov dword [ebp - 4], 0x80004005
test esi, esi
je 0x10af833
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0x10
test byte [ebp + 0x10], 1
jne 0x10af87d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x10af867
mov dword [ebp - 4], 0x8007000e
jmp 0x10af81a
mov eax, dword [edi + 8]
shl eax, 5
push eax
push dword [esi + 8]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi + 8], ebx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [eax], esi
jmp 0x10af833

Function at 0x10b0db6
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x80070057
je 0x10b0e75
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10b0e75
cmp dword [esi], 2
jb 0x10b0e75
call fcn.010b0a95
xor ebx, ebx
push ebx
push esi
push dword [ebp + 0xc]
mov esi, 0xffff
push dword [ebp + 8]
push esi
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x10b0e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10b0e16
and eax, esi
or eax, 0x80070000
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b0e6c
test byte [eax + 0x1c], 1
je 0x10b0e6c
push ebx
push dword [ebp + 8]
push 0x100ab68
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059d60
jmp 0x10b0e6c
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b0e6c
test byte [eax + 0x1c], 4
je 0x10b0e6c
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100ab68
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102c7ee
mov ecx, edi
call fcn.010b0ace
jmp 0x10b0e99
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b0e99
test byte [eax + 0x1c], 1
je 0x10b0e99
push 0x100ab68
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc