joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409cd1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0040990f
mov edi, eax
pop ecx
test edi, edi
js 0x409d16
push 0x434f3c
push dword [ebp + 8]
call fcn.00410de2
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x409d16
lea eax, [edi + 2]
push eax
call fcn.0040f174
mov esi, eax
pop ecx
push ebx
test esi, esi
jne 0x409d23
call fcn.00410bf7
pop ecx
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push edi
push 1
push esi
call fcn.00412812
mov ebx, eax
add esp, 0x10
cmp ebx, edi
jle 0x409d44
push 9
call fcn.00409558
push eax
call fcn.00407bc2
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00410bf7
pop ecx
cmp ebx, edi
je 0x409d59
push esi
call fcn.0040ef0b
jmp 0x409d15
xor ecx, ecx
xor eax, eax
cmp eax, ebx
jge 0x409d6e
cmp byte [eax + esi], 0
jne 0x409d68
inc ecx
inc eax
cmp eax, 6
jl 0x409d5d
cmp ecx, 1
jle 0x409d82
mov edi, dword [ebp + 0xc]
lea eax, [ebx + esi]
mov dword [edi], esi
mov word [eax], 0
jmp 0x409d99
mov byte [ebx + esi], 0
mov ebx, esi
call fcn.0040999a
mov edi, dword [ebp + 0xc]
push esi
mov dword [edi], eax
call fcn.0040ef0b
pop ecx
mov eax, dword [edi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409d9e
sub eax, edx
sar eax, 1
jmp 0x409d1e

Function at 0x40a597
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a600
cmp dword [ebp + 0x10], 1
je 0x40a5d8
cmp dword [ebp + 0x10], 2
je 0x40a5d8
push 0xd
pop eax
jmp 0x40a600
mov eax, dword [ebp - 4]
test edi, edi
je 0x40a5fa
test eax, eax
je 0x40a5f5
test al, 1
jne 0x40a5d3
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40a5fa
jmp 0x40a5d3
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x40a8ad
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x94], eax
cmp dword [0x44c600], 0
je 0x40a8d8
mov eax, dword [0x44c5fc]
jmp 0x40a91c
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0040ee70
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x70], 2
jne 0x40a90f
cmp dword [ebp - 0x7c], 6
jb 0x40a90f
mov eax, ecx
jmp 0x40a911
xor eax, eax
mov dword [0x44c5fc], eax
mov dword [0x44c600], ecx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0040e71b
add ebp, 0x98
leave
ret
Function at 0x40aa68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0040ee70
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40aafe
cmp eax, edi
ja 0x40aafe
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0040ee70
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x429c08
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x40ab00
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
leave
ret

Function at 0x40ab0f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x40ab1c
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret

Function at 0x40ab78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040ee70
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
add esp, 0xc
mov word [ebp - 0x28], ax
lea eax, [ebp - 4]
xor edi, edi
push eax
inc edi
push 0x2000000
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40abf1
cmp dword [ebp + 8], esi
je 0x40abf1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x8000008
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, esi
jne 0x40abf5
xor eax, eax
jmp 0x40ac13
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x40ae22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf8c]
mov eax, 0x100c
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0xf88], eax
push esi
mov esi, dword [ebp + 0xf9c]
push edi
mov edi, dword [ebp + 0xf94]
xor eax, eax
push 0x7fe
push eax
mov word [ebp + 0x788], ax
lea eax, [ebp + 0x78a]
push eax
call fcn.0040ee70
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
lea eax, [ebp + 0x788]
push 0x400
push eax
call fcn.0040fe2a
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x788]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
pop esi
test eax, eax
je 0x40aeb7
xor ecx, ecx
cmp eax, 2
sete cl
jmp 0x40af26
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x429eec
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 0x7c]
test eax, eax
je 0x40aee5
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40af28
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xf98]
lea ecx, [ebp - 0x78]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40af1a
test dx, dx
je 0x40af16
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40af1a
add eax, 4
add ecx, 4
test dx, dx
jne 0x40aef4
xor eax, eax
jmp 0x40af1f
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp + 0xf88]
xor ecx, ebp
call fcn.0040e71b
add ebp, 0xf8c
leave
ret

Function at 0x40b12f
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x40b150
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x42a004
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40b150
inc esi
mov eax, esi
pop esi
ret
Function at 0x40b23c
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x428040
call fcn.00412ff1
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x42a460
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x40b2b0
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.0040cb83
pop ecx
pop ecx
push edi
push esi
call fcn.00427de0
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.0040c800
push eax
push esi
push 0x4295f4
call fcn.0040cb83
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x40b2a9
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x40b361
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x40b30d
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x40b274
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x40b361
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x40b361
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x40b274
mov eax, esi
call fcn.00413027
ret

Function at 0x40c3a9
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x42810b
call fcn.00412fbe
push 0x42a09c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040f6db
add esp, 0xc
test eax, eax
jne 0x40c484
push dword [ebp - 0x18]
call fcn.0040ef0b
cmp dword [0x44c5e0], 0
pop ecx
je 0x40c404
xor eax, eax
inc eax
jmp 0x40c486
lea eax, [ebp]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x40c484
test eax, eax
je 0x40c484
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c6c8
and dword [ebp - 4], 0
push str.JavaDeployReg.log
lea ecx, [ebp - 0x14]
call fcn.0040c6c8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040c8e1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40c455
call fcn.0040c8a3
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x40c460
mov eax, dword [esi]
jmp 0x40c462
xor eax, eax
push 0x42a148
push eax
push 0x44c5e0
call fcn.00410df9
add esp, 0xc
test eax, eax
je 0x40c4a9
test esi, esi
je 0x40c484
mov ecx, esi
call fcn.0040c8a3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040e71b
add ebp, 0x20c
leave
ret
test esi, esi
je 0x40c3fc
mov ecx, esi
call fcn.0040c8a3
jmp 0x40c3fc
Function at 0x40c5fd
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.0040a510
mov ebx, eax
cmp ebx, esi
je 0x40c670
lea ecx, [ebp - 0x74]
call fcn.0040a4f5
mov eax, ebx
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
add ebp, 0x1a0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40c688
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040c5fd
cmp eax, esi
jne 0x40c6ba
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x40c678
lea ecx, [ebp - 0x74]
call fcn.0040a4f5
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0040a486
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.0040a4f5
mov eax, esi
jmp 0x40c656
Function at 0x40c9c2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x7fe
push esi
push eax
mov word [ebp - 0x1044], ax
lea eax, [ebp - 0x1042]
push eax
call fcn.0040ee70
push ebx
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x1044]
push 0x400
push eax
call fcn.00414227
add esp, 0x20
test eax, eax
jns 0x40ca23
xor eax, eax
mov word [ebp - 0x846], ax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
call fcn.0040ee70
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.0040c944
push 0x42a404
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.004130b0
xor eax, eax
push esi
push eax
mov word [ebp - 0x844], ax
lea eax, [ebp - 0x842]
push eax
call fcn.0040ee70
add esp, 0x2c
mov eax, edi
push 2
lea edx, [eax + 2]
pop ebx
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x40ca72
sub eax, edx
sar eax, 1
cmp eax, 6
jbe 0x40cac2
mov ecx, 0x42a408
lea eax, [edi + eax*2 - 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cab4
test dx, dx
je 0x40cab0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cab4
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ca8e
xor eax, eax
jmp 0x40cab9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40cac2
xor esi, esi
inc esi
jmp 0x40cac4
xor esi, esi
lea eax, [ebp - 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x40caca
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, str.Error:
test esi, esi
jne 0x40cae8
mov eax, 0x42a428
lea ecx, [ebp - 0x1044]
push ecx
push eax
lea esi, [edi + edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, edi
push 0xffffffffffffffff
push eax
lea eax, [ebp + esi - 0x844]
push eax
call fcn.0040fe48
add esp, 0x20
test eax, eax
jns 0x40cb39
xor eax, eax
movzx ecx, word [eax + 0x42a454]
mov word [ebp + eax - 0x4e], cx
add eax, ebx
test cx, cx
jne 0x40cb26
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.0040f210
lea edi, [ebp - 0x844]
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x40cb56
lea eax, [ebp - 0x844]
mov esi, 0x42a45c
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
leave
ret

Function at 0x40cbe1
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.http:__java.com_inst_dl_redirect
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x40cbf9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3f9c]
mov eax, 0x401c
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x3f98], eax
mov eax, dword [ebp + 0x3fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor esi, esi
xor eax, eax
mov ebx, 0xffe
mov dword [ebp - 0x78], esi
push ebx
mov word [ebp + 0x2f98], ax
lea eax, [ebp + 0x2f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.0040ee70
xor eax, eax
push ebx
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.0040ee70
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push 0x20019
push esi
push 0x42a620
mov edi, 0x800
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cd62
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2f98]
push eax
push esi
jmp 0x40cd51
lea eax, [ebp + 0x2f98]
push eax
push 0x42a678
push 0x42a614
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.0040fe2a
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cd39
push ebx
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.0040ee70
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push 0x42a6d0
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cd39
cmp dword [ebp - 0x6c], esi
jbe 0x40cd39
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push 0x42a6e8
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40cc9b
mov ecx, dword [ebp - 0x74]
lea eax, [ebp + 0x1f98]
push eax
call fcn.0040c6c8
mov ecx, dword [ebp + 0x3f98]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e71b
add ebp, 0x3f9c
leave
ret
Function at 0x40d503
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2f9c]
mov eax, 0x301c
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp + 0x2f98], eax
mov eax, dword [ebp + 0x2fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor eax, eax
mov edi, 0xffe
xor esi, esi
push edi
mov word [ebp + 0x1f98], ax
lea eax, [ebp + 0x1f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.0040ee70
xor eax, eax
push edi
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.0040ee70
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
push 0x42ab78
mov ebx, 0x800
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d66b
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
jmp 0x40d65a
lea eax, [ebp + 0x1f98]
push eax
push 0x42abd0
push 0x42ab6c
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.0040fe2a
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d642
push edi
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.0040ee70
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push str.RuntimeLib
push dword [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d642
cmp dword [ebp - 0x6c], esi
jbe 0x40d642
mov eax, dword [ebp + 0x2fa8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push esi
push 0x42ac40
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40d5a2
mov eax, dword [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40d671
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp + 0x2f98]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0040e71b
add ebp, 0x2f9c
leave
ret
Function at 0x40d6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 8], esi
call fcn.0040f661
pop ecx
test eax, eax
je 0x40d6d3
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00412965
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x40d721
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x43623c]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d6f7
xor eax, eax
jmp 0x40d721
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40d716
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x40d863
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040d724
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [ebp - 4]
push eax
push 0x20006
push edi
push dword [0x43623c]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d8a5
xor eax, eax
pop edi
pop esi
leave
ret
push esi
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40d8c9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40d8a1
xor edi, edi
inc edi
jmp 0x40d8bc
Function at 0x40db08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040ee40
mov eax, dword [0x436248]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x400
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x40db77
push str.DeploymentRuleSet.jar
lea eax, [ebp - 0x804]
push eax
push str._sSunJavaDeployment_s
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040de61
add esp, 0x14
test eax, eax
jle 0x40db77
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40db77
test al, 0x10
jne 0x40db77
xor eax, eax
inc eax
jmp 0x40db79
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040e71b
leave
ret

Function at 0x40e71b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436248]
jne 0x40e725
repz ret
jmp fcn.00414e92

Function at 0x41d2da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41d301
call fcn.00411077
mov dword [eax], esi
call fcn.00411064
push 0x16
pop esi
mov dword [eax], esi
call fcn.00414e82
mov eax, esi
jmp 0x41d356
test dword [ebp + 0xc], 0xfffffff9
jne 0x41d2e7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41d32e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041108a
pop ecx
call fcn.00411064
mov eax, dword [eax]
jmp 0x41d356
test al, 0x10
jne 0x41d354
test al, 1
je 0x41d354
test byte [ebp + 0xc], 2
je 0x41d354
call fcn.00411077
mov dword [eax], 5
call fcn.00411064
mov dword [eax], 0xd
jmp 0x41d325
xor eax, eax
pop esi
pop ebp
ret