joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c28f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40c29e
pop dword [ebp - 0x50]
mov eax, 0x40c29e
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xdc8e4cf3
sub dword [ebp - 0x60], 0x8e3c07a8
mov dword [ebp - 0x5c], 0xbd24a0f9
add dword [ebp - 0x5c], 0x750eab4c
mov dword [ebp - 0x58], 0x55822cd4
add dword [ebp - 0x58], 0xf6ca175a
mov dword [ebp - 0x54], 0xb907e9c1
sub dword [ebp - 0x54], 0xb907e9c1
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf7c1cc20
sub dword [ebp - 0x60], 0x834f62ca
mov dword [ebp - 0x5c], 0xc612f546
sub dword [ebp - 0x5c], 0x84a693d1
mov dword [ebp - 0x58], 0xeff86560
add dword [ebp - 0x58], 0x7377070c
mov dword [ebp - 0x54], 0x11bd3b79
sub dword [ebp - 0x54], 0x11bd3b79
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38972
push 0
call eax
mov ecx, 0x505b21c9
sub ecx, 0x505ad600
mov ebx, eax
mov edi, 0xf3ffb628
add edi, 0xc4239d8
add edi, dword [ebp - 0x50]
mov edx, 0x5a971090
xor dword [ebp - 0x4c], edi
mov esi, dword [edi]
xor dword [ebp - 0x28], 0xd2045ba8
add esi, edx
mov dword [ebp - 0x48], 0x4faa75af
mov dword [ebx], esi
xor dword [ebp - 0x28], ecx
add ebx, 4
add edi, 0xb1d5167b
sub edi, 0xb1d51677
loop 0x40c3ab
add eax, 0xb4bed797
add eax, 0x4b424a60
mov ebx, eax
add eax, 5
mov ecx, 0xdf7edc95
add ecx, 0x20c1236b
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4035fc
pop dword [ebp - 0x18]
mov eax, 0xa2028e1f
sub eax, 0xa1c25823
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x1d68d6c
add dword [ebp - 0x28], 0x4c7bb7df
mov dword [ebp - 0x24], 0x34257ae9
sub dword [ebp - 0x24], 0x1f22ea4
mov dword [ebp - 0x20], 0x2170f876
sub dword [ebp - 0x20], 0xd524b448
mov dword [ebp - 0x1c], 0xcbc50aa8
sub dword [ebp - 0x1c], 0xcbc50aa8
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xcc69ff5c
sub dword [ebp - 0x28], 0x57f79606
mov dword [ebp - 0x24], 0x26e1c05f
add dword [ebp - 0x24], 0x1a8aa116
mov dword [ebp - 0x20], 0x2919769e
sub dword [ebp - 0x20], 0xc5aa0a32
mov dword [ebp - 0x1c], 0xf8880a52
sub dword [ebp - 0x1c], 0xf8880a52
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x9e8ef543
add eax, 0x61b17add
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39ca5
push 0
call eax
mov ecx, 0x9b7af8b8
add ecx, 0x648557b1
mov edx, eax
mov edi, 0xbb7bf5c9
sub edi, 0xbb3b2dc9
add edi, dword [ebp - 0x18]
mov esi, 0x95711b51
add dword [ebp - 4], 0x7a991bba
mov ebx, dword [edi]
mov dword [ebp - 0xc], 0x46c367a1
xor ebx, esi
sub dword [ebp - 4], 0xd26ea29d
mov dword [edx], ebx
xor dword [ebp - 0xc], 0x7ab58a2b
add edx, 4
add edi, 0x68fef07c
sub edi, 0x68fef078
loop 0x403713
add eax, 0x6b826e0c
add eax, 0x947ec66b
mov ebx, eax
add eax, 0x1a4a6574
sub eax, 0x1a4a656f
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x10], 0x4f
dec edi
jl 0x407f72
or byte [ebp + 0x10], al
dec esi
add byte [eax], al
add cl, cl
inc ebp
or ah, bl
sbb eax, 0x8d402c30
mov ecx, dword [ebp + 0x18]
pushfd
mov ebx, dword [ebp + 0x20]
push esi
mov dl, 0xf6
push edi
fnstsw ax
mov dword [ebp - 4], esi
mov dword [ecx], esi
test ah, 5
xor edi, ebx
jp 0x407ef9
fld qword [ebp + 8]
fld dword [edi]
mov ecx, 0xf7c7085d
add eax, edi
add cl, bl
mov esp, ebx
or al, 0x8b
push ebp
or byte [ebp + 0x5950ec45], cl
invalid
fld qword [ebp - 0x14]
fmul qword [0x40c3d7]
lea eax, [ebp - 0x14]
push eax
sbb dword [edx], 8
fstp qword [esp]
mov dword [0x40c11815], eax
jnp 0x407fea
pop ebp
hlt
hlt
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401bd7
pop dword [ebp - 0x14]
mov eax, 0x401bd7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x76d18388
sub dword [ebp - 0x24], 0x287f3e3d
mov dword [ebp - 0x20], 0x4388a49a
sub dword [ebp - 0x20], 0x11555855
mov dword [ebp - 0x1c], 0x88eda249
sub dword [ebp - 0x1c], 0x3ca15e1b
mov dword [ebp - 0x18], 0x7e5e6fe9
sub dword [ebp - 0x18], 0x7e5e6fe9
lea eax, [ebp - 0x24]
push eax
mov eax, 0xd026edf2
sub eax, 0xcfe67d92
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb11756bf
sub dword [ebp - 0x24], 0x3ca4ed69
mov dword [ebp - 0x20], 0x81554b5d
add dword [ebp - 0x20], 0xc0171618
mov dword [ebp - 0x1c], 0xa72f45fa
add dword [ebp - 0x1c], 0xbc402672
mov dword [ebp - 0x18], 0x2be4f4b9
add dword [ebp - 0x18], 0xd41b0b47
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x2ca8b7df
add eax, 0xd397b921
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x35c9f
push 0
call eax
mov ecx, 0x44db
xor edx, edx
add edx, eax
mov ebx, 0x6a45fca9
sub ebx, 0x6a04fca9
add ebx, dword [ebp - 0x14]
mov edi, 0xc5e8af4c
sub edi, 0x23b6ceb8
xor dword [ebp - 0x10], ebx
mov esi, dword [ebx]
xor dword [ebp - 4], edi
xor esi, edi
xor dword [ebp - 8], 0xf55b2d4b
mov dword [edx], esi
add dword [ebp - 0x10], 0x80b7f454
add edx, 0xa4c58c3d
add edx, 0x5b3a73c7
add ebx, 0x5e2e0eb2
sub ebx, 0x5e2e0eae
loop 0x401cf0
add eax, 0xbb077395
sub eax, 0xbb066d56
xor ebx, ebx
add ebx, eax
add eax, 0x49ee3119
sub eax, 0x49ee3114
mov ecx, 0xcb6dd227
add ecx, 0x34d22dd9
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x8045b0
Capabilities:
Accept command line arguments
Delete directory
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1820
call fcn.0040c510
cmp dword [0x266225c], 0x37
jne 0x80466f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x403298
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x4032d0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x1020]
push edx
push 0
push 0x403364
push 0x403394
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x4033b4
push 0x4033bc
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov eax, dword [0x2662260]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x8253ec]
mov byte [eax + esi], dl
add esp, 0x1820
ret

Function at 0x8046a0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov edx, dword [0x81cf44]
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [0x81cf40]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x81cf48]
mov dword [esp + 0x20], edx
mov edx, dword [0x81cf4c]
push edi
mov dword [esp + 0x14], eax
mov edi, 0xc6ef3720
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov ebp, 0x20
jmp 0x8046f4
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 5
add ecx, dword [esp + 0x18]
mov edx, eax
shl edx, 4
add edx, dword [esp + 0x1c]
add eax, edi
xor ecx, edx
xor ecx, eax
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov dword [0x265820c], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x266225c], 0x1be
lea ebx, [edi + esi]
jne 0x804749
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x24]
mov dword [0x2658210], 0xff6b3619
xor eax, ebx
xor dword [esp + 0x10], eax
mov dword [0x2658214], 0xffffffff
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add edi, 0x61c88647
dec ebp
jne 0x8046f0
cmp dword [0x266225c], 0x8d4
jne 0x8047af
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0x60
ret 4
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x60
ret 4
Function at 0x401050
Capabilities:
Write file on windows

Disassembly:
cmp word [eax], 0
je 0x40117f
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x4c
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401068
mov ebx, eax
sub ebx, esi
sar ebx, 1
cmp esi, eax
je 0x4010b4
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
call edi
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4010bc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x38], ecx
call ecx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [ebp - 0x34], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4010b4
mov ecx, dword [ebp - 0x38]
call ecx
xor edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0x30]
mov dword [esp + 8], esi
xor esi, esi
mov dword [esp + 0xc], ebx
mov dword [esp], eax
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 4], ecx
mov ebx, dword [ebp - 0x34]
call ebx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call edi
push ebx
lea ebx, [ebp - 0x1c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0x2c]
mov dword [esp + 8], edx
mov edi, dword [ebp - 0x30]
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4010b4
ret

Function at 0x401510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push eax
mov eax, 0x101c
call fcn.004037a8
lea esi, [ebp - 0x1008]
sub esp, eax
mov eax, dword [esp + eax]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x401566
test byte [section..data], 2
jne 0x40157a
mov eax, esi
call fcn.00401050
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.LoadString_failed__error__ld_n
mov dword [esp + 8], str.fatal_string
mov dword [esp + 4], 0x404000
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.004014c0
jmp 0x401566
Function at 0x4015c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1038
call fcn.004037a8
lea edi, [ebp - 0x1018]
sub esp, eax
mov esi, edx
mov eax, dword [esp + eax]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x800
mov dword [esp + 8], edi
mov dword [esp + 4], 0x67
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
jne 0x401621
test byte [section..data], 2
jne 0x4016df
mov eax, edi
call fcn.00401050
mov eax, 0x405046
call fcn.00401050
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x1020], esi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x101c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x3100
call dword [sym.imp.kernel32.dll_FormatMessageW]
sub esp, 0x1c
test eax, eax
jne 0x4016b8
test byte [section..data], 2
jne 0x401692
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.FormatMessage_failed_n
mov dword [esp + 8], str.fatal_error
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call fcn.004014c0
jmp 0x401685
mov eax, dword [ebp - 0x101c]
call fcn.00401050
mov eax, dword [ebp - 0x101c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
push eax
mov eax, 0x405062
call fcn.00401050
jmp 0x401685
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.LoadString_failed__error__ld_n
mov dword [esp + 8], str.fatal_string_error
mov dword [esp + 4], 0x404000
mov dword [esp], 1
mov dword [esp + 0x10], eax
call fcn.004014c0
jmp 0x401621
Function at 0x4011f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
ror esi, 0xd3
ror eax, 0xff
rcr esi, 0x92
rcl esi, 0xda
or edi, 0x90
and edx, 0xef
or eax, 0x80
rcr ebx, 0x95
or edi, 0xc
dec esi
add ebx, 0xaf
and edx, 0x32
ror edi, 0xa1
sub eax, 0xaa
neg ebx
add esi, 0x35
sub edx, 0x58
neg ebx
dec edx
neg edi
rol edx, 0x54
and edx, 0x4a
not esi
and edi, 0xa2
and eax, 0x66
mov edx, 6
not edi
neg edi
sub ebx, 0xec
not edx
mov eax, 0x96
dec edx
sbb eax, 0x91
rcl edi, 0x2c
sub edx, 0xcb
inc edi
or eax, 0xd8
inc eax
inc eax
dec edx
add esi, 0x9a
dec esi
not eax
sub ebx, 9
mov ebx, 0xde
neg edi
not ebx
rol esi, 0x85
rcr ebx, 0x64
neg edx
xor ecx, ecx
xor edi, edi
not edx
add eax, 0xec
rcr edi, 0x5b
imul esi
bswap edi
sbb edi, 0xbc
imul esi
add edx, 0xc0
ror ebx, 0xae
dec edi
sub esi, 0x51
rcl eax, 0xaa
neg edx
not edx
mov esi, 0x2f
ror esi, 0x35
neg eax
bswap eax
sub edi, 0xba
inc ebx
rcr ebx, 0xc
rcl edx, 0xf6
imul ebx
sbb edx, 0x5f
not ebx
neg ebx
dec edx
add eax, 0x6d
bswap edi
and ebx, 0x3a
sbb eax, 0x72
bswap edx
not ebx
not edx
rcr esi, 0xd3
rol edi, 0x9d
sbb ebx, 0x69
neg ebx
and esi, 0xe
neg edx
sub ebx, 0x1f
imul eax
imul edx
and eax, 0x4b
not ebx
sub ebx, 0x79
sbb edi, 0x92
imul edx
mov edx, 0x7a
add eax, 0x40
mov ecx, dword [ebp + 0xc]
dec eax
imul edx
add esi, 0xd6
not esi
sub edx, 0xbf
not esi
bswap edi
rol edx, 0xe5
and edx, 0xdd
neg edx
ror ebx, 0xe7
inc edx
bswap edi
or ebx, 0x7b
imul ebx
inc eax
dec edx
inc ebx
dec eax
neg edx
not esi
inc edx
and edi, 0xf0
imul edi
neg esi
mov esi, 0xbf
dec esi
sbb edi, 0x59
rcr esi, 0x76
neg edx
ror edx, 0x20
imul esi
dec ebx
rol edi, 2
not edx
imul esi
dec ebx
mov eax, 3
and edx, 0x6a
ror edi, 0x6a
rcl edi, 0x72
mov eax, 0x16
imul eax
or eax, 0x7e
rol ebx, 0x66
sub ebx, 3
neg edx
rcr ebx, 0xfc
imul eax
add esi, 8
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, esi
xor ebx, ebx
not byte [edi]
xor esi, esi
mov esi, ebx
xor eax, esi
sub byte [edi], 0x88
xor eax, esi
mov ebx, eax
mov eax, ebx
add byte [edi], 0x49
mov eax, esi
xor esi, esi
xor ebx, eax
imul byte [edi]
inc edi
loop 0x4013b3
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407554
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40755e
repz ret
jmp fcn.0040b4bc
Function at 0x40aef8
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x4976a0]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
mov esi, dword [ebp + 0xb4]
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateEventA]
xor ebx, ebx
push ebx
push ebx
mov dword [esi + 0xc], 0xbc2
mov eax, dword [0x49afc4]
push 1
push ebx
mov dword [esi + 0x18], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x20], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x38], eax
call fcn.0042ef2e
mov dword [esi + 0x3c], eax
xor eax, eax
mov byte [ebp - 0x7c], bl
lea edi, [ebp - 0x7b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x68], ebx
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.SunJavaUpdateRecheckUpdateEvent
lea eax, [ebp - 0x7c]
push ebx
mov dword [ebp - 0x64], eax
push ebx
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0xc
call dword [sym.imp.kernel32.dll_CreateEventA]
push dword [esi + 0x20]
mov edi, dword [sym.imp.kernel32.dll_ResetEvent]
mov dword [esi + 0x40], eax
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x38]
call edi
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push 0x40b4e8
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, ebx
je 0x40afe0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esi + 0x20]
call edi
mov edi, dword [sym.imp.user32.dll_LoadStringA]
mov ebx, 0x104
push ebx
lea eax, [esi + 0x54]
push eax
push 0x7b
push dword [esi + 0x18]
call edi
push ebx
lea eax, [ebp - 0x5c]
push eax
push 0x7c
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.0040b1cc
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044a628
add ebp, 0xac
leave
ret 4
Function at 0x40f0c4
Capabilities:
Delete registry key

Disassembly:
push 0x38
mov eax, 0x46aa1a
call fcn.00452564
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x40], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x2c], bl
cmp eax, ebx
jne 0x40f130
cmp dword [ebp + 0x10], ebx
jne 0x40f10d
push 0x2001f
push str.SOFTWAREJavaSoftJava_UpdatePolicyjucheck
lea eax, [ebp - 0x40]
call fcn.00433a77
mov eax, dword [ebp - 0x38]
mov dword [ebp + 8], eax
jmp 0x40f122
push str.SetJavaUpdateStringKey_was_called_with_a_NULL_value_for_the_key__so_defaulting_to_trying_jucheck_key
call fcn.0042665c
pop ecx
lea eax, [ebp + 8]
push eax
call fcn.0042ef2e
pop ecx
cmp dword [ebp + 8], ebx
je 0x40f133
mov dword [ebp - 0x10], 1
jmp 0x40f133
mov dword [ebp + 8], eax
xor esi, esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.0040fa1a
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x10], ebx
je 0x40f164
push dword [ebp + 0x10]
lea ebx, [ebp - 0x24]
call fcn.0042ef2e
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40f1b1
cmp dword [ebp + 0x10], ebx
jne 0x40f17c
push dword [ebp + 0xc]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40f1aa
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 1
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call fcn.0042ef2e
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
call fcn.00433b51
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp - 0x10], ebx
je 0x40f1be
lea esi, [ebp - 0x40]
call fcn.00433aae
lea esi, [ebp - 0x20]
call fcn.004347b9
mov eax, edi
call fcn.0045263c
ret
Function at 0x40f263
Capabilities:
Delete file
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x4976a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x40c]
xor ebx, ebx
push eax
mov esi, SysStringLen
push ebx
lea edx, [ebp - 0x408]
mov ecx, str.LocalFileName
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x410], ebx
mov byte [ebp - 0x414], bl
mov dword [ebp - 0x40c], 0x400
call fcn.0040ef60
pop ecx
pop ecx
test eax, eax
je 0x40f2cf
cmp dword [ebp - 0x40c], ebx
je 0x40f2cf
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea edi, [ebp - 0x408]
call fcn.0042ef2e
test eax, eax
je 0x40f2f2
mov eax, edi
push eax
mov ecx, edi
call fcn.0040f553
pop ecx
mov eax, edi
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
call fcn.0042ef2e
push ebx
push str.PreDownldStatus
push ebx
call fcn.0040f0c4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x80
lea eax, [ebp - 0x408]
push eax
push ebx
push esi
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x424], esi
call edi
test eax, eax
jne 0x40f3bb
mov esi, 0x20019
inc dword [ebp - 0x40c]
push esi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x428]
call fcn.00433a77
cmp eax, ebx
jne 0x40f399
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x444], eax
push esi
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x430], bl
call fcn.00433a77
mov ecx, dword [ebp - 0x43c]
mov dword [ebp - 0x440], ecx
cmp eax, ebx
jne 0x40f399
push str.VersionXmlURL
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x80
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
push dword [ebp - 0x424]
call edi
test eax, eax
je 0x40f335
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a628
leave
ret