joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40121d
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1714]
mov eax, 0x1794
call fcn.0040f5e0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x1710], eax
mov eax, dword [ebp + 0x171c]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x1720]
xor edi, edi
cmp dword [ebp + 0x1728], ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], ebx
jl 0x401326
jg 0x401272
cmp dword [ebp + 0x1724], ebx
jbe 0x401326
mov ecx, dword [ebp + 0x1724]
sub ecx, dword [ebp - 0x6c]
mov eax, dword [ebp + 0x1728]
sbb eax, edi
js 0x401299
jg 0x40128f
cmp ecx, 0x1770
jbe 0x401299
mov ecx, 0x1770
mov dword [ebp - 0x7c], ebx
jmp 0x40129c
mov dword [ebp - 0x7c], eax
push ebx
lea eax, [ebp - 0x64]
push eax
push ecx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40135f
mov eax, dword [ebp - 0x64]
cmp eax, ebx
je 0x40135f
cmp byte [ebp + 0x172c], bl
je 0x4012da
xor ecx, ecx
cmp eax, ebx
jbe 0x4012da
xor byte [ebp + ecx - 0x60], 0x88
inc ecx
cmp ecx, eax
jb 0x4012d0
xor esi, esi
cmp eax, ebx
jbe 0x401304
push ebx
lea ecx, [ebp - 0x70]
push ecx
sub eax, esi
push eax
lea eax, [ebp + esi - 0x60]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401340
add esi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x64]
cmp esi, eax
jb 0x4012e0
add dword [ebp - 0x6c], eax
adc edi, ebx
cmp edi, dword [ebp + 0x1728]
jl 0x401272
jg 0x401326
mov eax, dword [ebp + 0x1724]
cmp dword [ebp - 0x6c], eax
jb 0x401272
xor eax, eax
mov ecx, dword [ebp + 0x1710]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f5c8
add ebp, 0x1714
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x64]
sub eax, esi
push eax
push str.WriteFile_failed__d__d
call fcn.0040c179
add esp, 0xc
push 2
pop eax
jmp 0x401328
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x64]
push str.ReadFile_failed__d__d__I64d
call fcn.0040c179
xor eax, eax
add esp, 0x14
inc eax
jmp 0x401328
Function at 0x403a9b
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x1708]
mov eax, 0x1788
call fcn.0040f5e0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x1704], eax
push ebx
push esi
push str.extracting_files
call fcn.0040c1e2
mov dword [esp], 0x7d2
call fcn.00403888
mov esi, eax
push esi
push 0x428cf8
mov dword [ebp - 0x80], esi
call fcn.0040c1e2
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
jne 0x403b00
cmp byte [ebp + 0x1710], bl
je 0x403af9
mov byte [0x43e930], bl
xor eax, eax
jmp 0x403c58
cmp byte [ebp + 0x1710], bl
je 0x403b0d
call fcn.0040de92
push edi
call fcn.0040106b
push ebx
push ebx
push dword [0x432ce8]
mov dword [ebp - 0x74], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7d3
call fcn.0040382d
mov dword [esp], 0x428cf4
push eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], ebx
call fcn.0040fee0
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
jle 0x403c26
mov edi, 0x43e930
cmp dword [ebp - 0x70], ebx
je 0x403c26
push dword [ebp - 0x70]
call fcn.0040f0b0
pop ecx
test eax, eax
je 0x403c26
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push edi
push 0x428cec
push eax
call fcn.00410061
push 0x5c
push dword [ebp - 0x70]
call fcn.0040eff0
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x403be0
push edi
call fcn.0040f0b0
sub esi, dword [ebp - 0x70]
lea ecx, [ebp + esi - 0x6b]
mov byte [ecx + eax], bl
lea eax, [ebp - 0x6c]
push eax
push str.creating_directory__S
call fcn.0040c1e2
add esp, 0xc
push ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403be0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403be0
lea eax, [ebp - 0x6c]
push eax
push str.failed_to_create_directory__S
call fcn.0040c179
pop ecx
pop ecx
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push edi
push 0x428cec
push eax
call fcn.00410061
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call fcn.00402776
mov esi, eax
add esp, 0x18
cmp esi, ebx
jne 0x403c6f
inc dword [ebp - 0x78]
push 0x428cf4
push ebx
call fcn.0040fee0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x80]
pop ecx
pop ecx
jl 0x403b54
push dword [ebp - 0x7c]
call fcn.0040f388
pop ecx
push 1
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x74]
mov dword [0x432ce0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.extracting_files_done
call fcn.0040c1e2
pop ecx
xor eax, eax
pop edi
mov ecx, dword [ebp + 0x1704]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f5c8
add ebp, 0x1708
leave
ret
lea eax, [ebp - 0x6c]
push eax
push str.Failed_to_extract__S
call fcn.0040c179
push dword [ebp - 0x7c]
call fcn.0040f388
add esp, 0xc
mov eax, esi
jmp 0x403c57
Function at 0x403ff2
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3024
call fcn.0040f5e0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 1
push 0x428e64
push esi
call fcn.0040ffa1
add esp, 0xc
test eax, eax
je 0x4041c4
push esi
call fcn.0040f0b0
pop ecx
test eax, eax
je 0x4041c4
push esi
push 0x428e4c
call fcn.0040c1e2
push esi
call fcn.0040f0b0
add esp, 0xc
test eax, eax
je 0x4041c4
push edi
lea eax, [ebp - 0x2ee4]
push esi
push eax
call fcn.0040f4d0
lea eax, [ebp - 0x2ee4]
push eax
call fcn.0040f0b0
add esp, 0xc
cmp byte [ebp + eax - 0x2ee4], 0x5c
mov edi, 0x428e48
je 0x40408b
lea eax, [ebp - 0x2ee4]
push edi
push eax
call fcn.0040f4e0
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x2ee4]
push 0x428e44
push eax
call fcn.0040f4e0
pop ecx
pop ecx
lea eax, [ebp - 0x3024]
push eax
lea eax, [ebp - 0x2ee4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4041c2
lea eax, [ebp - 0x2ff8]
push 0x428e64
push eax
call fcn.00410a00
pop ecx
pop ecx
test eax, eax
je 0x4041a5
lea eax, [ebp - 0x2ff8]
push 0x428e40
push eax
call fcn.00410a00
pop ecx
pop ecx
test eax, eax
je 0x4041a5
lea eax, [ebp - 0x1774]
push esi
push eax
call fcn.0040f4d0
lea eax, [ebp - 0x1774]
push eax
call fcn.0040f0b0
add esp, 0xc
cmp byte [ebp + eax - 0x1774], 0x5c
je 0x404129
lea eax, [ebp - 0x1774]
push edi
push eax
call fcn.0040f4e0
pop ecx
pop ecx
lea eax, [ebp - 0x2ff8]
push eax
lea eax, [ebp - 0x1774]
push eax
call fcn.0040f4e0
test byte [ebp - 0x3024], 0x10
pop ecx
pop ecx
jbe 0x404185
movzx eax, byte [ebp + 0xc]
push eax
lea eax, [ebp - 0x1774]
push eax
push str.attempting_to_remove__S___d_
call fcn.0040c1e2
add esp, 0xc
cmp byte [ebp + 0xc], 0
je 0x404176
lea eax, [ebp - 0x1774]
push 0
push eax
call fcn.00403ff2
pop ecx
pop ecx
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4041a5
lea eax, [ebp - 0x1774]
push eax
push str.attempting_to_delete__S
call fcn.0040c1e2
pop ecx
pop ecx
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x3024]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4040be
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040f5c8
leave
ret

Function at 0x4042fe
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404322
cmp dword [ebp - 8], 2
jae 0x404340
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error__d_n
call fcn.0040c1e2
push str.Internal_Error:_readShort
call fcn.00403fb1
add esp, 0xc
mov ax, word [ebp - 4]
leave
ret
Function at 0x404392
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004042b4
mov ebx, eax
cdq
sub eax, edx
mov esi, eax
sar esi, 1
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040ef5c
pop ecx
pop ecx
mov edi, eax
xor eax, eax
push eax
mov word [edi + esi*2], ax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4043e4
cmp dword [ebp - 4], ebx
jae 0x4043ef
push str.Internal_Error:_readWString
call fcn.00403fb1
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404e41
Capabilities:
Get common file path
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
mov edi, 0x1770
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x404e6d
push 1
push 1
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405047
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push edi
push esi
push 0x42925c
call ebp
test eax, eax
jbe 0x404ea7
push 0x429248
push esi
call fcn.0040f4e0
pop ecx
pop ecx
test eax, eax
je 0x404ea7
push 1
push 0
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405046
push edi
push esi
push 0x42923c
call ebp
test eax, eax
jbe 0x404eea
push esi
call fcn.0040f0b0
pop ecx
mov ecx, edi
sub ecx, eax
push ecx
push esi
call fcn.0040f0b0
pop ecx
add eax, esi
push eax
push 0x429230
call ebp
test eax, eax
jbe 0x404eea
push 1
push 0
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405046
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push esi
call ebx
test eax, eax
jbe 0x404f1f
push 0x429228
push esi
call fcn.0040f4e0
pop ecx
pop ecx
test eax, eax
je 0x404f1f
push 0
push 0
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push 0x429220
push esi
call fcn.0040f4d0
pop ecx
pop ecx
test eax, eax
je 0x404f45
push 0
push 0
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push 0x429218
push esi
call fcn.0040f4d0
pop ecx
pop ecx
test eax, eax
je 0x404f6b
push 0
push 0
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push edi
push esi
call ebx
xor ebx, ebx
test eax, eax
jbe 0x404f88
push ebx
push ebx
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push 0x429218
push esi
call fcn.0040f4d0
pop ecx
pop ecx
test eax, eax
je 0x404fad
push ebx
push 1
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push esi
push edi
mov byte [0x43d14a], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x404fd0
push ebx
push 1
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push edi
push esi
push 0x42925c
call ebp
test eax, eax
jbe 0x404ffd
push 0x429248
push esi
call fcn.0040f4e0
pop ecx
pop ecx
test eax, eax
je 0x404ffd
push ebx
push ebx
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push edi
push esi
push 0x42923c
call ebp
test eax, eax
jbe 0x405038
push esi
call fcn.0040f0b0
pop ecx
sub edi, eax
push edi
push esi
call fcn.0040f0b0
pop ecx
add eax, esi
push eax
push 0x429230
call ebp
test eax, eax
jbe 0x405038
push ebx
push ebx
push esi
call fcn.00404d4e
add esp, 0xc
test al, al
jne 0x405045
push ebx
push 0x3f7
call fcn.00403fda
pop ecx
pop ecx
pop ebx
pop ebp
pop edi
pop esi
ret
Function at 0x40504a
Capabilities:
Get common file path
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
mov edi, 0x1770
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x405076
push 1
push 1
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x405261
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
push esi
push str.USERPROFILE
call ebp
test eax, eax
jbe 0x4050b0
push str.AppDataLocalTemp
push esi
call fcn.0040fdbc
pop ecx
pop ecx
test eax, eax
je 0x4050b0
push 1
push 0
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x405260
push edi
push esi
push str.HOMEDRIVE
call ebp
test eax, eax
jbe 0x4050f4
push esi
call fcn.0040f87b
pop ecx
mov ecx, edi
sub ecx, eax
push ecx
push esi
call fcn.0040f87b
pop ecx
lea eax, [esi + eax*2]
push eax
push str.HOMEPATH
call ebp
test eax, eax
jbe 0x4050f4
push 1
push 0
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x405260
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push edi
push esi
call ebx
test eax, eax
jbe 0x405129
push 0x429288
push esi
call fcn.0040fdbc
pop ecx
pop ecx
test eax, eax
je 0x405129
push 0
push 0
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push str.c:_temp
push esi
call fcn.0040fdea
pop ecx
pop ecx
test eax, eax
je 0x40514f
push 0
push 0
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push str.c:_tmp
push esi
call fcn.0040fdea
pop ecx
pop ecx
test eax, eax
je 0x405175
push 0
push 0
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push edi
push esi
call ebx
xor ebx, ebx
test eax, eax
jbe 0x405192
push ebx
push ebx
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push str.c:_tmp
push esi
call fcn.0040fdea
pop ecx
pop ecx
test eax, eax
je 0x4051b7
push ebx
push 1
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push esi
push edi
mov byte [0x43d14a], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x4051de
push ebx
push 1
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push edi
push esi
push str.USERPROFILE
call ebp
test eax, eax
jbe 0x40520b
push str.AppDataLocalTemp
push esi
call fcn.0040fdbc
pop ecx
pop ecx
test eax, eax
je 0x40520b
push ebx
push ebx
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
push edi
push esi
push str.HOMEDRIVE
call ebp
test eax, eax
jbe 0x405247
push esi
call fcn.0040f87b
pop ecx
sub edi, eax
push edi
push esi
call fcn.0040f87b
pop ecx
lea eax, [esi + eax*2]
push eax
push str.HOMEPATH
call ebp
test eax, eax
jbe 0x405247
push ebx
push ebx
push esi
call fcn.00404dc6
add esp, 0xc
test al, al
jne 0x40525f
xor eax, eax
mov word [esi], ax
cmp byte [esp + 0x18], al
je 0x40525f
push ebx
push 0x3f7
call fcn.00403fda
pop ecx
pop ecx
pop ebx
pop ebp
pop edi
pop esi
ret
Function at 0x40531b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x177c
call fcn.0040f5e0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1774]
push eax
call fcn.00405264
lea eax, [ebp - 0x1774]
push eax
push 0x42937c
call fcn.0040c1e2
add esp, 0xc
push esi
push 0
push 0x429378
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4053f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempFileName_failed__last_error__d_
call fcn.0040c1e2
lea eax, [ebp - 0x1774]
push eax
call fcn.0040f0b0
add esp, 0xc
test eax, eax
jle 0x4053b9
mov al, byte [ebp + eax - 0x1775]
cmp al, 0x5c
je 0x4053b9
cmp al, 0x2f
je 0x4053b9
lea eax, [ebp - 0x1774]
push 0x428e48
push eax
call fcn.0040f4e0
pop ecx
pop ecx
push edi
push 0
call fcn.00410986
pop ecx
mov edi, eax
mov dword [ebp - 0x1778], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, edi
push eax
call fcn.00410edc
call fcn.00410eee
push eax
lea eax, [ebp - 0x1774]
push eax
push str._se4j_d
push esi
call fcn.00410061
add esp, 0x14
pop edi
push esi
push str.tempFile_is__S
call fcn.0040c1e2
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040f5c8
leave
ret
Function at 0x405bd0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x18b4]
mov eax, 0x18b4
call fcn.0040f5e0
push 0xffffffffffffffff
push 0x4278c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x18b0], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18bc]
mov edi, dword [ebp + 0x18c0]
mov esi, dword [ebp + 0x18c4]
push eax
lea eax, [ebp + 0x140]
push eax
call fcn.0040f4d0
lea eax, [ebp + 0x140]
push 0x4293b4
push eax
call fcn.0040f4e0
add esp, 0x10
cmp byte [edi], 0x2e
je 0x405c57
lea eax, [ebp + 0x140]
push 0x428e64
push eax
call fcn.0040f4e0
pop ecx
pop ecx
lea eax, [ebp + 0x140]
push edi
push eax
call fcn.0040f4e0
pop ecx
pop ecx
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405c85
xor eax, eax
jmp 0x405d1e
lea ecx, [ebp - 0x2c]
call fcn.00405a58
and dword [ebp - 4], 0
push 0x1770
call fcn.00410fc4
lea ecx, [ebp + 0x2c]
push ecx
push eax
mov dword [ebp - 0x10], eax
call fcn.0040f4d0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405ba7
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405c91
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
imul eax, eax, 0x1770
push eax
call fcn.00410fc4
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [esi], eax
jbe 0x405d0a
xor edi, edi
lea ecx, [ebp - 0x2c]
call fcn.0040591b
mov ecx, dword [esi]
mov eax, dword [eax]
mov dword [edi + ecx], eax
lea ecx, [ebp - 0x2c]
call fcn.00405a8f
add edi, 4
cmp dword [ebp - 0x14], 0
ja 0x405cea
lea ecx, [ebp - 0x2c]
call fcn.00405831
push dword [ebp - 0x2c]
call fcn.0040f388
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x18b0]
xor ecx, ebp
call fcn.0040f5c8
add ebp, 0x18b4
leave
ret
Function at 0x408f1a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1778
call fcn.0040f5e0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
push str.SOFTWAREej_technologiesexe4jjvms_
push eax
lea eax, [ebp - 0x1774]
push eax
call fcn.00408ed1
add esp, 0xc
xor edi, edi
push edi
lea eax, [ebp - 0x1778]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp - 0x1774]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x408fba
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 8
lea eax, [ebp + 0xc]
push eax
push 3
push edi
push str.LastWriteTime
push dword [ebp - 0x1778]
call esi
push ebx
call fcn.0040f0b0
pop ecx
push eax
push ebx
push 1
push edi
push str.Version
push dword [ebp - 0x1778]
call esi
push dword [ebp - 0x1778]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040f5c8
leave
ret

Function at 0x408fc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1708]
mov eax, 0x1788
call fcn.0040f5e0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x1704], eax
mov eax, dword [ebp + 0x1710]
push ebx
push esi
mov esi, dword [ebp + 0x171c]
push str.SOFTWAREej_technologiesexe4jjvms_
push eax
lea eax, [ebp - 0x74]
push eax
xor bl, bl
call fcn.00408ed1
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4090ff
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x16fc]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.LastWriteTime
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 8
call edi
test eax, eax
jne 0x4090f5
cmp dword [ebp - 0x78], 8
jne 0x4090f5
push 8
lea eax, [ebp + 0x1714]
push eax
lea eax, [ebp + 0x16fc]
push eax
call fcn.00411fbe
add esp, 0xc
test eax, eax
jne 0x4090f5
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x80]
push eax
push 0
push str.Version
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 0x1770
call edi
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x4090f5
mov eax, dword [ebp - 0x78]
cmp eax, 1
jae 0x4090b5
mov byte [esi], 0
jmp 0x4090c0
add eax, esi
cmp byte [eax - 1], 0
je 0x4090c0
mov byte [eax], 0
push str.1.7.
push esi
call fcn.00410a00
pop ecx
pop ecx
test eax, eax
je 0x4090f3
push str.1.6.
push esi
call fcn.00410a00
pop ecx
pop ecx
test eax, eax
je 0x4090f3
push str.1.5.
push esi
call fcn.00410a00
pop ecx
pop ecx
test eax, eax
jne 0x4090f5
xor bl, bl
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x1704]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040f5c8
add ebp, 0x1708
leave
ret
Function at 0x4093c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409412
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x40949b
Capabilities:
Query environment variable
Set environment variable

Disassembly:
sub esp, 0xdc
mov eax, dword [0x431920]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
push esi
push edi
push 0x7d0
call fcn.0040ef5c
mov esi, str.javaw.exe
push esi
mov edi, eax
call fcn.0040f0b0
pop ecx
pop ecx
push esi
mov ebp, ebx
push ebx
sub ebp, eax
call fcn.0040f0b0
pop ecx
add eax, ebp
push eax
call fcn.00410a00
pop ecx
pop ecx
test eax, eax
jne 0x4094f0
push esi
jmp 0x4094f5
push str.java.exe
call fcn.0040f0b0
or ebp, 0xffffffff
push ebx
sub ebp, eax
call fcn.0040f0b0
pop ecx
mov esi, eax
pop ecx
add esi, ebp
push esi
push ebx
push edi
call fcn.0040f3a0
push edi
mov byte [esi + edi], 0
call fcn.0040dfa4
mov ebx, 0x5dc0
push ebx
mov dword [esp + 0x30], eax
call fcn.0040ef5c
push ebx
mov esi, eax
call fcn.0040ef5c
add esp, 0x18
push 0x2ee0
mov ebp, eax
push ebp
mov ebx, str.PATH
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebp
push esi
call fcn.0040f4d0
push 0x428cf4
push esi
call fcn.0040f4e0
push edi
push esi
call fcn.0040f4e0
add esp, 0x18
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x409582
push esi
push str.Setting_PATH__S
call fcn.0040c1e2
pop ecx
pop ecx
jmp 0x409597
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Setting_PATH__S_failed_with_error__d
call fcn.0040c1e2
add esp, 0xc
push 0x5dc6
call fcn.0040ef5c
push esi
push str.PATH_s
push eax
mov dword [esp + 0x24], eax
call fcn.00410061
push dword [esp + 0x24]
call fcn.0041395b
and dword [esp + 0x24], 0
push 0xc8
lea eax, [esp + 0x38]
push eax
push 0x98
call fcn.004037d1
lea eax, [esp + 0x40]
push eax
call fcn.0040f0b0
add esp, 0x24
test eax, eax
jbe 0x4095f5
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00409417
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], str.hotspot
cmp dword [esp + 0x10], 0
jne 0x40967e
mov eax, dword [esp + 0x18]
push dword [eax]
push edi
call fcn.00409417
add dword [esp + 0x20], 4
cmp dword [esp + 0x20], 0x42abe4
pop ecx
pop ecx
mov dword [esp + 0x10], eax
jl 0x4095fd
test eax, eax
jne 0x40967e
push dword [esp + 0x1c]
call fcn.0040e033
pop ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x40964e
push ebp
push str.Setting_PATH__S
call fcn.0040c1e2
pop ecx
pop ecx
jmp 0x409663
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Setting_PATH__S_failed_with_error__d
call fcn.0040c1e2
add esp, 0xc
push ebp
push str.PATH_s
push dword [esp + 0x1c]
call fcn.00410061
push dword [esp + 0x20]
call fcn.0041395b
add esp, 0x10
push esi
call fcn.0040f388
push ebp
call fcn.0040f388
push dword [esp + 0x1c]
call fcn.0040f388
push edi
call fcn.0040f388
mov ecx, dword [esp + 0xf8]
mov eax, dword [esp + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040f5c8
add esp, 0xdc
ret