joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4237ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x493ee0]
jne 0x4237b5
repz ret
jmp fcn.00429b07

Function at 0x428199
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00421ee1
xor ebx, ebx
cmp dword [0x52fb10], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42826e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4281d9
xor eax, eax
jmp 0x428332
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4281d2
push eax
call fcn.00421e7e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x52fb10], eax
call esi
push eax
call fcn.00421e7e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x52fb14], eax
call esi
push eax
call fcn.00421e7e
mov dword [0x52fb18], eax
lea eax, [ebp - 8]
push eax
call fcn.0041f6ca
test eax, eax
pop ecx
pop ecx
je 0x42823c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041f4b0
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42826e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00421e7e
cmp eax, ebx
pop ecx
mov dword [0x52fb20], eax
je 0x42826e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00421e7e
pop ecx
mov dword [0x52fb1c], eax
mov eax, dword [0x52fb1c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4282e7
cmp dword [0x52fb20], esi
je 0x4282e7
push eax
call fcn.00421eea
pop ecx
call eax
cmp eax, ebx
je 0x4282b4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x52fb20]
call fcn.00421eea
pop ecx
call eax
test eax, eax
je 0x4282b4
test byte [ebp - 0x18], 1
jne 0x4282e7
lea eax, [ebp - 0xc]
push eax
call fcn.0041f779
test eax, eax
pop ecx
je 0x4282cf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041f4b0
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4282de
or dword [ebp + 0x10], 0x200000
jmp 0x428318
or dword [ebp + 0x10], 0x40000
jmp 0x428318
mov eax, dword [0x52fb14]
cmp eax, esi
je 0x428318
push eax
call fcn.00421eea
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x428318
mov eax, dword [0x52fb18]
cmp eax, esi
je 0x428318
push dword [ebp - 4]
push eax
call fcn.00421eea
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x52fb10]
call fcn.00421eea
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d38
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00403dde
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x403dcb
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 8], eax
test eax, eax
je 0x403dc4
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [ebx + 0xc], edx
test edx, edx
je 0x403dc4
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x403dc4
mov ecx, dword [ebp - 0x14]
mov al, 1
mov dword [ebx + 0x10], ecx
jmp 0x403dcd
mov ecx, ebx
call fcn.00403dde
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret 4

Function at 0x4040ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
push edi
cmp esi, 0x40
jb 0x404132
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x404132
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x404132
cmp dword [edx + ecx], 0x4550
jne 0x404132
movzx eax, word [edx + ecx + 4]
mov edi, 0x14c
cmp ax, di
je 0x404117
mov edi, 0x8664
cmp ax, di
je 0x404132
add ecx, 0x98
add ecx, edx
mov eax, dword [ecx]
test eax, eax
je 0x404132
add eax, 0xc
cmp esi, eax
sbb eax, eax
not eax
and eax, ecx
jmp 0x404134
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x404c11
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
push ecx
push 1
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404c8f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x404c8f
cmp dword [ebp - 8], 4
jne 0x404c8f
cmp dword [ebp - 0xc], 4
ja 0x404c8f
mov ecx, dword [ebp - 0x10]
mov dword [edi], ecx
mov byte [edi + 4], 1
jmp 0x404c92
mov byte [edi + 4], bl
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret
Function at 0x418680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4186ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4186ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44c940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3c000]
push edi
jmp 0x44c95a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44c961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c950
mov eax, 1
add ebx, ebx
jne 0x44c973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44c984
jne 0x44c9a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c9a3
dec eax
add ebx, ebx
jne 0x44c990
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44c968
add ebx, ebx
jne 0x44c99f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44c9f5
xor ecx, ecx
sub eax, 3
jb 0x44c9bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44ca2a
sar eax, 1
mov ebp, eax
jmp 0x44c9c6
add ebx, ebx
jne 0x44c9c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c994
inc ecx
add ebx, ebx
jne 0x44c9d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c994
add ebx, ebx
jne 0x44c9e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44c9d6
jne 0x44c9f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44c9d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44ca14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44ca06
jmp 0x44c956
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44ca14
add edi, ecx
jmp 0x44c956
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44ca32
cmp byte [edi], 0x12
jne 0x44ca32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44ca37
lea edi, [esi + 0x4a000]
mov eax, dword [edi]
or eax, eax
je 0x44caaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x73398]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x73478]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44ca64
mov ecx, edi
jns 0x44ca93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x73480]
or eax, eax
je 0x44caa9
mov dword [ebx], eax
add ebx, 4
jmp 0x44ca81
call dword [esi + 0x7347c]
mov ebp, dword [esi + 0x73484]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44cae3
sub esp, 0xffffff80
jmp 0x41942f
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x429580]
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x4295a0], eax
call fcn.0040922a
pop ecx
test eax, eax
je 0x401050
push str.Windows_original_main_args:_n
call fcn.004090f7
xor esi, esi
pop ecx
cmp dword [0x429574], esi
jle 0x401050
mov eax, dword [0x429578]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004090f7
add esp, 0xc
inc esi
cmp esi, dword [0x429574]
jl 0x401031
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.004011b4
call fcn.0040121c
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.004010e8
pop ecx
pop ecx
mov esi, eax
call fcn.00401222
xor edx, edx
test ebx, ebx
jle 0x40108a
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x40107f
and dword [esi + edx*4], 0
mov edi, dword [str.openjdk]
test edi, edi
jne 0x40109a
mov edi, dword [esi]
mov edx, dword [0x42800c]
test edx, edx
jne 0x4010a6
mov edx, dword [esi]
mov ecx, dword [0x429360]
test ecx, ecx
push 0
push 1
push 1
setne al
movzx eax, al
push eax
push edi
push edx
push 0x41e29c
push 0x41e2a0
push dword [0x429364]
push 1
push ecx
push 1
push esi
push ebx
call fcn.00401ccb
add esp, 0x38
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x403a8c
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [ebx]
add esi, eax
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esi*4 + 4]
push eax
mov ecx, dword [edi]
mov dword [esp + 0x24], ecx
call fcn.004010e8
mov ebp, eax
mov dword [ebx], esi
mov dword [edi], ebp
xor esi, esi
mov edi, dword [esp + 0x1c]
pop ecx
test edi, edi
jle 0x403af2
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x403aed
cmp byte [eax + 1], 0x4a
jne 0x403aed
add eax, 2
je 0x403ae7
push eax
call fcn.00401178
pop ecx
mov dword [ebp], eax
add ebp, 4
inc esi
cmp esi, edi
jl 0x403acd
mov ebx, dword [esp + 0x10]
xor eax, eax
test ebx, ebx
jle 0x403b25
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + eax*4]
cmp byte [ecx], 0x2d
jne 0x403b20
cmp byte [ecx + 1], 0x4a
jne 0x403b20
add ecx, 2
cmp byte [ecx], 0
je 0x403bd1
mov dword [ebp], ecx
add ebp, 4
inc eax
cmp eax, ebx
jl 0x403b00
xor esi, esi
test edi, edi
jle 0x403b53
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x403b3d
cmp byte [eax + 1], 0x4a
je 0x403b4a
push eax
call fcn.00401178
mov dword [ebp], eax
add ebp, 4
pop ecx
inc esi
cmp esi, edi
jl 0x403b2f
mov ebx, dword [esp + 0x10]
xor esi, esi
test ebx, ebx
jle 0x403bc7
mov eax, dword [esp + 0x20]
mov edi, dword [eax + esi*4]
cmp byte [edi], 0x2d
jne 0x403bbc
mov al, byte [edi + 1]
cmp al, 0x4a
je 0x403bc2
cmp byte [0x429389], 0
je 0x403bbc
cmp al, 0x63
jne 0x403bbc
push 0x41e548
push edi
call fcn.0040afe0
pop ecx
pop ecx
test eax, eax
je 0x403b9b
push str._classpath
push edi
call fcn.0040afe0
pop ecx
pop ecx
test eax, eax
jne 0x403bbc
lea eax, [ebx - 1]
cmp esi, eax
jge 0x403bbc
mov eax, dword [esp + 0x20]
mov dword [ebp], edi
push dword [eax + esi*4 + 4]
call fcn.0040684b
mov dword [ebp + 4], eax
add ebp, 8
pop ecx
inc esi
jmp 0x403bc2
mov dword [ebp], edi
add ebp, 4
inc esi
cmp esi, ebx
jl 0x403b59
and dword [ebp], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Error:_The__J_option_should_not_be_followed_by_a_space.
call fcn.004058ff
pop ecx
push 1
call fcn.00409649
int3
Function at 0x40413d
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0040d0d0
mov edi, edx
add esp, 0x10
mov esi, eax
test edi, edi
jg 0x40416d
jl 0x404163
test esi, esi
jae 0x40416d
or eax, 0xffffffff
or edx, eax
jmp 0x4042b4
push ebx
mov ebx, dword [esp + 0x20]
push 0x16
push ebx
push ebp
call fcn.0041702b
add esp, 0xc
test eax, eax
js 0x4042ae
movzx ecx, byte [ebx + 3]
movzx eax, byte [ebx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x4041d0
push ebx
call fcn.004046af
pop ecx
test eax, eax
je 0x4041c7
push edi
push esi
push ebx
push ebp
call fcn.00404300
add esp, 0x10
mov esi, eax
mov edi, edx
mov eax, esi
mov edx, edi
jmp 0x4042b3
push 2
xor edi, edi
push edi
push edi
push ebp
call fcn.0040d0d0
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, edi
jg 0x4041f9
jl 0x4042ae
cmp ebp, edi
jb 0x4042ae
mov ecx, 0x10015
cmp eax, edi
jg 0x40420e
jl 0x404208
cmp ebp, ecx
jae 0x40420e
mov esi, ebp
mov ecx, eax
jmp 0x404212
mov esi, ecx
mov ecx, edi
mov eax, esi
neg eax
push 2
adc ecx, edi
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0040d0d0
add esp, 0x10
cmp edx, edi
jg 0x404234
jl 0x4042ae
cmp eax, edi
jb 0x4042ae
push 0x10015
call fcn.00409a80
mov edi, eax
pop ecx
test edi, edi
je 0x4042ae
push esi
push edi
push dword [esp + 0x24]
call fcn.0041702b
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x4042a7
lea edx, [edi + eax]
lea esi, [edx - 0x16]
jmp 0x4042a3
cmp byte [esi], 0x50
jne 0x4042a2
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x4042a2
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x4042ba
dec esi
cmp esi, edi
jae 0x404263
push edi
call fcn.00409a48
pop ecx
or eax, 0xffffffff
or edx, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
pop ecx
ret
push 0x16
push esi
push ebx
call fcn.0040a800
push edi
call fcn.00409a48
mov eax, dword [esp + 0x20]
add eax, edi
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push ebx
sbb esi, edx
call fcn.004046af
add esp, 0x14
test eax, eax
je 0x4042fa
push esi
push ebp
push ebx
push dword [esp + 0x28]
call fcn.00404300
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x4042b3
Function at 0x404300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, 0x14
push ebx
push edi
push 0
sbb eax, 0
push eax
push ecx
push dword [ebp + 8]
call fcn.0040d0d0
mov ebx, edx
add esp, 0x10
mov edi, eax
test ebx, ebx
jg 0x404335
jl 0x40432e
test edi, edi
jae 0x404335
or eax, 0xffffffff
or edx, eax
jmp 0x40437d
push esi
mov esi, dword [ebp + 0xc]
push 0x14
push esi
push dword [ebp + 8]
call fcn.0041702b
add esp, 0xc
test eax, eax
js 0x404377
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x7064b50
jne 0x404377
mov eax, edi
mov edx, ebx
jmp 0x40437c
or eax, 0xffffffff
or edx, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40471f
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
cmp dword [edi + 4], 0xffffffff
je 0x404859
cmp dword [edi], 0xffffffff
je 0x404859
push 0
push dword [edi + 0xc]
push dword [edi + 8]
push dword [esp + 0x58]
call fcn.0040d0d0
add esp, 0x10
test edx, edx
jg 0x404763
jl 0x404859
test eax, eax
jb 0x404859
mov eax, dword [edi + 4]
inc eax
push eax
call fcn.00409a80
mov esi, eax
pop ecx
test esi, esi
je 0x404859
mov ebx, dword [edi + 4]
push ebx
push esi
push dword [esp + 0x54]
call fcn.0041702b
add esp, 0xc
cmp eax, ebx
jne 0x404852
cmp dword [edi + 0x10], 0
jne 0x4047af
mov ecx, dword [esp + 0x54]
mov byte [ebx + esi], 0
test ecx, ecx
je 0x4047a8
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov eax, esi
jmp 0x40485b
cmp dword [edi + 0x10], 8
jne 0x404852
xor eax, eax
mov dword [esp + 0x10], esi
push 0x38
push str.1.2.11
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x18]
push 0xfffffffffffffff1
push eax
mov dword [esp + 0x24], ebx
call fcn.00408100
add esp, 0x10
test eax, eax
js 0x404852
mov ebp, dword [edi]
lea eax, [ebp + 1]
push eax
call fcn.00409a80
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404852
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], ebx
push 1
push eax
mov dword [esp + 0x28], ebp
call fcn.00406ac8
pop ecx
pop ecx
push esi
test eax, eax
jns 0x404824
call fcn.00409a48
push ebx
call fcn.00409a48
pop ecx
jmp 0x404858
mov eax, dword [edi]
mov byte [ebx + eax], 0
call fcn.00409a48
lea eax, [esp + 0x14]
push eax
call fcn.004080c4
pop ecx
pop ecx
test eax, eax
jns 0x404842
push ebx
jmp 0x404853
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x40484e
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, ebx
jmp 0x40485b
push esi
call fcn.00409a48
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x404a76
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 0x10000
push dword [esp + 0x28]
mov dword [esp + 0x14], ebx
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.0040d447
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x404ac2
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
call fcn.0040d447
add esp, 0x18
mov esi, eax
cmp dword [0x428044], ebx
je 0x404b6b
push ebp
push edi
push str.J2D_D3D
call fcn.0040922a
mov ebp, str.false
pop ecx
test eax, eax
je 0x404af7
push ebp
push eax
call fcn.0041d7d5
neg eax
pop ecx
sbb eax, eax
and dword [0x428044], eax
pop ecx
push str.J2D_D3D_PRELOAD
call fcn.0040922a
mov edi, eax
pop ecx
test edi, edi
je 0x404b25
push ebp
push edi
call fcn.0041d7d5
pop ecx
pop ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [0x428044]
mov dword [0x428044], ecx
jmp 0x404b2b
mov ecx, dword [0x428044]
test ecx, ecx
jns 0x404b5c
mov dword [0x428044], ebx
test edi, edi
je 0x404b69
push str.true
push edi
call fcn.0041d7d5
xor edx, edx
pop ecx
inc edx
test eax, eax
pop ecx
mov ecx, dword [0x428044]
cmove ecx, edx
mov dword [0x428044], ecx
test ecx, ecx
je 0x404b69
push str.preloadD3D
call fcn.0040491b
pop ecx
pop edi
pop ebp
test esi, esi
je 0x404b8d
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404b99
push dword [esp + 0x20]
call dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [0x4293e8], 0
pop esi
pop ebx
je 0x404ba9
call fcn.00404a6a
mov eax, dword [esp]
pop ecx
pop ecx
ret
Function at 0x404ea1
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
mov ebp, dword [esp + 0xc]
inc eax
push esi
mov ebx, dword [ebx]
mov esi, eax
push edi
push 0x20
pop edi
cmp dword [ebp], eax
jle 0x404f39
push str._J_d64
push dword [ebx + esi*4]
call fcn.0040afe0
pop ecx
pop ecx
test eax, eax
je 0x404f27
push str._d64
push dword [ebx + esi*4]
call fcn.0040afe0
pop ecx
pop ecx
test eax, eax
je 0x404f27
push str._J_d32
push dword [ebx + esi*4]
call fcn.0040afe0
pop ecx
pop ecx
test eax, eax
je 0x404f23
push str._d32
push dword [ebx + esi*4]
call fcn.0040afe0
pop ecx
pop ecx
test eax, eax
je 0x404f23
call fcn.00401cc5
test al, al
je 0x404f19
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x404f2a
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x404f30
jmp 0x404f2a
push 0x20
jmp 0x404f29
push 0x40
pop edi
inc esi
cmp esi, dword [ebp]
jl 0x404ebc
cmp edi, 0x20
jne 0x40509a
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0040550a
pop ecx
pop ecx
test al, al
jne 0x404f5e
push str.Error:_Could_not_find_Java_SE_Runtime_Environment.
call fcn.004058ff
pop ecx
push 2
jmp 0x4050a9
mov eax, 0x41f374
push eax
push str.i386
push eax
push eax
push dword [esp + 0x2c]
push str._s_slib_s_s_sjvm.cfg
push dword [esp + 0x48]
push dword [esp + 0x48]
call fcn.00405ad0
push 0
push dword [esp + 0x50]
call fcn.00402ddf
add esp, 0x28
cmp eax, 1
jge 0x404fa3
push str.Error:_no_known_VMs.__check_for_corrupt_jvm.cfg_file_
call fcn.004058ff
jmp 0x4050a6
mov ebx, dword [esp + 0x18]
push 0
push ebx
push ebp
call fcn.00401730
mov esi, eax
push str.ERROR
push esi
call fcn.0040afe0
add esp, 0x14
test eax, eax
jne 0x404fd6
push str.Error:_could_not_determine_JVM_type.
call fcn.004058ff
pop ecx
push 4
jmp 0x4050a9
push dword [esp + 0x28]
mov edi, dword [esp + 0x28]
push edi
push esi
push dword [esp + 0x28]
mov byte [edi], 0
call fcn.00405610
add esp, 0x10
test al, al
jne 0x405004
push edi
push esi
push str.Error:_missing___s_JVM_at___s._nPlease_install_or_use_the_JRE_or_JDK_that_contains_these_missing_components.
call fcn.004058ff
add esp, 0xc
jmp 0x404fcf
mov edi, dword [ebx]
xor esi, esi
cmp dword [ebp], esi
jle 0x405095
mov ecx, dword [0x428044]
test ecx, ecx
jns 0x405040
push dword [edi + esi*4]
push str._Dsun.awt.warmup
call fcn.004054c8
xor ebx, ebx
pop ecx
inc ebx
pop ecx
mov ecx, dword [0x428044]
cmp eax, ebx
cmove ecx, ebx
mov dword [0x428044], ecx
jmp 0x405043
xor ebx, ebx
inc ebx
test ecx, ecx
je 0x405086
push dword [edi + esi*4]
push str._Dsun.java2d.noddraw
call fcn.004054c8
pop ecx
pop ecx
cmp eax, ebx
je 0x40508e
push dword [edi + esi*4]
push str._Dsun.java2d.d3d
call fcn.004054c8
pop ecx
pop ecx
test eax, eax
je 0x40508e
push dword [edi + esi*4]
push str._Dsun.java2d.opengl
call fcn.004054c8
pop ecx
pop ecx
cmp eax, ebx
je 0x40508e
mov ecx, dword [0x428044]
inc esi
cmp esi, dword [ebp]
jl 0x405017
jmp 0x405095
and dword [0x428044], 0
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push str.Error:_This_Java_instance_does_not_support_a__d_bit_JVM._nPlease_install_the_desired_version.
call fcn.004058ff
pop ecx
pop ecx
push 1
call fcn.00409649
int3
Function at 0x405da4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4282e0]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xa0]
xor esi, esi
push 0x104
mov dword [ebp - 0x7c], eax
xor ebx, ebx
lea eax, [ebp - 0x74]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x405e71
mov eax, dword [ebp - 0x7c]
inc ebx
push dword [eax + 8]
lea eax, [ebp - 0x74]
push eax
call fcn.0040613c
pop ecx
pop ecx
test eax, eax
je 0x405e2b
test esi, esi
je 0x405e1f
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.004061af
pop ecx
pop ecx
test eax, eax
jle 0x405e2b
push esi
call fcn.0040110a
pop ecx
lea eax, [ebp - 0x74]
push eax
call fcn.00401178
pop ecx
mov esi, eax
push 0x104
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x405dee
test esi, esi
je 0x405e71
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
push 0x20019
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
test eax, eax
je 0x405e8b
call fcn.0040110a
pop ecx
cmp dword [ebp - 0x78], ebx
je 0x405e71
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b10c
lea esp, [ebp + 0x94]
pop ebp
ret
call fcn.0040110a
pop ecx
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x104
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push str.JavaHome
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405e63
cmp dword [ebp - 0x78], ebx
je 0x405ec2
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x74]
push eax
call fcn.00401178
pop ecx
jmp 0x405e73