joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100109c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100109cf
pop dword [ebp - 0x40]
mov eax, 0x100109cf
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x975e465c
sub dword [ebp - 0x50], 0x490c0111
mov dword [ebp - 0x4c], 0xee98570b
sub dword [ebp - 0x4c], 0xbc650ac6
mov dword [ebp - 0x48], 0xdd741f7e
sub dword [ebp - 0x48], 0x9127db50
mov dword [ebp - 0x44], 0x5b3c40ab
sub dword [ebp - 0x44], 0x5b3c40ab
lea eax, [ebp - 0x50]
push eax
mov eax, 0x9e8f8b0b
sub eax, 0x8e8dfacf
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf8da39bc
sub dword [ebp - 0x50], 0x8467d066
mov dword [ebp - 0x4c], 0x1a8384f1
sub dword [ebp - 0x4c], 0xd917237c
mov dword [ebp - 0x48], 0xb93109ae
sub dword [ebp - 0x48], 0x55c19d42
mov dword [ebp - 0x44], 0x7f6264ee
add dword [ebp - 0x44], 0x809d9b12
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x33c57f3c
sub eax, 0x23c3ef04
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x370eb
push 0
call eax
mov ecx, 0x91638731
sub ecx, 0x91633d59
mov edi, eax
mov ebx, 0x84a45f99
add ebx, 0x8b5dc867
add ebx, dword [ebp - 0x40]
mov edx, 0xaa562217
sub edx, 0xb67fc807
add dword [ebp - 0x10], edx
mov esi, dword [ebx]
xor dword [ebp - 0x24], eax
sub esi, edx
mov dword [ebp - 8], 0x2e271b17
mov dword [edi], esi
add dword [ebp - 0x34], ecx
add edi, 4
add ebx, 0x368d2d0d
sub ebx, 0x368d2d09
loop 0x10010aec
add eax, 0xa0d87f10
add eax, 0x5f289b23
mov ebx, eax
add eax, 0x793b67de
add eax, 0x86c49827
mov ecx, 0xbc1a3aac
add ecx, 0x53e5c554
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x1e1b69
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [ebp - 0x118]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
call fcn.001e1ae5
mov ebx, eax
cmp ebx, esi
je 0x1e1bd5
cmp dword [ebp - 0x118], esi
je 0x1e1bce
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1e1c6d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1e1bfd
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x118]
call fcn.001e1b69
mov dword [ebp - 0x124], eax
cmp eax, esi
jne 0x1e1c7e
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x118]
mov dword [ebp - 0x11c], pe_nt_image_headers32
call ebx
test eax, eax
je 0x1e1bdd
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x118], esi
je 0x1e1c48
push dword [ebp - 0x118]
call ebx
mov dword [ebp - 0x118], esi
push dword [ebp - 0x120]
mov dword [ebp - 0x114], esi
call fcn.001e1a0a
mov edi, eax
cmp dword [ebp - 0x118], esi
je 0x1e1c6b
push dword [ebp - 0x118]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.001fe56d
leave
ret 4
cmp dword [ebp - 0x118], esi
je 0x1e1c92
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
jmp 0x1e1c6d
Function at 0x1e4bb2
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x818], ebx
mov byte [ebp - 0x81c], bl
mov dword [esi], ebx
call fcn.001ee146
mov dword [esi], eax
cmp eax, ebx
jne 0x1e4c0e
push str.ERROR:_ShutdownEvent_handle_is_NULL
call fcn.001f262c
pop ecx
mov dword [ebp - 0x810], 0xfffffffe
push ebx
push dword [ebp - 0x814]
call fcn.001ed91e
pop ecx
pop ecx
test eax, eax
jne 0x1e4c36
push str.jusched_ERROR:_Could_not_open_Policy_key_for_reading
call fcn.001f262c
mov dword [ebp - 0x810], 0xfffffffd
jmp 0x1e4c5f
mov eax, dword [ebp - 0x814]
push dword [eax]
call fcn.001e4b33
pop ecx
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x1e4c60
push str.jusched_main:_ERROR_creating_registry_watch_event_notifier
call fcn.001f262c
mov dword [ebp - 0x810], 0xfffffffe
pop ecx
push str.SunJavaUpdateSchedulerMutex
push 1
push ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
cmp eax, ebx
jne 0x1e4ce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7ff
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x80b]
push ebx
push eax
mov byte [ebp - 0x80c], bl
call fcn.001ff900
add esp, 0xc
cmp dword [ebp - 0x810], 0xb7
lea eax, [ebp - 0x80c]
jne 0x1e4cbf
push str.Error:_Scheduler_Mutex_already_exists_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0x1e4cd4
push dword [ebp - 0x810]
push str.Error:_Error_creating_scheduler_mutex:__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
call fcn.001f262c
or dword [ebp - 0x810], 0xffffffff
pop ecx
cmp dword [ebp - 0x810], ebx
je 0x1e4d13
push dword [edi]
push esi
call fcn.001e4b84
mov eax, dword [ebp - 0x814]
mov eax, dword [eax]
pop ecx
pop ecx
lea esi, [ebp - 0x830]
mov dword [ebp - 0x82c], eax
call fcn.001f2d4a
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x810]
pop esi
xor ecx, ebp
pop ebx
call fcn.001fe56d
leave
ret
Function at 0x1e6672
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
mov esi, dword [ebp + 0xb4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ebx, ebx
push ebx
push ebx
mov dword [esi + 0xc], 0xbc2
mov eax, dword [0x22a618]
push 1
push ebx
mov dword [esi + 0x18], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x20], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x38], eax
call fcn.001ee146
mov dword [esi + 0x3c], eax
xor eax, eax
mov byte [ebp - 0x7c], bl
lea edi, [ebp - 0x7b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x68], ebx
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.SunJavaUpdateRecheckUpdateEvent
lea eax, [ebp - 0x7c]
push ebx
mov dword [ebp - 0x64], eax
push ebx
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0xc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x40], eax
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x38]
call edi
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push 0x1e6c47
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x1e675a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x20]
call edi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebx, 0x104
push ebx
lea eax, [esi + 0x58]
push eax
push 0x7b
push dword [esi + 0x18]
call edi
push ebx
lea eax, [ebp - 0x5c]
push eax
push 0x7c
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1e67ac
lea eax, [ebp - 0x5c]
push eax
add esi, 0x15c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.001fe56d
add ebp, 0xac
leave
ret 4
Function at 0x1ea36b
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x2159f9
call fcn.0020501e
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x38], ebx
cmp eax, 0xffffffff
jne 0x1ea38e
xor eax, eax
call fcn.002050a1
ret 4
mov ecx, dword [ebx + 0x24]
mov edx, dword [ecx]
xor esi, esi
cmp edx, esi
je 0x1ea3b4
mov ecx, dword [ebx + 0x34]
mov edi, dword [ecx]
add edi, edx
cmp edx, edi
jae 0x1ea3b4
dec dword [ecx]
mov ebx, dword [ebx + 0x24]
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov dword [ebx], edx
mov byte [ecx], al
jmp 0x1ea386
cmp dword [ebx + 0x54], esi
jne 0x1ea3be
or eax, 0xffffffff
jmp 0x1ea386
mov eax, ebx
call fcn.001eaf79
cmp dword [ebx + 0x44], esi
jne 0x1ea3e3
movsx eax, byte [ebp + 8]
push dword [ebx + 0x54]
push eax
call fcn.00201729
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x1ea3b9
mov eax, dword [ebp + 8]
jmp 0x1ea386
mov al, byte [ebp + 8]
push esi
push 8
pop edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], al
call fcn.001eab20
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1ea4a0
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x34]
push edi
mov edi, dword [ebp - 0x1c]
add edi, eax
push edi
push edx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
push dword [ebp - 0x40]
call dword [esi + 0x14]
test eax, eax
js 0x1ea4c8
cmp eax, 1
jg 0x1ea4a8
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1ea44c
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x1ea472
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1ea45f
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.002023ff
add esp, 0x10
cmp esi, eax
jne 0x1ea4c8
lea eax, [ebp - 0x2d]
mov byte [ebx + 0x49], 1
cmp dword [ebp - 0x3c], eax
jne 0x1ea4c3
test esi, esi
jne 0x1ea3ff
cmp dword [ebp - 0x1c], 0x20
jae 0x1ea4c8
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.001eab71
mov ebx, dword [ebp - 0x38]
jmp 0x1ea3ff
mov edx, dword [ebp - 0x2c]
jmp 0x1ea411
cmp eax, 3
jne 0x1ea4c8
movsx eax, byte [ebp - 0x2d]
push dword [ebx + 0x54]
push eax
call fcn.00201729
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x1ea4cb
mov esi, dword [ebp + 8]
jmp 0x1ea4cb
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.001e5dcc
mov eax, esi
jmp 0x1ea386
Function at 0x1eae81
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x2159cc
call fcn.0020501e
mov ebx, ecx
cmp dword [ebx + 0x44], 0
mov dword [ebp - 0x34], ebx
je 0x1eaf71
cmp byte [ebx + 0x49], 0
je 0x1eaf71
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1eaeb9
xor al, al
jmp 0x1eaf73
push 0
push 8
pop edi
lea esi, [ebp - 0x2c]
call fcn.001eab20
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1eaf10
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
push eax
push edx
push dword [ebp - 0x38]
call dword [esi + 0x18]
xor edi, edi
sub eax, edi
je 0x1eaf15
dec eax
je 0x1eaf19
dec eax
dec eax
je 0x1eaf6d
xor bl, bl
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.001e5dcc
mov al, bl
jmp 0x1eaf73
mov edx, dword [ebp - 0x2c]
jmp 0x1eaede
mov byte [ebx + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1eaf25
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x1eaf4b
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1eaf38
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.002023ff
add esp, 0x10
cmp esi, eax
jne 0x1eaeff
cmp byte [ebx + 0x49], 0
je 0x1eaf6d
cmp esi, edi
jne 0x1eaed0
push edi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.001eab71
mov ebx, dword [ebp - 0x34]
jmp 0x1eaed0
mov bl, 1
jmp 0x1eaf01
mov al, 1
call fcn.002050a1
ret
Function at 0x1edc2a
Capabilities:
Delete registry key

Disassembly:
push 0x38
mov eax, 0x216fcf
call fcn.00204fb3
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x40], 0x80000002
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x2c], bl
cmp eax, ebx
jne 0x1edc96
cmp dword [ebp + 0x10], ebx
jne 0x1edc73
push 0x2001f
push str.SOFTWAREJavaSoftJava_UpdatePolicyjucheck
lea eax, [ebp - 0x40]
call fcn.001f2d13
mov eax, dword [ebp - 0x38]
mov dword [ebp + 8], eax
jmp 0x1edc88
push str.SetJavaUpdateStringKey_was_called_with_a_NULL_value_for_the_key__so_defaulting_to_trying_jucheck_key
call fcn.001f262c
pop ecx
lea eax, [ebp + 8]
push eax
call fcn.001ed96d
pop ecx
cmp dword [ebp + 8], ebx
je 0x1edc99
mov dword [ebp - 0x10], 1
jmp 0x1edc99
mov dword [ebp + 8], eax
xor esi, esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.001ee897
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x10], ebx
je 0x1edcca
push dword [ebp + 0x10]
lea ebx, [ebp - 0x24]
call fcn.001fbe05
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1edd17
cmp dword [ebp + 0x10], ebx
jne 0x1edce2
push dword [ebp + 0xc]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1edd10
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call fcn.001ff040
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
call fcn.001f2ded
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp - 0x10], ebx
je 0x1edd24
lea esi, [ebp - 0x40]
call fcn.001f2d4a
lea esi, [ebp - 0x20]
call fcn.001ead65
mov eax, edi
call fcn.0020508d
ret
Function at 0x1edefb
Capabilities:
Delete file
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x40c]
xor ebx, ebx
push eax
mov esi, 0x80000003
push ebx
lea edx, [ebp - 0x408]
mov ecx, str.LocalFileName
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x410], ebx
mov byte [ebp - 0x414], bl
mov dword [ebp - 0x40c], 0x400
call fcn.001eda5f
pop ecx
pop ecx
test eax, eax
je 0x1edf67
cmp dword [ebp - 0x40c], ebx
je 0x1edf67
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [ebp - 0x408]
call fcn.001ed9ab
test eax, eax
je 0x1edf8a
mov eax, edi
push eax
mov ecx, edi
call fcn.001ee69c
pop ecx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.001ee062
push ebx
push str.PreDownldStatus
push ebx
call fcn.001edc2a
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x80
lea eax, [ebp - 0x408]
push eax
push ebx
push esi
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x424], esi
call edi
test eax, eax
jne 0x1ee053
mov esi, 0x20019
inc dword [ebp - 0x40c]
push esi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x428]
call fcn.001f2d13
cmp eax, ebx
jne 0x1ee031
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x444], eax
push esi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x430], bl
call fcn.001f2d13
mov ecx, dword [ebp - 0x43c]
mov dword [ebp - 0x440], ecx
cmp eax, ebx
jne 0x1ee031
push str.VersionXmlURL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x80
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
push dword [ebp - 0x424]
call edi
test eax, eax
je 0x1edfcd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.001fe56d
leave
ret
Function at 0x1ee3f3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.001ff900
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x1ee44e
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x94
call esi
test eax, eax
je 0x1ee473
cmp dword [ebp - 0x98], 2
jne 0x1ee470
cmp dword [ebp - 0xa4], 6
jae 0x1ee470
cmp dword [ebp - 0xa4], 4
jb 0x1ee470
call fcn.001ee1f5
jmp 0x1ee473
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.001fe56d
leave
ret

Function at 0x1ee69c
Capabilities:
Get common file path
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x5cc]
sub esp, 0x64c
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp + 0x5c8], eax
mov eax, dword [ebp + 0x5d4]
push ebx
push esi
push edi
push 0x3c
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x80]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x3c4], bl
call fcn.001ff900
lea eax, [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x50], 0x400
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov edi, 0x104
cmp eax, ebx
je 0x1ee744
push pe_nt_image_headers32
lea eax, [ebp + 0x3c4]
push eax
push edi
lea eax, [ebp + 0x4c4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00202a6a
lea eax, [ebp + 0x4c4]
push 0x21e234
push eax
call fcn.001ff500
add esp, 0x2c
test eax, eax
je 0x1ee78d
mov eax, esi
mov dword [ebp - 0x40], ebx
cmp byte [esi], bl
je 0x1ee775
mov cl, byte [eax]
cmp cl, 0x20
je 0x1ee759
cmp cl, 9
jne 0x1ee762
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x1ee74d
mov ecx, dword [ebp - 0x40]
movsx edx, byte [eax]
imul ecx, ecx, 0x1f
add ecx, edx
inc eax
mov dword [ebp - 0x40], ecx
cmp byte [eax], bl
jne 0x1ee74d
push dword [ebp - 0x40]
lea eax, [ebp + 0x4c4]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x4c4]
push eax
push dword [ebp - 0x44]
call esi
lea eax, [ebp + 0x3c4]
push eax
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp + 0x5c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.001fe56d
add ebp, 0x5cc
leave
ret
Function at 0x1f09fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x228630]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push esi
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000002
mov dword [ebp - 0x78], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1f0add
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.TransferJobID
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x78], 0
jbe 0x1f0add
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
je 0x1f0add
lea eax, [ebp - 0x70]
push eax
call esi
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x1f0a9b
xor eax, eax
jmp 0x1f0ab1
lea eax, [edi + edi]
call fcn.00210a00
mov esi, esp
push 3
push edi
lea eax, [ebp - 0x70]
push eax
call fcn.001e1106
push dword [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x10
push 0x219410
push dword [ebp - 0x74]
call fcn.00200158
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x1f0ae2
mov eax, 0x80004005
lea esp, [ebp - 0x88]
pop edi
pop esi
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
call fcn.001fe56d
add ebp, 0x394
leave
ret

Function at 0x1f1d60
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x2162f2
call fcn.0020501e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
dec ecx
push 4
neg ecx
sbb ecx, ecx
mov esi, edx
pop edx
and ecx, 0xfffffffc
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
add ecx, edx
lea eax, [ebp - 0x54]
push eax
or ecx, 1
push ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], edx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x1f1ded
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.001f1cfa
push eax
lea eax, [ebp - 0x4c]
push str.encryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.001e60a2
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.001e7285
push 0x22234c
mov eax, esi
push eax
call fcn.00204705
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.001ee897
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.001fe580
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.002050a1
ret