joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40779c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x407901
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405eec
cmp si, word [0x4279f8]
jb 0x407834
cmp si, word [0x427bf8]
ja 0x407834
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x407834
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4279f8]
jae 0x40780e
mov edi, ebx
dec edi
jmp 0x40782f
cmp si, word [ebx*8 + 0x4279f8]
jbe 0x40781e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40782f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4279fc]
call fcn.004076ac
jmp 0x407834
cmp edi, dword [ebp - 8]
jae 0x4077f8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4078e3
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4078e3
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004067dc
push dword [ebp - 0x160]
push 0x40791c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004067dc
push dword [ebp - 0x164]
push 0x40792c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004067dc
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004069a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407908
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00405f4c
ret
Function at 0x407ab4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407bb7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x42bb78
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x42bb90]
jne 0x407b00
mov eax, esi
mov edx, 0x42bb92
mov ecx, 0x55
call fcn.004067dc
push 0x42bb78
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x407ba1
push 0x42bb78
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00405eec
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x407b6f
cmp byte [0x42bb74], 0
je 0x407b34
mov edx, esi
mov eax, ebx
call fcn.00407998
jmp 0x407b6f
mov edx, esi
mov eax, ebx
call fcn.0040779c
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x407b6f
cmp dword [esi], 0
je 0x407b58
mov eax, esi
mov edx, 0x407bd0
call fcn.004068c8
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040779c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004068c8
push 0x42bb78
call sub.kernel32.dll_EnterCriticalSection
mov word [0x42bb90], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406748
push eax
push 0x42bb92
call sub.kernel32.dll_lstrcpynW
push 0x42bb78
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407bbe
lea eax, [ebp - 4]
call fcn.00405eec
ret
Function at 0x407dec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405fd0
xor eax, eax
push ebp
push 0x408011
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x407e2c
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x407e46
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406748
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x407ffb
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408020
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407f15
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408020
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407f15
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40805c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407f15
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40805c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407f15
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408090
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407f15
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4080c4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x407ffb
xor eax, eax
push ebp
push 0x407ff4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00407bf8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x407f84
mov eax, dword [ebp - 0x10]
call fcn.00404144
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004067a0
jmp 0x407fcf
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408104
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x407fcf
mov eax, dword [ebp - 0x10]
call fcn.00404144
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408104
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004067a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407ffb
cmp dword [ebp - 8], 0
je 0x407fea
mov eax, dword [ebp - 8]
call fcn.00404160
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408018
lea eax, [ebp - 4]
call fcn.00405eec
ret
Function at 0x4082f8
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405fd0
xor eax, eax
push ebp
push 0x4083b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004067dc
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00406920
mov eax, dword [ebx]
call fcn.004081c0
test al, al
jne 0x408395
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004067dc
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00406920
mov eax, dword [ebx]
call fcn.004081c0
test al, al
jne 0x408395
mov eax, ebx
call fcn.00405eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4083bf
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405f4c
lea eax, [ebp - 4]
call fcn.00405eec
ret

Function at 0x408a48
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x419708
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x419741
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406044
jmp 0x41974a
mov eax, ebx
mov edx, esi
call fcn.0040629c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419754
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x419776
movzx eax, word [esp]
jmp 0x419778
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41a44c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41a571
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041a254
mov esi, eax
mov eax, dword [0x4288bc]
cmp byte [eax], 0
je 0x41a519
mov eax, dword [0x4287b8]
call fcn.00404474
call fcn.00404298
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41a41c]
call fcn.00407228
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41a58c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41a555
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x42878c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42bc40]
call fcn.004072e0
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a578
lea eax, [ebp - 4]
mov edx, dword [0x41a41c]
call fcn.00407234
ret

Function at 0x41bdd8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040638c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408a28
mov edi, eax
cmp edi, 0x104
jbe 0x41bd83
mov eax, edi
add eax, eax
call fcn.00404144
mov esi, eax
jmp 0x41bd85
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408a28
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41bdbe
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41bda8
mov eax, esp
cmp esi, eax
je 0x41bdcb
mov eax, esi
call fcn.00404160
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41be04
cmp bl, 0
je 0x41be00
cmp bl, 0x41
jl 0x41bdfb
cmp bl, 0x5a
jg 0x41bdfb
or bl, 0x20
xor al, bl
inc esi
jmp 0x41bddf
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41bd44

Function at 0x41bff8
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.004067dc
add esp, 0x800
pop ebx
ret
Function at 0x404ba4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b0]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x6c], bl
mov dword [esi], ebx
call fcn.0043475f
mov dword [esi], eax
cmp eax, ebx
jne 0x404bf9
push str.ERROR:_ShutdownEvent_handle_is_NULL
call fcn.004154d3
pop ecx
mov dword [ebp - 0x60], 0xfffffffe
push ebx
push dword [ebp - 0x64]
call fcn.0043475f
pop ecx
pop ecx
test eax, eax
jne 0x404c1b
push str.jusched_ERROR:_Could_not_open_Policy_key_for_reading
call fcn.004154d3
mov dword [ebp - 0x60], 0xfffffffd
jmp 0x404c3e
mov eax, dword [ebp - 0x64]
push dword [eax]
call fcn.00404b27
pop ecx
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x404c3f
push str.jusched_main:_ERROR_creating_registry_watch_event_notifier
call fcn.004154d3
mov dword [ebp - 0x60], 0xfffffffe
pop ecx
push str.SunJavaUpdateSchedulerMutex
push 1
push ebx
mov dword [edi], ebx
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov dword [edi], eax
cmp eax, ebx
jne 0x404caf
call dword [sym.imp.kernel32.dll_GetLastError]
push 0x7ff
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.004360a0
add esp, 0xc
cmp dword [ebp - 0x60], 0xb7
lea eax, [ebp - 0x5c]
jne 0x404c8f
push str.Error:_Scheduler_Mutex_already_exists_n
push eax
call dword [sym.imp.user32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0x404ca1
push dword [ebp - 0x60]
push str.Error:_Error_creating_scheduler_mutex:__d_n
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call fcn.004154d3
or dword [ebp - 0x60], 0xffffffff
pop ecx
cmp dword [ebp - 0x60], ebx
je 0x404cce
push dword [edi]
push esi
call fcn.00404b76
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
pop ecx
pop ecx
lea esi, [ebp - 0x80]
mov dword [ebp - 0x7c], eax
call fcn.00412716
mov ecx, dword [ebp + 0x7a4]
mov eax, dword [ebp - 0x60]
pop esi
xor ecx, ebp
pop ebx
call fcn.00434c4e
add ebp, 0x7a8
leave
ret
Function at 0x406630
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
mov esi, dword [ebp + 0xb4]
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateEventA]
xor ebx, ebx
push ebx
push ebx
mov dword [esi + 0xc], 0xbc2
mov eax, dword [0x473f84]
push 1
push ebx
mov dword [esi + 0x18], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x20], eax
call edi
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x38], eax
call fcn.0043475f
mov dword [esi + 0x3c], eax
xor eax, eax
mov byte [ebp - 0x7c], bl
lea edi, [ebp - 0x7b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x68], ebx
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.SunJavaUpdateRecheckUpdateEvent
lea eax, [ebp - 0x7c]
push ebx
mov dword [ebp - 0x64], eax
push ebx
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0xc
call dword [sym.imp.kernel32.dll_CreateEventA]
push dword [esi + 0x20]
mov edi, dword [sym.imp.kernel32.dll_ResetEvent]
mov dword [esi + 0x40], eax
call edi
push dword [esi + 0x24]
call edi
push dword [esi + 0x38]
call edi
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push 0x406c05
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, ebx
je 0x406718
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esi + 0x20]
call edi
mov edi, dword [sym.imp.user32.dll_LoadStringA]
mov ebx, 0x104
push ebx
lea eax, [esi + 0x58]
push eax
push 0x7b
push dword [esi + 0x18]
call edi
push ebx
lea eax, [ebp - 0x5c]
push eax
push 0x7c
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jle 0x40676a
lea eax, [ebp - 0x5c]
push eax
add esi, 0x15c
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00434c4e
add ebp, 0xac
leave
ret 4
Function at 0x40c984
Capabilities:
Delete registry key

Disassembly:
push 0x38
mov eax, 0x451566
call fcn.0043c771
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x40], MsiConfigureFeatureFromDescriptorA
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x2c], bl
cmp eax, ebx
jne 0x40c9f0
cmp dword [ebp + 0x10], ebx
jne 0x40c9cd
push 0x2001f
push str.SOFTWAREJavaSoftJava_UpdatePolicyjucheck
lea eax, [ebp - 0x40]
call fcn.004126df
mov eax, dword [ebp - 0x38]
mov dword [ebp + 8], eax
jmp 0x40c9e2
push str.SetJavaUpdateStringKey_was_called_with_a_NULL_value_for_the_key__so_defaulting_to_trying_jucheck_key
call fcn.004154d3
pop ecx
lea eax, [ebp + 8]
push eax
call fcn.0043475f
pop ecx
cmp dword [ebp + 8], ebx
je 0x40c9f3
mov dword [ebp - 0x10], 1
jmp 0x40c9f3
mov dword [ebp + 8], eax
xor esi, esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.0040d4f9
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x10], ebx
je 0x40ca24
push dword [ebp + 0x10]
lea ebx, [ebp - 0x24]
call fcn.0043475f
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40ca71
cmp dword [ebp + 0x10], ebx
jne 0x40ca3c
push dword [ebp + 0xc]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40ca6a
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 1
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call fcn.0043475f
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x24]
call fcn.004127b9
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp - 0x10], ebx
je 0x40ca7e
lea esi, [ebp - 0x40]
call fcn.00412716
lea esi, [ebp - 0x20]
call fcn.0042595c
mov eax, edi
call fcn.0043c849
ret
Function at 0x40d2db
Capabilities:
Get common file path
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x5cc]
sub esp, 0x64c
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0x5c8], eax
mov eax, dword [ebp + 0x5d4]
push ebx
push esi
push edi
push 0x3c
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x80]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x3c4], bl
call fcn.004360a0
lea eax, [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x50], 0x400
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
mov edi, 0x104
cmp eax, ebx
je 0x40d383
push pe_nt_image_headers32
lea eax, [ebp + 0x3c4]
push eax
push edi
lea eax, [ebp + 0x4c4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0043475f
lea eax, [ebp + 0x4c4]
push 0x45ed3c
push eax
call fcn.00435be0
add esp, 0x2c
test eax, eax
je 0x40d3cc
mov eax, esi
mov dword [ebp - 0x40], ebx
cmp byte [esi], bl
je 0x40d3b4
mov cl, byte [eax]
cmp cl, 0x20
je 0x40d398
cmp cl, 9
jne 0x40d3a1
push eax
call dword [sym.imp.user32.dll_CharNextA]
jmp 0x40d38c
mov ecx, dword [ebp - 0x40]
movsx edx, byte [eax]
imul ecx, ecx, 0x1f
add ecx, edx
inc eax
mov dword [ebp - 0x40], ecx
cmp byte [eax], bl
jne 0x40d38c
push dword [ebp - 0x40]
lea eax, [ebp + 0x4c4]
push str.jupdate__x
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
push dword [ebp - 0x44]
push edi
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
lea eax, [ebp + 0x4c4]
push eax
push dword [ebp - 0x44]
call esi
lea eax, [ebp + 0x3c4]
push eax
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp + 0x5c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434c4e
add ebp, 0x5cc
leave
ret
Function at 0x410b07
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push esi
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000002
mov dword [ebp - 0x78], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410be9
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.TransferJobID
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x78], 0
jbe 0x410be9
mov esi, dword [sym.imp.kernel32.dll_lstrlenA]
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
je 0x410be9
lea eax, [ebp - 0x70]
push eax
call esi
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x410ba7
xor eax, eax
jmp 0x410bbd
lea eax, [edi + edi]
call fcn.00449670
mov esi, esp
push 3
push edi
lea eax, [ebp - 0x70]
push eax
call fcn.00401098
push dword [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x10
push 0x457598
push dword [ebp - 0x74]
call fcn.0043475f
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x410bee
mov eax, 0x80004005
lea esp, [ebp - 0x88]
pop edi
pop esi
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
call fcn.00434c4e
add ebp, 0x394
leave
ret

Function at 0x4120fa
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x44fe01
call fcn.0043c7da
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
dec ecx
push 4
neg ecx
sbb ecx, ecx
mov esi, edx
pop edx
and ecx, 0xfffffffc
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
add ecx, edx
lea eax, [ebp - 0x54]
push eax
or ecx, 1
push ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], edx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x412187
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.0043475f
push eax
lea eax, [ebp - 0x4c]
push str.encryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.0043475f
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0043475f
push 0x466a80
mov eax, esi
push eax
call fcn.0043475f
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.0040d4f9
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.0043475f
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, edi
call fcn.0043c85d
ret