joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d1bc860
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
sub esp, 0x834
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push ebp
push esi
xor esi, esi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x18], 1
call fcn.6d1b2d40
test eax, eax
mov eax, dword [esp + 0x10]
je 0x6d1bc8ee
cmp eax, esi
je 0x6d1bc8d4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x834
ret
push edi
push 0x20019
push str.JavaSoft
push eax
lea ecx, [esp + 0x30]
call fcn.6d1b2d40
test eax, eax
je 0x6d1bc90f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d1bc93c
mov ecx, dword [esp + 0x24]
push 0x20019
push str.Java_Plug_in
push ecx
lea ecx, [esp + 0x3c]
call fcn.6d1b2d40
test eax, eax
je 0x6d1bc959
mov eax, dword [esp + 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x6d1bc93c
push eax
call edi
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x6d1bc947
push eax
call edi
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x6d1bc952
push eax
call edi
xor eax, eax
jmp 0x6d1bca3c
push 0x800
lea edx, [esp + 0x44]
push esi
push edx
call sub.MSVCR100.dll_memset
mov edi, dword [esp + 0x3c]
add esp, 0xc
push 0x400
lea eax, [esp + 0x44]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x6d1bca15
lea ebx, [ebx]
lea ecx, [esp + 0x20]
push ecx
push 0x20006
push esi
lea edx, [esp + 0x4c]
push edx
push edi
inc ebp
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x6d1bc9ec
xor eax, eax
cmp ebx, esi
je 0x6d1bc9bd
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov ebx, ecx
cmp eax, esi
jne 0x6d1bc9ec
mov eax, dword [esp + 0x848]
push 4
lea edx, [esp + 0x40]
push edx
push 4
push esi
push str.UseJava2IExplorer
push ecx
mov dword [esp + 0x54], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x6d1bc9f0
mov dword [esp + 0x10], esi
push 0x400
lea eax, [esp + 0x44]
push eax
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x6d1bc990
cmp ebx, esi
je 0x6d1bca15
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
jmp 0x6d1bca1b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x6d1bca22
push edi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x6d1bca2d
push eax
call ebx
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x6d1bca38
push eax
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x840]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.6d1c932c
add esp, 0x834
ret
Function at 0x6d1bd430
Capabilities:
Initialize iwebbrowser2

Disassembly:
sub esp, 0x20
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x6d1bd445
xor al, al
pop edi
add esp, 0x20
ret 0xc
push ebx
push ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x38]
push eax
push 0x6d1cc744
push 0x17
push 0
push 0x6d1cee00
mov dword [esp + 0x4c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, eax
test ebp, ebp
js 0x6d1bd514
push esi
mov esi, dword [esp + 0x34]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x64]
push edi
push esi
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x2a4]
push 0
push edi
push esi
call ecx
lea edx, [esp + 0x10]
push edx
mov ebx, eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
push ebx
lea ecx, [esp + 0x24]
mov word [esp + 0x24], ax
call fcn.6d1c8ef8
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push edx
push edx
push edx
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2a8]
push ebx
push edi
push esi
mov ebp, eax
call edx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebx
test edi, edi
je 0x6d1bd513
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
push edi
push esi
call eax
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x38]
test ebp, ebp
setns bl
test eax, eax
je 0x6d1bd52f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebp
mov al, bl
pop ebx
pop edi
add esp, 0x20
ret 0xc

Function at 0x6d1bddc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x6d1bddd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x6d1bde12
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x6d1bde0e
lea ebx, [ebx]
cmp esi, eax
jae 0x6d1bde12
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x6d1bde00
cmp esi, eax
jb 0x6d1bde18
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x6d1be1d0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x944]
sub esp, 0x944
push 0xfffffffffffffffe
push 0x6d1cfba0
push 0x6d1c943c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d1d54cc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x940], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x94c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x950]
mov ecx, dword [ebp + 0x954]
xor ebx, ebx
mov byte [ebp + 0x140], bl
push ecx
push eax
push str._s_s
lea ecx, [ebp + 0x140]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp]
push edx
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d1be2f4
push eax
call dword [sym.imp.kernel32.dll_FindClose]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp + 0x140]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x6d1be2f4
push edi
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x6d1be2f4
mov dword [ebp - 4], ebx
push esi
push edi
push ebx
lea eax, [ebp + 0x140]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x6d1be2e8
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
push str.StringFileInfo040904e4ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x6d1be2e8
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x6d1be2e8
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x6d1d54cc
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
lea eax, [ebx + 1]
jmp 0x6d1be2f6
mov dword [ebp - 4], 0xfffffffe
call fcn.6d1be31e
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x940]
xor ecx, ebp
call fcn.6d1c932c
lea esp, [ebp + 0x944]
pop ebp
ret
Function at 0x6d1be410
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x30
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebp
call dword [sym.imp.kernel32.dll_GetTickCount]
push 1
push 0
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x6d1be44b
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x30
ret
push esi
push 0x24
push str.JavaQuickStarterService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x6d1be47a
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
call edi
test eax, eax
jne 0x6d1be4b6
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x30
ret
mov eax, dword [esp + 0x18]
push ebx
cmp eax, 1
je 0x6d1be580
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
cmp eax, 3
jne 0x6d1be50b
nop
mov edx, dword [esp + 0x30]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
push 0x24
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
call edi
test eax, eax
je 0x6d1be50b
cmp dword [esp + 0x1c], 1
je 0x6d1be50b
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
ja 0x6d1be50b
cmp dword [esp + 0x1c], 3
je 0x6d1be4d0
lea edx, [esp + 0x18]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x6d1be53e
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x30
ret
cmp dword [esp + 0x1c], 1
je 0x6d1be580
mov eax, dword [esp + 0x30]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call edi
test eax, eax
je 0x6d1be580
cmp dword [esp + 0x1c], 1
je 0x6d1be580
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
ja 0x6d1be580
cmp dword [esp + 0x1c], 1
jne 0x6d1be545
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
mov ecx, dword [esp + 0x3c]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.6d1c932c
add esp, 0x30
ret

Function at 0x6d1be5b0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
push 0x800
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, 1
jl 0x6d1be5d4
cmp eax, 0x800
jle 0x6d1be5df
push 0x6d1cccbc
push esi
call edi
add esp, 8
push esi
push str._sjqs.log
push esi
call edi
add esp, 0xc
pop edi
pop esi
ret
Function at 0x6d1bf030
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x828
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x824], eax
push ebp
push esi
mov esi, dword [esp + 0x834]
xor ebp, ebp
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.6d1b2d40
test eax, eax
je 0x6d1bf0b7
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x6d1bf09e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x828
ret
push ebx
mov ebx, dword [esp + 0x24]
push 0x2001f
push str.JavaSoft
push ebx
lea ecx, [esp + 0x18]
call fcn.6d1b2d40
test eax, eax
je 0x6d1bf106
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x6d1bf0e5
push eax
call esi
cmp ebx, ebp
je 0x6d1bf0ec
push ebx
call esi
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x828
ret
push edi
push 0x2001f
lea ecx, [esp + 0x20]
cmp dword [esp + 0x844], ebp
jne 0x6d1bf152
mov edi, dword [esp + 0x14]
push str.Java_Runtime_Environment
push edi
call fcn.6d1b2d40
test eax, eax
je 0x6d1bf18c
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x6d1bf13d
push eax
call esi
cmp edi, ebp
je 0x6d1bf144
push edi
call esi
cmp ebx, ebp
je 0x6d1bf188
push ebx
call esi
xor eax, eax
jmp 0x6d1bf20a
mov eax, dword [esp + 0x14]
push str.Java_Development_Kit
push eax
call fcn.6d1b2d40
test eax, eax
je 0x6d1bf18c
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x6d1bf176
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x6d1bf181
push eax
call esi
cmp ebx, ebp
je 0x6d1bf188
push ebx
call esi
xor eax, eax
jmp 0x6d1bf20a
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x400
lea ecx, [esp + 0x38]
push ecx
push ebp
push edi
mov byte [esi], 0
call ebx
test eax, eax
jne 0x6d1bf1e2
jmp 0x6d1bf1b0
push esi
lea edx, [esp + 0x38]
push edx
inc ebp
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jle 0x6d1bf1d0
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x400
lea ecx, [esp + 0x38]
push ecx
push ebp
push edi
call ebx
test eax, eax
je 0x6d1bf1b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x6d1bf1ef
push edi
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6d1bf1fa
push eax
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6d1bf205
push eax
call esi
mov eax, 1
mov ecx, dword [esp + 0x834]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.6d1c932c
add esp, 0x828
ret
Function at 0x6d1bfc00
Capabilities:
Set registry value

Disassembly:
sub esp, 0x18
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
push 0x20019
lea ecx, [esp + 8]
cmp dword [esp + 0x30], edi
jne 0x6d1bfc56
push str.SOFTWAREJavaSoftJava_Runtime_Environment
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.6d1b2d40
test eax, eax
je 0x6d1bfc5d
mov eax, dword [esp + 4]
cmp eax, edi
je 0x6d1bfc4f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
add esp, 0x18
ret
push str.SOFTWAREJavaSoftJava_Development_Kit
jmp 0x6d1bfc32
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 8]
push esi
push 0x20019
push eax
push ebx
lea ecx, [esp + 0x24]
call fcn.6d1b2d40
test eax, eax
jne 0x6d1bfc97
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push ecx
push str.JavaHome
push esi
lea ecx, [esp + 0x24]
call fcn.6d1b2e10
test eax, eax
je 0x6d1bfcb8
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x6d1bfca8
push eax
call esi
cmp ebx, edi
je 0x6d1bfcaf
push ebx
call esi
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x18
ret
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
push ebp
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
mov ebp, dword [esp + 0x1c]
jne 0x6d1bfcf6
mov byte [eax + esi - 1], 0
test esi, esi
jne 0x6d1bfce0
push 0x80004005
call fcn.6d1b1d60
push esi
call edi
inc eax
push eax
push esi
push 1
push 0
push str.JavaHome
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x6d1bfd03
push ebp
call esi
test ebx, ebx
je 0x6d1bfd0a
push ebx
call esi
pop ebp
pop esi
pop ebx
mov eax, 1
pop edi
add esp, 0x18
ret
Function at 0x6d1bff90
Capabilities:
Copy file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x2464
call fcn.6d1c9470
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x2460], eax
mov eax, dword [esp + 0x2468]
push ebx
push ebp
mov ebp, dword [esp + 0x2474]
push esi
push edi
push eax
lea eax, [esp + 0x1c74]
push str._s_bin_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
add esp, 0xc
lea ecx, [esp + 0x1c70]
push ecx
lea edx, [esp + 0x474]
xor ebx, ebx
push edx
mov byte [esp + 0x478], bl
call esi
push ebp
lea eax, [esp + 0xc74]
push eax
mov byte [esp + 0xc78], bl
call esi
mov dword [esp + 0x14], 3
cmp dword [esp + 0x2480], ebx
je 0x6d1c001d
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x14], ebx
jle 0x6d1c01c9
mov dword [esp + 0x10], 0x6d1ccbc8
jmp 0x6d1c0040
lea ecx, [esp + 0x1c70]
push ecx
lea edx, [esp + 0x1474]
push edx
mov byte [esp + 0x1478], bl
call esi
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1474]
push ecx
call esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1474]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x6d1c01aa
jmp 0x6d1c0090
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x474]
push edx
call esi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0xc74]
push ecx
call esi
push ebx
lea edx, [esp + 0xc74]
push edx
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.kernel32.dll_CopyFileA]
test eax, eax
jne 0x6d1c016b
cmp dword [esp + 0x2480], ebx
jne 0x6d1c01e7
lea ecx, [esp + 0xc70]
push ecx
lea edx, [esp + 0x370]
push str._s..
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
lea eax, [esp + 0x268]
push eax
push 0x105
lea ecx, [esp + 0x378]
push ecx
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
test eax, eax
je 0x6d1c016b
lea edx, [esp + 0x15c]
push edx
push ebx
push 0x6d1cce68
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x6d1c016b
push ebx
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x478]
push edx
call dword [sym.imp.kernel32.dll_CopyFileA]
test eax, eax
je 0x6d1c016b
lea eax, [esp + 0xc70]
push eax
lea ecx, [esp + 0x160]
push ecx
call fcn.6d1bf230
add esp, 8
lea edx, [esp + 0x1c70]
push edx
lea eax, [esp + 0x474]
push eax
mov byte [esp + 0x478], bl
call esi
push ebp
lea ecx, [esp + 0xc74]
push ecx
mov byte [esp + 0xc78], bl
call esi
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d1c0090
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], 0xf
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x14]
jl 0x6d1c0040
mov eax, 1
mov ecx, dword [esp + 0x2470]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.6d1c932c
add esp, 0x2464
ret
push edi
call dword [sym.imp.kernel32.dll_FindClose]
xor eax, eax
jmp 0x6d1c01ce
Function at 0x6d1c0ae0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x19a0
call fcn.6d1c9470
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x199c], eax
push esi
mov esi, dword [esp + 0x19a8]
push 0x7ff
lea eax, [esp + 0x9a5]
push 0
push eax
mov byte [esp + 0x9ac], 0
call sub.MSVCR100.dll_memset
push 0x7ff
lea ecx, [esp + 0x11b1]
push 0
push ecx
mov byte [esp + 0x11b8], 0
call sub.MSVCR100.dll_memset
push 0x7ff
lea edx, [esp + 0x1bd]
push 0
push edx
mov byte [esp + 0x1c4], 0
call sub.MSVCR100.dll_memset
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1cc]
push ecx
push esi
mov dword [esp + 0x3c], 0x800
call fcn.6d1bfc00
add esp, 0x34
test eax, eax
jne 0x6d1c0b90
xor eax, eax
pop esi
mov ecx, dword [esp + 0x199c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x19a0
ret
lea edx, [esp + 0x1a0]
push edx
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp byte [esp + eax + 0x19f], 0x5c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x6d1c0bc3
lea eax, [esp + 0x1a0]
push eax
mov ecx, eax
push 0x6d1ccf3c
push ecx
call esi
add esp, 0xc
push str.jqs.exe
lea edx, [esp + 0x1a4]
push edx
lea eax, [esp + 0x9a8]
push str._sbin_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x9a4]
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d1c0b78
push eax
call dword [sym.imp.kernel32.dll_FindClose]
call fcn.6d1be410
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
lea edx, [esp + 0x9ac]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x11b0]
xor ecx, ecx
push str.__s___unregister
push eax
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x60], 1
mov word [esp + 0x64], cx
call esi
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0x2000000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6d1c0b78
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x8000008
push 0
push 0
push 0
lea ecx, [esp + 0x11c0]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x6d1c0b78
mov eax, dword [esp + 0xc]
push 0x7530
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x19a0]
pop esi
xor ecx, esp
mov eax, 1
call fcn.6d1c932c
add esp, 0x19a0
ret
Function at 0x6d1c1f80
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d1c1fe7
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x6d1c1fc3
cmp eax, 2
jne 0x6d1c1fd6
mov eax, dword [esp + 0x14]
test esi, esi
je 0x6d1c1fe3
test eax, eax
je 0x6d1c1fe0
cmp byte [eax + esi - 1], 0
je 0x6d1c1fe3
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x6d1c1ff0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x208], eax
cmp dword [0x6d1d56bc], 0
je 0x6d1c2027
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x20c
ret
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, 0x104
ja 0x6d1c2094
test eax, eax
je 0x6d1c2094
lea ecx, [esp + 0x104]
push ecx
push 0
push 0x6d1cd188
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x6d1c2094
push 0x6d1cbae0
lea eax, [esp + 0x108]
push eax
push 0x6d1d56bc
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.6d1c932c
add esp, 0x20c
ret

Function at 0x6d1c20f0
Capabilities:
Set registry value

Disassembly:
push ecx
cmp dword [esp + 8], 0
push esi
mov dword [esp + 4], 0
mov esi, str.false
jne 0x6d1c210b
mov esi, str.true
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6d1c2164
cmp dword [esp + 0xc], eax
je 0x6d1c2159
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov edx, dword [esp + 0xc]
push eax
push esi
push 1
push 0
push str.Disabled
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret