joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a3c43
Capabilities:
Get user security identifier

Disassembly:
push 0xe0
mov eax, 0x10dfdd3
call fcn.010a0bbf
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe0], eax
call fcn.0102df27
test ebx, ebx
je 0x10a3dcc
and dword [ebp - 0xd8], 0
and dword [ebp - 4], 0
mov esi, 0x80
push esi
lea ecx, [ebp - 0xd8]
call fcn.010a2554
mov ecx, dword [ebp - 0xd8]
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push ecx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0xe0]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xdc], 0x44
mov dword [ebp - 0xe8], esi
call ebx
test eax, eax
jne 0x10a3d49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10a3dac
cmp dword [ebp - 0xdc], 0x44
jbe 0x10a3cf7
push 0x80004005
call fcn.01027b0b
mov eax, dword [ebp - 0xe8]
cmp eax, esi
jbe 0x10a3d1b
add eax, eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.010a2578
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe4], eax
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xe4]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xe0]
call ebx
test eax, eax
je 0x10a3dac
lea eax, [ebp - 0x54]
push eax
lea eax, [edi + 4]
push eax
push dword [ebp - 0xdc]
mov byte [edi + 0x48], 1
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x10a3dac
push dword [ebp - 0xe4]
lea ecx, [edi + 0x54]
call fcn.01028b05
push dword [ebp - 0xec]
lea ecx, [edi + 0x50]
call fcn.01028b05
push dword [ebp - 0xe0]
lea ecx, [edi + 0x5c]
call fcn.01028b05
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x10a3da8
lea ecx, [ebp - 0xd8]
call fcn.010a2170
mov al, 1
jmp 0x10a3dce
mov ecx, edi
call fcn.0102df27
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x10a3dcc
lea ecx, [ebp - 0xd8]
call fcn.010a2170
xor al, al
call fcn.010a0c51
ret 8
Function at 0x10a3e3f
Capabilities:
Get session user name

Disassembly:
push 0x6c
mov eax, 0x10dfe28
call fcn.010a0bbf
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
cmp eax, esi
je 0x10a3e80
test byte [eax + 0x1c], 1
je 0x10a3e80
cmp byte [eax + 0x19], 5
jb 0x10a3e80
push 0x100a080
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, 0x7fff
push eax
mov ecx, edi
mov dword [ebp - 0x78], eax
call fcn.0102869f
lea ecx, [ebp - 0x78]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
movzx ebx, al
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3ec7
test byte [eax + 0x1c], 2
je 0x10a3ec7
cmp byte [eax + 0x19], 4
jb 0x10a3ec7
push ebx
push 0x100a080
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
push 0xffffffffffffffff
mov ecx, edi
call fcn.0102f001
lea ecx, [ebp - 0x70]
call fcn.010a25eb
and dword [ebp - 4], 0
cmp ebx, 1
jne 0x10a3f8c
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3f0e
test byte [eax + 0x1c], 2
je 0x10a3f0e
cmp byte [eax + 0x19], 4
jb 0x10a3f0e
push dword [edi]
push 0x100a080
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
mov edi, dword [edi]
push 0
push edi
lea ecx, [ebp - 0x70]
call fcn.010a3c43
movzx ebx, al
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3f4b
test byte [eax + 0x1c], 2
je 0x10a3f4b
cmp byte [eax + 0x19], 4
jb 0x10a3f4b
push ebx
push 0x100a080
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, dword [0x10ed030]
cmp ebx, 1
jne 0x10a3f91
lea ecx, [ebp - 0x70]
call fcn.010a3ddb
mov edi, dword [ebp - 0x74]
push eax
mov ecx, edi
call fcn.01028b05
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3fb4
test byte [eax + 0x1c], 2
je 0x10a3f91
cmp byte [eax + 0x19], 4
jb 0x10a3f91
push dword [edi]
push 0x100a080
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a3fb4
test byte [eax + 0x1c], 1
je 0x10a3fb4
cmp byte [eax + 0x19], 5
jb 0x10a3fb4
push ebx
push 0x100a080
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
lea ecx, [ebp - 0x70]
call fcn.0103051e
mov eax, ebx
call fcn.010a0c51
ret 8
Function at 0x10a410a
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x1c
mov eax, 0x10dfe82
call fcn.010a0b4c
mov eax, dword [0x10ed030]
mov edi, 0x10ed030
cmp eax, edi
je 0x10a4142
test byte [eax + 0x1c], 1
je 0x10a4142
cmp byte [eax + 0x19], 5
jb 0x10a4142
push 0x100a080
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push esi
push esi
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a4196
test byte [eax + 0x1c], 2
je 0x10a4196
cmp byte [eax + 0x19], 4
jb 0x10a4196
push ebx
push 0x100a080
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, dword [0x10ed030]
inc dword [ebp - 0x14]
cmp ebx, esi
jne 0x10a42b0
push 0x10f1178
lea ecx, [ebp - 0x10]
call fcn.0104bdc3
mov dword [ebp - 4], esi
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a41db
test byte [eax + 0x1c], 2
je 0x10a41db
cmp byte [eax + 0x19], 4
jb 0x10a41db
push dword [ebp - 0x1c]
push 0x100a080
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x1c], esi
jbe 0x10a42a0
cmp ebx, esi
jne 0x10a42a0
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.01031f2c
push eax
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a4243
test byte [eax + 0x1c], 2
je 0x10a4243
cmp byte [eax + 0x19], 4
jb 0x10a4243
push ebx
push 0x100a080
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
call fcn.0102f001
cmp ebx, esi
jne 0x10a4291
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.010334d5
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a4291
test byte [eax + 0x1c], 2
je 0x10a4291
cmp byte [eax + 0x19], 4
jb 0x10a4291
push dword [ebp - 0x10]
push 0x100a080
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jb 0x10a41e7
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.010280a5
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x10a42e1
test byte [eax + 0x1c], 1
je 0x10a42e1
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10a42e1
push ebx
push 0x100a080
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, ebx
call fcn.010a0c38
ret 8
Function at 0x10a438a
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov eax, dword [0x10ed030]
mov ebx, 0x100a1f8
cmp eax, 0x10ed030
je 0x10a43c4
test byte [eax + 0x1c], 1
je 0x10a43c4
cmp byte [eax + 0x19], 5
jb 0x10a43c4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104adee
push esi
push edi
mov esi, 0x80
xor edi, edi
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 8], edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], 4
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a441a
test byte [eax + 0x1c], 2
je 0x10a441a
cmp byte [eax + 0x19], 5
jb 0x10a441a
push dword [ebp + 8]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov edi, eax
xor edx, edx
cmp edi, edx
je 0x10a44a3
jg 0x10a443c
mov dword [ebp - 4], edi
jmp 0x10a444d
mov ecx, edi
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], edx
jl 0x10a4459
mov dword [ebp - 4], 0x80004005
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10a451c
test byte [ecx + 0x1c], 2
je 0x10a451c
movzx eax, byte [ecx + 0x19]
xor edx, edx
cmp dword [ebp - 4], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x10a451c
push edi
push dword [ebp - 4]
push ebx
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cde9
jmp 0x10a451c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
cmp ecx, esi
jbe 0x10a44e0
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a44d7
test byte [eax + 0x1c], 2
je 0x10a44d7
cmp byte [eax + 0x19], 2
jb 0x10a44d7
push edx
push esi
push edx
push ecx
push ebx
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010a42f0
mov dword [ebp - 4], 0x80004005
jmp 0x10a451c
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10a4508
test byte [eax + 0x1c], 2
je 0x10a4508
cmp byte [eax + 0x19], 5
jb 0x10a4508
push edx
push ecx
push ebx
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cca2
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
push dword [eax + 0x18]
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, dword [0x10ed030]
pop edi
pop esi
cmp eax, 0x10ed030
je 0x10a4572
test byte [eax + 0x1c], 1
je 0x10a4572
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp dword [ebp - 4], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x10a4572
cmp dword [ebp - 4], 0
jl 0x10a455d
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx]
jmp 0x10a4560
or ecx, 0xffffffff
push ecx
push dword [ebp - 4]
push ebx
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010667a3
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8
Function at 0x10a5871
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x40c], eax
mov ecx, dword [0x10ed030]
mov ebx, 0x10ed030
cmp ecx, ebx
je 0x10a58cc
test byte [ecx + 0x1c], 1
je 0x10a58cc
cmp byte [ecx + 0x19], 5
jb 0x10a58cc
push dword [ebp + 0xc]
push esi
push 0x100a1f8
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cde9
mov ecx, dword [0x10ed030]
movzx eax, word [esi]
push 2
pop edx
xor edi, edi
cmp dx, ax
je 0x10a58eb
push 0x17
pop edx
cmp dx, ax
je 0x10a58eb
mov edi, 0x80070057
jmp 0x10a59b6
push 2
push 0
push 0
push 0x401
lea eax, [ebp - 0x408]
push eax
push 0x80
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x10a595d
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edi, eax
test eax, eax
jle 0x10a5925
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x10a592e
mov edi, 0x80004005
mov ecx, dword [0x10ed030]
cmp ecx, ebx
je 0x10a59f0
test byte [ecx + 0x1c], 2
je 0x10a59b6
cmp byte [ecx + 0x19], 2
jb 0x10a59b6
push eax
push 0x100a1f8
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01027ecb
jmp 0x10a59b0
cmp dword [ebp + 0xc], edi
je 0x10a599e
push 0x17
pop eax
cmp ax, word [esi]
jne 0x10a599e
lea eax, [ebp - 0x408]
push 0x25
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x10a5982
mov byte [eax], 0
lea eax, [ebp - 0x408]
push eax
push 0x100a2d0
push dword [ebp - 0x40c]
call fcn.0102aca6
add esp, 0xc
jmp 0x10a59b0
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
call fcn.0104c1a4
mov ecx, dword [0x10ed030]
cmp ecx, ebx
je 0x10a59f0
test byte [ecx + 0x1c], 1
je 0x10a59f0
movzx eax, byte [ecx + 0x19]
xor edx, edx
test edi, edi
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x10a59f0
mov eax, dword [ebp - 0x40c]
push dword [eax]
push edi
push 0x100a1f8
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102c716
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0b37
leave
ret 0xc
Function at 0x10a9637
Capabilities:
Delete registry value

Disassembly:
push 0x14
mov eax, 0x10e0411
call fcn.010a0b4c
mov dword [ebp - 0x14], ecx
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
mov ebx, 0x100a5b0
cmp eax, esi
je 0x10a9679
test byte [eax + 0x1c], 1
je 0x10a9679
cmp byte [eax + 0x19], 5
jb 0x10a9679
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push 0x7a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102c7ac
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.01028b65
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0104c1f5
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
call fcn.010a74d8
mov dword [ebp + 8], eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a96db
test byte [eax + 0x1c], 2
je 0x10a96db
cmp byte [eax + 0x19], 4
jb 0x10a96db
push dword [ebp + 8]
push ebx
push 0x7b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, dword [0x10ed030]
cmp dword [ebp + 8], edi
jne 0x10a973f
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 8], eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a971d
test byte [eax + 0x1c], 2
je 0x10a971d
cmp byte [eax + 0x19], 4
jb 0x10a971d
push dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push 0x7c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104adee
mov eax, dword [0x10ed030]
cmp dword [ebp + 8], 2
jne 0x10a976f
mov dword [ebp + 8], 0x490
cmp eax, esi
je 0x10a979f
test byte [eax + 0x1c], 2
je 0x10a976f
cmp byte [eax + 0x19], 4
jb 0x10a976f
push ebx
push 0x7d
jmp 0x10a975f
cmp dword [ebp + 8], 2
jne 0x10a976f
mov dword [ebp + 8], 0x490
cmp eax, esi
je 0x10a979f
test byte [eax + 0x1c], 2
je 0x10a976f
cmp byte [eax + 0x19], 4
jb 0x10a976f
push ebx
push 0x7e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x10a979f
test byte [eax + 0x1c], 1
je 0x10a979f
mov edx, dword [ebp + 8]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10a979f
push dword [ebp + 8]
push ebx
push 0x7f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.010280a5
lea ecx, [ebp - 0x20]
call fcn.010292a7
mov eax, dword [ebp + 8]
call fcn.010a0c38
ret 8

Function at 0x10aedbd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10aedd4
xor eax, eax
jmp 0x10aedd7
and eax, 0x10
pop ebp
ret 4
Function at 0x10aede0
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0x1e
jbe 0x10aee25
mov edi, 0xa1
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10aeea1
test byte [eax + 0x1c], 1
je 0x10aeea1
push dword [ebp + 8]
push 0x100abe0
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
jmp 0x10aeea1
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10aeea5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10aeea5
push esi
push 0x5c
push ebx
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10aee59
push 3
jmp 0x10aee95
xor eax, eax
inc edi
push edi
push dword [ebp + 0xc]
mov word [esi], ax
push ebx
call fcn.010aede0
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
jl 0x10aeea0
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10aee9e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x10aee9e
call esi
push eax
call fcn.010ae2f8
mov edi, eax
jmp 0x10aeea0
xor edi, edi
pop esi
mov eax, edi
jmp 0x10aeea7
xor eax, eax
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x10aeed1
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10aef4b
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10aef47
test byte [eax + 0x1c], 1
je 0x10aef47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x10ed030]
push 0x100abe0
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
xor eax, eax
jmp 0x10aef55
cmp dword [ebp - 0x114], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010a0b37
leave
ret
Function at 0x10af59d
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0x80070057
test edi, edi
je 0x10af63a
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x98
jbe 0x10af639
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10af639
and dword [eax], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0x10
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x10af663
mov eax, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 0xc], eax
lea edx, [edi + 0x3d0]
push dword [edx]
push esi
call fcn.010af571
mov dword [esi + 8], eax
mov ebx, dword [edi + 8]
shl ebx, 5
push ebx
push dword [edx]
push esi
call fcn.010af53a
test eax, eax
je 0x10af642
mov dword [ebp - 4], 0x80004005
test esi, esi
je 0x10af638
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0x10
test byte [ebp + 0x10], 1
jne 0x10af682
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x10af66c
mov dword [ebp - 4], 0x8007000e
jmp 0x10af61f
mov eax, dword [edi + 8]
shl eax, 5
push eax
push dword [esi + 8]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi + 8], ebx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [eax], esi
jmp 0x10af638

Function at 0x10b0bf5
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x80070057
je 0x10b0cb4
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10b0cb4
cmp dword [esi], 2
jb 0x10b0cb4
call fcn.010b08d4
xor ebx, ebx
push ebx
push esi
push dword [ebp + 0xc]
mov esi, 0xffff
push dword [ebp + 8]
push esi
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x10b0c81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10b0c55
and eax, esi
or eax, 0x80070000
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b0cab
test byte [eax + 0x1c], 1
je 0x10b0cab
push ebx
push dword [ebp + 8]
push 0x100ab68
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104adee
jmp 0x10b0cab
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b0cab
test byte [eax + 0x1c], 4
je 0x10b0cab
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100ab68
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102c7ac
mov ecx, edi
call fcn.010b090d
jmp 0x10b0cd8
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b0cd8
test byte [eax + 0x1c], 1
je 0x10b0cd8
push 0x100ab68
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
Function at 0x10b0ff7
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, 0x80070057
test ebx, ebx
jne 0x10b102d
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b10fe
test byte [eax + 0x1c], 1
je 0x10b10fe
push 0x100ac18
push 0xc
jmp 0x10b1054
cmp dword [ebp + 0xc], 0
jne 0x10b1064
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b10fe
test byte [eax + 0x1c], 1
je 0x10b10fe
push 0x100ac18
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x10b10fe
push esi
push 0x1001900
mov esi, 0x104
push esi
push ebx
call fcn.0104e248
mov edi, eax
test edi, edi
jge 0x10b1098
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b10fd
test byte [eax + 0x1c], 1
je 0x10b10fd
push edi
push 0x100ac18
push 0xe
jmp 0x10b10c2
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0104e248
mov edi, eax
test edi, edi
jge 0x10b10cf
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b10fd
test byte [eax + 0x1c], 1
je 0x10b10fd
push edi
push 0x100ac18
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
jmp 0x10b10fd
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10b10fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10b10fb
test eax, eax
jle 0x10b10f7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10b10fd
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10b1829
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x22c], ax
xor ebx, ebx
lea eax, [ebp - 0x22a]
push ebx
push eax
call sub.msvcrt.dll_memset
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
xor eax, eax
mov dword [ebp - 0x238], ebx
lea edi, [ebp - 0x234]
push 0x100add0
stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
push 0x104
push eax
mov dword [ebp - 0x230], ebx
call fcn.010aceee
mov esi, eax
add esp, 0x1c
cmp esi, ebx
jge 0x10b18d3
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b19da
test byte [eax + 0x1c], 1
je 0x10b19da
push esi
push 0x100ac18
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x10b19d5
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push 0x10041cc
push 0x10
push eax
call fcn.010aceee
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x10b1913
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10b19da
test byte [eax + 0x1c], 1
je 0x10b19da
push esi
push 0x100ac18
push 0x23
jmp 0x10b18c8
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
cmp dword [ebp + 0x18], ebx
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10b19a9
cmp dword [ebp - 0x230], ebx
je 0x10b19b3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x14]
push 8
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x238]
push eax
push 0xb
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10b19a5
jle 0x10b1987
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b19da
test byte [ecx + 0x1c], 1
je 0x10b19da
push eax
push 0x100ac18
push 0x25
jmp 0x10b19cf
xor esi, esi
jmp 0x10b19da
jle 0x10b19b3
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10b19da
test byte [ecx + 0x1c], 1
je 0x10b19da
push eax
push 0x100ac18
push 0x24
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01027ecb
cmp dword [ebp - 0x230], ebx
je 0x10b19ee
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0b37
leave
ret 0x14