joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094e9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040fb75
test eax, eax
pop ecx
jne 0x409516
cmp dword [ebp + 0xc], eax
je 0x409512
push edi
push str.File__s_does_not_exist.
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
jmp 0x409595
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
jmp 0x40952c
mov cl, byte [eax + edi]
cmp cl, 0x5c
je 0x409533
cmp cl, 0x2f
je 0x409533
dec eax
test eax, eax
jg 0x40951f
jmp 0x409534
inc eax
push ebx
push esi
xor esi, esi
lea ebx, [eax + edi]
push dword [esi*8 + 0x426170]
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x409555
inc esi
cmp esi, 0xe
jb 0x40953b
jmp 0x409568
push dword [esi*8 + 0x426174]
push edi
call fcn.0040d17e
test eax, eax
pop ecx
pop ecx
jne 0x40956d
cmp esi, 0xe
jne 0x409572
xor eax, eax
inc eax
jmp 0x409593
cmp dword [ebp + 0xc], 0
je 0x40958a
push edi
push str.Downloaded_File__s_is_corrupt.
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x4095f8
Capabilities:
Get geographical location

Disassembly:
push edi
xor edi, edi
push edi
call fcn.0040e8e3
cmp dword [0x428234], edi
pop ecx
je 0x40964b
push esi
mov esi, 0x427e0c
push esi
push 0x427bf8
call fcn.0040d1ec
push esi
push str.Country
push edi
call fcn.0040e4c3
push 0x427df8
push str.Method
push edi
call fcn.0040e4c3
push 0x427cf8
push str.PostStatusUrl
push edi
call fcn.0040e4c3
add esp, 0x2c
pop esi
pop edi
ret

Function at 0x40964d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004103f7
add esp, 0xc
test eax, eax
je 0x40966a
xor eax, eax
inc eax
pop ebp
ret
cmp dword [ebp + 0x14], 0
je 0x409680
push str.Uncompression_of_downloaded_file_failed.
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
xor eax, eax
pop ebp
ret
Function at 0x4098e1
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00411570
push edi
xor eax, eax
mov edx, 0xff
mov byte [ebp - 0x1000], 0
mov ecx, edx
lea edi, [ebp - 0xfff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xc00], 0
mov ecx, edx
lea edi, [ebp - 0xbff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x400], 0
mov ecx, edx
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x800], 0
mov ecx, edx
lea edi, [ebp - 0x7ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1000]
push 0x400
push eax
call fcn.004102a1
test eax, eax
pop ecx
pop ecx
jne 0x40996b
or eax, 0xffffffff
jmp 0x4099f6
lea eax, [ebp - 0xc00]
push esi
push eax
call fcn.004106c9
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x400]
push str._sSunJavajre1.6.0_10_
push eax
call esi
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x800]
push str._sSunJavajre1.6.0_10.tmpsv_
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileA]
add esp, 0x1c
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x400]
push eax
call esi
test eax, eax
jne 0x4099ca
or eax, 0xffffffff
jmp 0x4099f5
lea eax, [ebp - 0x1000]
push str.__x_26A24AE4_039D_4CA4_87B4_2F83216010FF__qb
push eax
call fcn.0040fd63
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test eax, eax
je 0x4099c5
mov eax, edi
pop esi
pop edi
leave
ret

Function at 0x40a1c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [0x4283a4]
push 0xf0
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x40a27e
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x40a27e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x40a27e
push edi
call dword [0x426060]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ax, word [esi]
test ax, ax
je 0x40a27d
inc esi
inc esi
mov cx, word [esi]
inc esi
inc esi
mov edx, dword [esi]
add esi, 4
cmp cx, 0x403
mov dword [ebp + 8], edx
jne 0x40a242
push esi
push 0
push 0x143
jmp 0x40a262
cmp cx, 0x1234
jne 0x40a274
or dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x28]
push ecx
push 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], esi
push 0x401
movzx eax, ax
push eax
push dword [ebx + 4]
call edi
cmp eax, 0xffffffff
jne 0x40a274
and dword [ebp - 4], 0
add esi, dword [ebp + 8]
cmp dword [ebp - 4], 0
jne 0x40a21a
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x40aad6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41e325
call fcn.00411ea8
sub esp, 0x418
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x426060]
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x424], ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], 1
je 0x40ab7f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edi, [eax + eax + 2]
cmp edi, 0x400
jg 0x40ab48
push edi
call fcn.0040730d
test al, al
pop ecx
je 0x40ab48
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.00411570
mov dword [ebp - 0x10], esp
mov esi, esp
jmp 0x40ab5e
lea eax, [edi + 8]
push eax
call fcn.004122c7
cmp eax, ebx
pop ecx
je 0x40ab7f
mov dword [eax], ebx
mov dword [ebp - 0x18], eax
lea esi, [eax + 8]
cmp esi, ebx
je 0x40ab7f
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x40ab81
xor eax, eax
cmp eax, ebx
jne 0x40aba8
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40ab9e
lea ecx, [ebp - 0x424]
call fcn.0040acbc
mov esi, 0x8007000e
jmp 0x40ac9b
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x14], edi
jne 0x40abc7
call fcn.00403722
mov esi, eax
jmp 0x40ac82
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x40abe9
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x40abf3
call fcn.00403722
jmp 0x40ac77
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, 0x400
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
jbe 0x40ac22
push eax
lea ecx, [ebp - 0x424]
call fcn.0040bcd2
jmp 0x40ac35
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x40ac35
cmp dword [ebp - 0x424], ebx
mov dword [ebp - 4], 1
jne 0x40ac4b
mov esi, 0x8007000e
jmp 0x40ac79
push esi
push dword [ebp + 0x10]
push dword [ebp - 0x424]
call fcn.00411ed0
mov eax, dword [ebp - 0x424]
add esp, 0xc
push dword [ebp + 0x14]
mov byte [esi + eax], bl
push dword [ebp - 0x424]
lea ecx, [ebp - 0x20]
call fcn.0040acc5
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40ac9b
lea ecx, [ebp - 0x424]
call fcn.0040acbc
lea ecx, [ebp - 0x18]
call fcn.00407366
mov eax, esi
lea esp, [ebp - 0x430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40b7a8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00409004
cmp eax, esi
jne 0x40b820
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40b7e9
lea eax, [ebp - 0x110]
push eax
call fcn.0040b7a8
cmp eax, esi
jne 0x40b81f
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x40b7d9
call fcn.00408fed
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00408fed
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x40bbde
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40bbe9
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x40d6e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push esi
push edi
call dword [0x426060]
mov edi, eax
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d7b9
mov byte [ebp - 0x40c], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.TransferJobID
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jbe 0x40d7b9
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0x40c]
push eax
call esi
test eax, eax
je 0x40d7b9
lea eax, [ebp - 0x40c]
push eax
call esi
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.00411570
mov eax, esp
push edi
push esi
lea ecx, [ebp - 0x40c]
push ecx
push eax
call fcn.00408f88
push dword [ebp + 8]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x4218dc
push dword [ebp + 8]
call fcn.0040cf83
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0x80004005
jmp 0x40d7be
mov eax, 0x80004005
lea esp, [ebp - 0x414]
pop edi
pop esi
leave
ret

Function at 0x40d7c8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call dword [0x426060]
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d82d
push 0x4218dc
push dword [ebp + 8]
call fcn.0040cf83
test eax, eax
pop ecx
pop ecx
je 0x40d831
push str.TransferJobID
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40d824
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40d8ae
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
mov dword [ebp - 0xc], eax
jl 0x40d893
mov edi, dword [ebp - 4]
test edi, edi
jne 0x40d854
xor eax, eax
jmp 0x40d877
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.00411570
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.0040cf9b
push 4
push eax
push 1
push 0
push str.TransferJobID
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40d893
and dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x40d8a2
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d8b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
xor ebx, ebx
test eax, eax
push esi
jne 0x40d8eb
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 4], ebx
je 0x40d8ee
inc ebx
jmp 0x40d8ee
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push dword [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test ebx, ebx
je 0x40d91a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40d9a6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
and dword [ebp + 0x74], 0
push 0x94
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00410ef0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40da33
cmp dword [ebp - 0x1c], 6
je 0x40da2e
cmp dword [ebp - 0x1c], 5
jne 0x40da33
cmp dword [ebp - 0x18], 1
jae 0x40da2e
lea eax, [ebp - 0xc]
push eax
call fcn.00412890
test eax, eax
pop ecx
jbe 0x40da22
lea eax, [ebp - 0xc]
push eax
call fcn.00412890
test eax, eax
pop ecx
jbe 0x40da22
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0xc]
push str.Service_Pack__d
push eax
call fcn.00412bd5
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x40da33
cmp dword [ebp + 0x74], 2
jb 0x40da33
xor eax, eax
inc eax
jmp 0x40da35
xor eax, eax
add ebp, 0x78
leave
ret

Function at 0x40da3a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push 0x94
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00410ef0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x40da88
cmp dword [ebp - 0x18], 6
jne 0x40da7a
xor eax, eax
inc eax
jmp 0x40da8a
cmp dword [ebp - 0x18], 5
jne 0x40da88
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
je 0x40da8a
xor eax, eax
add ebp, 0x78
leave
ret
Function at 0x40da8f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40dab6
xor eax, eax
leave
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.LocalFileName
push dword [ebp - 4]
call esi
push str.InstallOptions
push dword [ebp - 4]
call esi
push str.UpdateDescription
push dword [ebp - 4]
call esi
push str.UpdateTitle1
push dword [ebp - 4]
call esi
push str.UpdateTitle2
push dword [ebp - 4]
call esi
push str.UpdateMoreInfoUrl
push dword [ebp - 4]
call esi
push str.BalloonTitle
push dword [ebp - 4]
call esi
push str.BalloonTip
push dword [ebp - 4]
call esi
push str.DlgCaption
push dword [ebp - 4]
call esi
push str.MoreInfoTxt
push dword [ebp - 4]
call esi
push str.PreDownld
push dword [ebp - 4]
call esi
push str.UrlInfo
push dword [ebp - 4]
call esi
push str.NumTries
push dword [ebp - 4]
call esi
call fcn.0040da3a
test eax, eax
je 0x40db52
push str.TransferJobID
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x40df32
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
call fcn.004113d5
lea eax, [ebp - 8]
push eax
call fcn.00412d14
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x41f682
push eax
call fcn.004116a0
xor edi, edi
add esp, 0x10
cmp esi, edi
je 0x40df8c
push esi
call fcn.00412c09
cmp eax, edi
pop ecx
je 0x40df8c
push eax
lea eax, [ebp - 0x20c]
push str._n_s::
push eax
call fcn.0041136c
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x10c]
push eax
push str.TMPDIR
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
test eax, eax
lea eax, [ebp - 0x10c]
jne 0x40dfbe
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x40dfc6
push 0x420388
push eax
call esi
push str.jusched.log
lea eax, [ebp - 0x10c]
push eax
call esi
push edi
push 0x80
push 4
push edi
push 2
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e041
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e046
Capabilities:
Check os version

Disassembly:
push 0xa4
push 0x420e00
call fcn.00410f50
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], 0x94
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0xb0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x40e0c8
cmp dword [ebp - 0xb0], 5
jb 0x40e0c8
mov dword [ebp - 4], esi
push str.Crypt32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x40e0bf
push str.CryptProtectData
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40e0bf
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.0040e0d1
mov eax, dword [ebp - 0x20]
call fcn.00410f8b
ret

Function at 0x40e189
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e1c0
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x40e1c2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocStringLen
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x64
mov dword [ebp - 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e261
call fcn.0040e046
test eax, eax
je 0x40e228
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040e0e1
add esp, 0x10
jmp 0x40e23d
push 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00411ed0
add esp, 0xc
push dword [ebp - 0xc]
lea eax, [ebp - 0x210]
push eax
push 3
push esi
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x40e29b
Capabilities:
Get common file path
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
push ebx
push esi
push 0x3c
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x3c]
push ebx
push eax
mov byte [ebp - 0x240], bl
call fcn.00410ef0
lea eax, [ebp - 0x640]
add esp, 0xc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp eax, ebx
je 0x40e322
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
lea eax, [ebp - 0x640]
push ebx
push eax
call fcn.0041273a
lea eax, [ebp - 0x140]
push 0x420b68
push eax
call fcn.004114e0
add esp, 0x1c
test eax, eax
je 0x40e342
push 1
push dword [ebp + 8]
call fcn.0040e264
push eax
lea eax, [ebp - 0x140]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push dword [ebp + 0xc]
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 0x240]
push eax
push dword [ebp + 0xc]
call esi
pop esi
pop ebx
leave
ret
Function at 0x40e4c3
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x40e517
cmp ebx, edi
lea eax, [ebp - 4]
jne 0x40e4ff
push eax
push 0x2001f
push edi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40e509
push 1
push eax
call fcn.0040e372
pop ecx
pop ecx
cmp dword [ebp - 4], edi
je 0x40e55e
mov dword [ebp - 8], 1
jmp 0x40e51a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
je 0x40e550
cmp ebx, edi
jne 0x40e531
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40e549
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
push ebx
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 8], edi
je 0x40e55e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40e565
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x114
push ebx
push esi
mov esi, 0x20019
push esi
xor ebx, ebx
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
call fcn.00409004
test eax, eax
je 0x40e5a6
xor esi, esi
jmp 0x40e688
push esi
push str.JavaSoft
push dword [ebp + 0x68]
lea ecx, [ebp + 0x6c]
call fcn.00409004
test eax, eax
jne 0x40e59f
push esi
push str.Java_Runtime_Environment
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x70]
call fcn.00409004
test eax, eax
jne 0x40e59f
push edi
lea eax, [ebp - 0xa0]
push 0x41f682
push eax
call fcn.004116a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
pop ecx
pop ecx
mov edi, 0x80
push edi
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 0x70]
call esi
test eax, eax
jne 0x40e684
inc dword [ebp + 0x60]
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jle 0x40e656
lea eax, [ebp - 0x20]
push str.1.6.0_10
push eax
call fcn.00412ed0
test eax, eax
pop ecx
pop ecx
je 0x40e656
lea eax, [ebp - 0x20]
push eax
call fcn.00412890
cmp eax, 3
pop ecx
jbe 0x40e656
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004116a0
pop ecx
pop ecx
mov dword [ebp + 0x64], 1
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x70]
call esi
test eax, eax
je 0x40e602
cmp dword [ebp + 0x64], ebx
je 0x40e684
lea eax, [ebp - 0xa0]
push eax
push 0x420358
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov esi, dword [ebp + 0x64]
pop edi
lea ecx, [ebp + 0x70]
call fcn.00408fed
lea ecx, [ebp + 0x6c]
call fcn.00408fed
lea ecx, [ebp + 0x68]
call fcn.00408fed
mov eax, esi
pop esi
pop ebx
add ebp, 0x74
leave
ret