joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a0d
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4104a0
push 0x40e836
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x460
push ebx
push esi
push edi
push 1
pop ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x130], 4
xor esi, esi
push esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x401a5e
mov eax, ebx
jmp 0x401be1
push str.http:__java.sun.com
push 0x4131f8
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push 0x4131fc
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x401bd2
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x26c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x26c], 0x3c
lea eax, [ebp - 0x230]
mov dword [ebp - 0x25c], eax
mov eax, 0x100
mov dword [ebp - 0x258], eax
mov word [ebp - 0x254], si
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], eax
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x26c]
push eax
push esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
push esi
push esi
push 3
push 0x415c54
push 0x415c58
push dword [ebp - 0x254]
push dword [ebp - 0x25c]
push dword [ebp - 0x1c]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x12c], eax
cmp eax, esi
je 0x401bd2
push esi
push 0x4400000
push esi
push 0x415c5c
push 0x413204
lea ecx, [ebp - 0x46c]
push ecx
push 0x413210
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
mov dword [ebp - 0x128], edi
cmp edi, esi
je 0x401bd2
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x401ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x470], eax
sub eax, 0x2ee2
je 0x401b9e
sub eax, 5
je 0x401b9e
sub eax, 0x16
jne 0x401ba4
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x20], esi
push esi
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x401bd2
cmp dword [ebp - 0x20], 0x197
jne 0x401bd2
mov dword [ebp - 0x124], ebx
or dword [ebp - 4], 0xffffffff
call fcn.00401bf2
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403cff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
xor esi, esi
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
or dword [ebp - 4], 0xffffffff
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x58], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403d6a
push dword [ebp - 0x14]
call fcn.00404551
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x403d5f
cmp dword [ebp - 4], 0x669
jne 0x403d5f
mov dword [ebp - 4], esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403d73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x407e0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
mov dword [esi + 0xc], 0xbc2
mov eax, dword [0x415b94]
push ebx
push 1
push ebx
mov dword [esi + 0x18], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x20], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x34], eax
call fcn.00409b13
mov dword [esi + 0x38], eax
call fcn.0040c10d
push dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esi + 0x3c], eax
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x34]
call edi
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x408312
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x20]
call edi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebx, 0x104
lea eax, [esi + 0x58]
push ebx
push eax
push 0x7b
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x104]
push ebx
push eax
push 0x7c
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x104]
mov ecx, esi
push eax
call fcn.00408031
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x408b4b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push 1
push eax
call fcn.00408a76
pop ecx
test eax, eax
pop ecx
je 0x408c43
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push 0
push 0x413a8c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408c43
lea eax, [ebp - 4]
push esi
push eax
push 0x413ab4
push dword [ebp - 8]
call fcn.00408d14
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0xc
test eax, eax
jne 0x408be1
lea eax, [ebp - 4]
push eax
push 0x413ac0
push dword [ebp - 0xc]
call fcn.00408d14
add esp, 0xc
test eax, eax
je 0x408be1
push dword [ebp - 4]
push 0x413acc
push dword [ebp - 8]
call fcn.0040909b
add esp, 0xc
test eax, eax
je 0x408be1
push 0x413ad8
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
push eax
push 0x413ae4
push dword [ebp - 8]
call fcn.00408d14
add esp, 0xc
test eax, eax
jne 0x408c32
lea eax, [ebp - 4]
push eax
push 0x413af4
push dword [ebp - 0xc]
call fcn.00408d14
add esp, 0xc
test eax, eax
je 0x408c32
push dword [ebp - 4]
push 0x413b04
push dword [ebp - 8]
call fcn.0040909b
add esp, 0xc
test eax, eax
je 0x408c32
push 0x413b14
push dword [ebp - 0xc]
call esi
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
pop esi
leave
ret

Function at 0x4090ff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp + 8]
xor ebx, ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x413c6c
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x409132
xor eax, eax
jmp 0x40918b
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x34]
push 0x1e
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetTimeFromSystemTime]
test eax, eax
jne 0x409154
mov byte [ebp - 0x34], bl
push esi
push edi
lea edi, [ebp - 0x34]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x34]
push ecx
push eax
push 1
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409275
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push edi
and dword [ebp - 4], 0
push 0x25
xor eax, eax
pop ecx
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x409324
cmp dword [ebp - 0x94], 6
je 0x40931f
cmp dword [ebp - 0x94], 5
jne 0x409324
cmp dword [ebp - 0x90], 1
jae 0x40931f
lea eax, [ebp - 0x84]
test eax, eax
je 0x409310
lea edi, [ebp - 0x84]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x409310
lea edi, [ebp - 0x84]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x409310
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push 0x413cf8
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [ebp - 0x90], 0
jne 0x409324
cmp dword [ebp - 4], 2
jb 0x409324
push 1
pop eax
jmp 0x409326
xor eax, eax
pop edi
leave
ret

Function at 0x409329
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
pop edi
jne 0x409383
cmp dword [ebp - 0x90], 6
jne 0x40936f
push 1
pop eax
leave
ret
cmp dword [ebp - 0x90], 5
jne 0x409383
push 1
pop eax
cmp dword [ebp - 0x8c], eax
je 0x409385
xor eax, eax
leave
ret
Function at 0x40a2c0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 0x2001f
push ebx
push 0x414044
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40a2ef
mov eax, 0x80004005
jmp 0x40a42d
cmp dword [ebp + 8], ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
jne 0x40a30c
push 0x41406c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a32a
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 8]
push 1
push ebx
push str.LocalFileName
push dword [ebp - 4]
call esi
cmp dword [ebp + 0xc], ebx
jne 0x40a33f
push 0x41408c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a35d
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 0xc]
push 1
push ebx
push str.InstallOptions
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x10], ebx
jne 0x40a372
push 0x4140ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a390
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 0x10]
push 1
push ebx
push str.UpdateDescription
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x14], ebx
jne 0x40a3a5
push 0x4140d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a3c3
mov edi, dword [ebp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 0x14]
push 1
push ebx
push str.UpdateMoreInfoUrl
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x18], ebx
jne 0x40a3d8
push 0x4140fc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a3f6
mov edi, dword [ebp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 0x18]
push 1
push ebx
push str.BalloonTitle
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x1c], ebx
jne 0x40a40b
push 0x41411c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a429
mov edi, dword [ebp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 0x1c]
push 1
push ebx
push str.BalloonTip
push dword [ebp - 4]
call esi
pop edi
xor eax, eax
pop esi
pop ebx
Function at 0x40a47e
Capabilities:
Delete registry value
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x414144
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a516
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x41416c
push dword [ebp - 4]
call esi
push 0x41417c
push dword [ebp - 4]
call esi
push 0x414184
push dword [ebp - 4]
call esi
push 0x41418c
push dword [ebp - 4]
call esi
push 0x4141a0
push dword [ebp - 4]
call esi
push 0x4141b0
push dword [ebp - 4]
call esi
push 0x4141bc
push dword [ebp - 4]
call esi
push 0x4141cc
push dword [ebp - 4]
call esi
push 0x4141e0
push dword [ebp - 4]
call esi
push 0x4141f4
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x40a518
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.AllocateAndInitializeSid
push edi
call esi
push str.OpenProcessToken
push edi
mov dword [ebp - 8], eax
call esi
push str.GetTokenInformation
push edi
mov dword [ebp - 0x18], eax
call esi
push str.EqualSid
push edi
mov dword [ebp - 0x10], eax
call esi
push str.FreeSid
push edi
mov dword [ebp - 0x1c], eax
call esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x28]
push 2
push eax
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 5
mov dword [ebp - 0x14], ebx
call dword [ebp - 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x18]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
call dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0xc]
call dword [ebp - 0x10]
cmp dword [esi], ebx
mov dword [ebp - 8], ebx
jbe 0x40a607
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push dword [eax]
push dword [ebp - 0x14]
call dword [ebp - 0x1c]
test eax, eax
jne 0x40a607
inc dword [ebp - 8]
add dword [ebp - 0x10], 8
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
jb 0x40a5ea
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [esi]
push esi
setne al
mov dword [ebp - 0x1c], eax
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [ebp - 0x20]
cmp edi, ebx
je 0x40a636
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a63e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x27
pop ecx
xor eax, eax
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x9c
push eax
call esi
test eax, eax
jne 0x40a68a
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
push eax
call esi
test eax, eax
je 0x40a6af
cmp dword [ebp - 0x8c], 2
jne 0x40a6ac
cmp dword [ebp - 0x98], 6
jae 0x40a6ac
cmp dword [ebp - 0x98], 4
jb 0x40a6ac
call fcn.0040a518
jmp 0x40a6af
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x40a8b8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x27
xor eax, eax
pop ecx
lea edi, [ebp - 0xb4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
xor ebx, ebx
push str.win32
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xb4], 0x9c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0xb4]
push eax
call edi
test eax, eax
jne 0x40a917
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0x94
push eax
call edi
cmp dword [ebp - 0xa4], 2
jne 0x40a994
cmp dword [ebp - 0xb0], 4
jne 0x40a933
push str.winnt
jmp 0x40a9cb
cmp dword [ebp - 0xb0], 6
jne 0x40a95c
cmp dword [ebp - 0xac], ebx
jne 0x40a9d1
cmp byte [ebp - 0x1a], 1
jne 0x40a955
push str.winvista
jmp 0x40a9cb
push str.winlong
jmp 0x40a9cb
cmp dword [ebp - 0xb0], 5
jne 0x40a9d1
cmp dword [ebp - 0xac], ebx
jne 0x40a974
push str.win2000
jmp 0x40a9cb
cmp dword [ebp - 0xac], 1
jne 0x40a984
push str.winxp
jmp 0x40a9cb
cmp dword [ebp - 0xac], 2
jne 0x40a9d1
push str.win2003
jmp 0x40a9cb
cmp dword [ebp - 0xa4], 1
jne 0x40a9d1
cmp dword [ebp - 0xb0], 4
jne 0x40a9c6
cmp dword [ebp - 0xac], 0xa
jne 0x40a9b6
push str.win98
jmp 0x40a9cb
cmp dword [ebp - 0xac], 0x5a
jne 0x40a9c6
push str.winme
jmp 0x40a9cb
push str.win95
lea eax, [ebp - 0x18]
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x18]
push eax
push 0x414330
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0xa0]
add esp, 0xc
test eax, eax
je 0x40aa37
lea edi, [ebp - 0xa0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40aa37
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa0]
push str.Service_Pack__d
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp dword [ebp - 4], 0
jbe 0x40aa37
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
push str._s_sp_d
push dword [ebp + 8]
call ebx
add esp, 0x10
mov ebx, dword [ebp + 0x10]
and word [ebp - 0xd8], 0
push str.Unknown
push ebx
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40aa76
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa76
lea ecx, [ebp - 0xd8]
push ecx
call eax
jmp 0x40aa83
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test edi, edi
je 0x40aa8e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [ebp - 0xd8]
test eax, eax
je 0x40aab1
cmp eax, 6
je 0x40aaaa
cmp eax, 9
jne 0x40aab9
push str.amd64
jmp 0x40aab6
push str.ia64
jmp 0x40aab6
push 0x414388
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b771
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_time]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_localtime]
pop ecx
mov edx, eax
pop ecx
mov edi, 0x415d1c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x20c]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
cmp edx, edi
je 0x40b7e5
push edx
call dword [sym.imp.MSVCRT.dll_asctime]
cmp eax, edi
pop ecx
je 0x40b7e5
push eax
lea eax, [ebp - 0x20c]
push str._n_s::
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ebx, 0x104
lea eax, [ebp - 0x10c]
push ebx
push eax
push str.TMPDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x40b817
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40b825
lea eax, [ebp - 0x10c]
push 0x4147d0
push eax
call esi
lea eax, [ebp - 0x10c]
push str.jusched.log
push eax
call esi
push edi
push 0x80
push 4
push edi
push 2
lea eax, [ebp - 0x10c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40b8a9
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push edi
push eax
lea edi, [ebp - 0x20c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20c]
not ecx
dec ecx
push ecx
push eax
push ebx
call esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 8]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b8ae
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4109c0
push 0x40e836
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 0x94
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 2
jne 0x40b94d
cmp dword [ebp - 0xac], 5
jb 0x40b94d
mov dword [ebp - 4], esi
push 0x4147e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xb4], eax
cmp eax, esi
je 0x40b944
push 0x4147ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b944
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
call fcn.0040b95f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bb20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 1
push esi
push 0x41485c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bb81
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x208]
push eax
push esi
push esi
push str.ITCONFIG
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x40bb81
movzx esi, byte [ebp - 0x208]
mov eax, esi
pop esi
leave
ret

Function at 0x40bb99
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
xor esi, esi
mov dword [ebp - 4], 0x200
call fcn.0040bb86
test eax, eax
jne 0x40bc3d
call fcn.00409275
test eax, eax
je 0x40bc3d
lea eax, [ebp - 0xc]
push eax
push 1
push esi
push 0x414890
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bc40
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x4148b8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x40bc40
mov dword [ebp - 8], esi
call fcn.0040b8ae
test eax, eax
je 0x40bc32
lea eax, [ebp - 8]
push 4
push eax
lea eax, [ebp - 0x20c]
push dword [ebp - 4]
push eax
call fcn.0040b975
mov eax, dword [ebp - 8]
add esp, 0x10
jmp 0x40bc38
mov eax, dword [ebp - 0x20c]
cmp eax, 0x64
jne 0x40bc40
push 1
pop esi
mov eax, esi
pop esi
leave
ret

Function at 0x40bc45
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x4148d0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bc7c
push 0x4148f8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40bc7e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocString
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x64
mov dword [ebp - 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40bd11
call fcn.0040b8ae
test eax, eax
je 0x40bce4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040ba39
add esp, 0x10
jmp 0x40bced
mov eax, dword [ebp - 8]
mov dword [ebp - 0x210], eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x210]
push eax
push 3
push esi
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret