joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de4a
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x421460
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40de79
mov eax, 0x80004005
jmp 0x40dfc3
cmp dword [ebp + 8], ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
jne 0x40de96
push 0x421488
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40deb6
mov eax, dword [ebp + 8]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40de9c
sub eax, edi
push eax
push dword [ebp + 8]
push 1
push ebx
push str.LocalFileName
push dword [ebp - 4]
call esi
cmp dword [ebp + 0xc], ebx
jne 0x40decb
push 0x4214a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40deeb
mov eax, dword [ebp + 0xc]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ded1
sub eax, edi
push eax
push dword [ebp + 0xc]
push 1
push ebx
push str.InstallOptions
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x10], ebx
jne 0x40df00
push 0x4214c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40df20
mov eax, dword [ebp + 0x10]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df06
sub eax, edi
push eax
push dword [ebp + 0x10]
push 1
push ebx
push str.UpdateDescription
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x14], ebx
jne 0x40df35
push 0x4214f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40df55
mov eax, dword [ebp + 0x14]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df3b
sub eax, edi
push eax
push dword [ebp + 0x14]
push 1
push ebx
push str.UpdateMoreInfoUrl
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x18], ebx
jne 0x40df6a
push 0x421518
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40df8a
mov eax, dword [ebp + 0x18]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df70
sub eax, edi
push eax
push dword [ebp + 0x18]
push 1
push ebx
push str.BalloonTitle
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x1c], ebx
jne 0x40df9f
push 0x421538
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40dfbf
mov eax, dword [ebp + 0x1c]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dfa5
sub eax, edi
push eax
push dword [ebp + 0x1c]
push 1
push ebx
push str.BalloonTip
push dword [ebp - 4]
call esi
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x40dfc6
Capabilities:
Delete registry value
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x421560
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e05e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x421588
push dword [ebp - 4]
call esi
push 0x421598
push dword [ebp - 4]
call esi
push 0x4215a0
push dword [ebp - 4]
call esi
push str.InstalledJREVersion
push dword [ebp - 4]
call esi
push str.NewJREVersion
push dword [ebp - 4]
call esi
push 0x4215cc
push dword [ebp - 4]
call esi
push str.UpdateDetected
push dword [ebp - 4]
call esi
push str.UpdAvailNotifyCnt
push dword [ebp - 4]
call esi
push str.UpdAvailNotifyTime
push dword [ebp - 4]
call esi
push str.UpdAvailElapsed
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x40e060
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.AllocateAndInitializeSid
push edi
call esi
push str.OpenProcessToken
push edi
mov dword [ebp - 8], eax
call esi
push str.GetTokenInformation
push edi
mov dword [ebp - 0x18], eax
call esi
push str.EqualSid
push edi
mov dword [ebp - 0x10], eax
call esi
push str.FreeSid
push edi
mov dword [ebp - 0x1c], eax
call esi
xor ebx, ebx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 5
mov dword [ebp - 0x14], ebx
call dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 8
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x18]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
call dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.004121fd
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0xc]
call dword [ebp - 0x10]
cmp dword [esi], ebx
mov dword [ebp - 8], ebx
jbe 0x40e14e
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push dword [eax]
push dword [ebp - 0x14]
call dword [ebp - 0x1c]
test eax, eax
jne 0x40e14e
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 0x10], 8
cmp eax, dword [esi]
jb 0x40e131
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [esi]
push esi
setne al
mov dword [ebp - 0x1c], eax
call fcn.0041150d
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [ebp - 0x20]
cmp edi, ebx
je 0x40e17c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e1e6
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xdc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x27
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
push str.win32
lea eax, [ebp + 0x50]
xor ebx, ebx
push eax
mov dword [ebp + 0x64], ebx
mov dword [ebp - 0x50], 0x9c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x50]
push eax
call edi
test eax, eax
jne 0x40e238
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x94
call edi
cmp dword [ebp - 0x40], 2
jne 0x40e299
cmp dword [ebp - 0x4c], 4
jne 0x40e24b
push str.winnt
jmp 0x40e2c4
cmp dword [ebp - 0x4c], 6
jne 0x40e26d
cmp dword [ebp - 0x48], ebx
jne 0x40e2ca
cmp byte [ebp + 0x4a], 1
lea eax, [ebp + 0x50]
jne 0x40e266
push str.winvista
jmp 0x40e2c7
push str.winlong
jmp 0x40e2c7
cmp dword [ebp - 0x4c], 5
jne 0x40e2ca
cmp dword [ebp - 0x48], ebx
jne 0x40e27f
push str.win2000
jmp 0x40e2c4
cmp dword [ebp - 0x48], 1
jne 0x40e28c
push str.winxp
jmp 0x40e2c4
cmp dword [ebp - 0x48], 2
jne 0x40e2ca
push str.win2003
jmp 0x40e2c4
cmp dword [ebp - 0x40], 1
jne 0x40e2ca
cmp dword [ebp - 0x4c], 4
jne 0x40e2bf
cmp dword [ebp - 0x48], 0xa
jne 0x40e2b2
push str.win98
jmp 0x40e2c4
cmp dword [ebp - 0x48], 0x5a
jne 0x40e2bf
push str.winme
jmp 0x40e2c4
push str.win95
lea eax, [ebp + 0x50]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x50]
push eax
push 0x42174c
push dword [ebp + 0x70]
call edi
lea eax, [ebp - 0x3c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e2e7
sub eax, edx
mov dword [ebp + 0x4c], eax
je 0x40e323
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x3c]
push str.Service_Pack__d
push eax
call fcn.00412a88
add esp, 0xc
cmp dword [ebp + 0x64], ebx
jbe 0x40e323
push dword [ebp + 0x64]
lea eax, [ebp + 0x50]
push eax
push str._s_sp_d
push dword [ebp + 0x70]
call edi
add esp, 0x10
mov word [ebp - 0x74], bx
mov ebx, dword [ebp + 0x78]
push str.Unknown
push ebx
call esi
push 0x421770
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e35b
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e35b
lea ecx, [ebp - 0x74]
push ecx
call eax
jmp 0x40e365
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test edi, edi
je 0x40e370
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [ebp - 0x74]
test eax, eax
je 0x40e390
cmp eax, 6
je 0x40e389
cmp eax, 9
jne 0x40e398
push str.amd64
jmp 0x40e395
push str.ia64
jmp 0x40e395
push 0x4217a4
push ebx
call esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
add ebp, 0x68
leave
ret
Function at 0x40e4ab
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
call fcn.0041183d
lea eax, [ebp - 8]
push eax
call fcn.00412c04
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
mov byte [ebp - 0x20c], bl
je 0x40e4f7
push eax
call fcn.00412af9
cmp eax, ebx
pop ecx
je 0x40e4f7
push eax
lea eax, [ebp - 0x20c]
push str._n_s::
push eax
call fcn.004117d4
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x10c]
push eax
push str.TMPDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
lea eax, [ebp - 0x10c]
jne 0x40e529
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40e531
push 0x421bf0
push eax
call esi
push str.jusched.log
lea eax, [ebp - 0x10c]
push eax
call esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e5b8
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x20c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e577
push ebx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40e59c
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e5bd
Capabilities:
Check os version

Disassembly:
push 0xa4
push 0x421d70
call fcn.004113b8
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], 0x94
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0xb0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x40e63f
cmp dword [ebp - 0xb0], 5
jb 0x40e63f
mov dword [ebp - 4], esi
push 0x421c00
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x40e636
push 0x421c0c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e636
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.0040e648
mov eax, dword [ebp - 0x20]
call fcn.004113f3
ret
Function at 0x40e7a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push 0x421c7c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e809
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
push esi
push str.ITCONFIG
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x40e809
movzx esi, byte [ebp - 0x208]
mov eax, esi
pop esi
leave
ret

Function at 0x40e8cb
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x421cf0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e902
push 0x421d18
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40e904
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocString
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x64
mov dword [ebp - 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e997
call fcn.0040e5bd
test eax, eax
je 0x40e96a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040e6fc
add esp, 0x10
jmp 0x40e973
mov eax, dword [ebp - 8]
mov dword [ebp - 0x210], eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x210]
push eax
push 3
push esi
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x40edf9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
push ebx
push edi
mov ebx, 0x20019
push ebx
xor edi, edi
push 0x421138
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.00408569
test eax, eax
jne 0x40effe
push ebx
push 0x421144
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.00408569
test eax, eax
jne 0x40effe
push ebx
push 0x421150
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.00408569
test eax, eax
jne 0x40effe
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push str.CurrentVersion
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.0040859e
test eax, eax
je 0x40eea9
lea ecx, [ebp - 8]
call fcn.00408552
lea ecx, [ebp - 4]
call fcn.00408552
lea ecx, [ebp - 0xc]
call fcn.00408552
lea ecx, [ebp - 0x10]
call fcn.00408552
mov eax, edi
jmp 0x40f020
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 8]
push dword [ebp - 4]
call fcn.00408569
test eax, eax
jne 0x40eee5
lea eax, [ebp + 0x10]
push eax
push 0x42117c
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.0040859e
test eax, eax
jne 0x40eee5
push dword [ebp + 0xc]
call fcn.0040ddc4
test eax, eax
pop ecx
jne 0x40eff6
push esi
mov esi, 0x400
push esi
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x14], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov byte [ebp - 0x818], 0
jmp 0x40efa7
push eax
lea eax, [ebp - 0x418]
push eax
mov dword [ebp + 0x10], esi
call fcn.0041d00e
test eax, eax
pop ecx
pop ecx
jle 0x40ef9c
push ebx
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.00408569
test eax, eax
jne 0x40ef99
lea eax, [ebp + 0x10]
push eax
push str.JavaHome
lea eax, [ebp - 0xc18]
push eax
lea ecx, [ebp - 8]
call fcn.0040859e
test eax, eax
jne 0x40ef99
cmp dword [ebp + 0x10], eax
jbe 0x40ef99
lea eax, [ebp - 0xc18]
push eax
call fcn.0040ddc4
test eax, eax
pop ecx
je 0x40ef99
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x818]
push 0x421194
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xc18]
push eax
push 0x421198
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
inc dword [ebp - 0x14]
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x14]
push dword [ebp - 4]
call edi
test eax, eax
lea eax, [ebp - 0x818]
je 0x40ef09
lea edx, [eax + 1]
pop esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40efbe
sub eax, edx
mov dword [ebp - 0x14], eax
je 0x40effe
lea eax, [ebp - 0x818]
push eax
push 0x42119c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40efea
sub eax, ecx
mov dword [ebp + 0x10], eax
xor edi, edi
inc edi
jmp 0x40ee82
lea ecx, [ebp - 8]
call fcn.00408552
lea ecx, [ebp - 4]
call fcn.00408552
lea ecx, [ebp - 0xc]
call fcn.00408552
lea ecx, [ebp - 0x10]
call fcn.00408552
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x40f024
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x114
push esi
push edi
mov esi, 0x20019
push esi
xor edi, edi
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x70], edi
mov dword [ebp + 0x60], edi
mov dword [ebp + 0x64], edi
call fcn.00408569
test eax, eax
je 0x40f065
xor esi, esi
jmp 0x40f142
push esi
push 0x4211ac
push dword [ebp + 0x68]
lea ecx, [ebp + 0x6c]
call fcn.00408569
test eax, eax
jne 0x40f05e
push esi
push str.Java_Runtime_Environment
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x70]
call fcn.00408569
test eax, eax
jne 0x40f05e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x80
mov byte [ebp - 0xa0], al
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x70]
call ebx
test eax, eax
jne 0x40f13e
inc dword [ebp + 0x60]
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041d00e
test eax, eax
pop ecx
pop ecx
jle 0x40f10c
push 6
mov edi, str.1.6.0
lea esi, [ebp - 0x20]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40f10a
lea eax, [ebp - 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f0e3
sub eax, edx
cmp eax, 3
jbe 0x40f10a
xor eax, eax
mov cl, byte [ebp + eax - 0x20]
mov byte [ebp + eax - 0xa0], cl
inc eax
test cl, cl
jne 0x40f0f3
mov dword [ebp + 0x64], 1
xor edi, edi
push 0x80
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x70]
call ebx
test eax, eax
je 0x40f0b3
cmp dword [ebp + 0x64], edi
je 0x40f13e
lea eax, [ebp - 0xa0]
push eax
push 0x4211dc
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov esi, dword [ebp + 0x64]
pop ebx
lea ecx, [ebp + 0x70]
call fcn.00408552
lea ecx, [ebp + 0x6c]
call fcn.00408552
lea ecx, [ebp + 0x68]
call fcn.00408552
pop edi
mov eax, esi
pop esi
add ebp, 0x74
leave
ret
Function at 0x40f42a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [0x426060]
push 0xf003f
xor ebx, ebx
push 0x421374
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00408569
test eax, eax
je 0x40f46f
mov esi, 0x80004005
jmp 0x40f55e
push ebx
push ebx
mov esi, 0x2001f
push esi
push ebx
push ebx
push 0x421380
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.0040ce80
test eax, eax
jne 0x40f465
push ebx
push ebx
push esi
push ebx
push ebx
push 0x42138c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0040ce80
test eax, eax
jne 0x40f465
push ebx
push ebx
push esi
push ebx
push ebx
push 0x421398
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.0040ce80
test eax, eax
jne 0x40f465
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x422528
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
mov dword [ebp - 8], 0x80004005
jne 0x40f4ee
push 0x4213a0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40f55b
mov dword [ebp - 8], ebx
jmp 0x40f55b
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x40f54d
mov edi, dword [ebp - 4]
cmp edi, ebx
jne 0x40f510
xor eax, eax
jmp 0x40f535
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.004118d0
mov eax, esp
push dword [ebp - 0x1c]
push esi
push edi
push eax
call fcn.0040db9e
push 0xffffffffffffffff
push ebx
push str.TransferJobID
push eax
lea ecx, [ebp - 0xc]
call fcn.0040cece
test eax, eax
jne 0x40f54d
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x40f55b
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0xc]
call fcn.00408552
lea ecx, [ebp - 0x10]
call fcn.00408552
lea ecx, [ebp - 0x14]
call fcn.00408552
lea ecx, [ebp - 0x18]
call fcn.00408552
mov eax, esi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f7d2
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x8c
push edi
push 0x20019
push 0x4216a0
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0x6c]
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x70], edi
mov dword [ebp + 0x68], 0x80
call fcn.00408569
test eax, eax
jne 0x40f89e
push 0x2001f
push str.JavaSoft
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x70]
call fcn.00408569
test eax, eax
jne 0x40f89e
cmp dword [ebp + 0x7c], edi
jne 0x40f83a
push 0x4216b8
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40f89b
lea eax, [ebp + 0x68]
push eax
push 0x4216c8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x70]
call fcn.0040859e
test eax, eax
jne 0x40f888
cmp dword [ebp + 0x68], edi
je 0x40f888
push esi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, 0x4216d8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
jmp 0x40f89b
push 0xffffffffffffffff
push edi
push dword [ebp + 0x7c]
lea ecx, [ebp + 0x70]
push 0x4216e8
call fcn.0040cece
xor edi, edi
inc edi
lea ecx, [ebp + 0x70]
call fcn.00408552
lea ecx, [ebp + 0x6c]
call fcn.00408552
mov eax, edi
pop edi
add ebp, 0x74
leave
ret
Function at 0x410923
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp dword [0x427d94], 0
je 0x41093c
mov eax, dword [0x427d90]
leave
ret
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x84], 2
pop edi
jne 0x41097b
cmp dword [ebp - 0x90], 6
jne 0x41097b
mov eax, ecx
jmp 0x41097d
xor eax, eax
mov dword [0x427d90], eax
mov dword [0x427d94], ecx
leave
ret

Function at 0x410a25
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x410a48
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x410a48
mov bl, 1
mov al, bl
pop ebx
ret

Function at 0x41220f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004118d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4122aa
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x427e5c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4122aa
cmp eax, 1
je 0x4122cb
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4122aa
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x412277
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4122a6
xor eax, eax
inc eax
jmp 0x4122ea
cmp edi, eax
jae 0x4122ae
xor eax, eax
jmp 0x4122ea
cmp eax, esi
jae 0x4122b5
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x427e5c]
jmp 0x4122ce
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret