joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4742f3
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov esi, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov dl, byte [eax + 4]
mov byte [esi + 4], dl
mov dword [esp + 0xc], esi
mov byte [eax + 4], 0
xor edx, edx
push 0xffffffffffffffff
lea ecx, [esi + 8]
push edx
add eax, 8
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x44], 0
mov word [ecx], dx
call fcn.004041b0
lea eax, [esi + 0x28]
push eax
mov ecx, edi
mov dword [esp + 0x3c], 1
call fcn.00438ff0
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov byte [esp + 0x3c], 2
call fcn.00438ff0
push 0
push eax
mov ecx, esi
mov byte [esp + 0x40], 3
call fcn.0043f980
cmp dword [esp + 0x24], 0x10
mov dword [esi + 0x24], eax
jb 0x43b4a0
mov edx, dword [esp + 0x10]
push edx
call fcn.004533ae
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045407e
add esp, 0x30
ret 8

Function at 0x43b830
Capabilities:
Move file

Disassembly:
sub esp, 0x310
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x30c], eax
push esi
mov esi, dword [esp + 0x318]
push edi
mov edi, dword [esp + 0x320]
push 0x30b
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.004547c0
add esp, 0xc
mov ecx, 0x48e810
test edi, edi
je 0x43b878
mov ecx, edi
mov eax, str.NULL
test esi, esi
je 0x43b883
mov eax, esi
push ecx
push eax
push str.___Start_in_MoveFileOnReboot:__s_to__s___
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
push 0x30c
push ecx
call fcn.00454e68
lea edx, [esp + 0x20]
push edx
call fcn.00438d20
add esp, 0x1c
test esi, esi
jne 0x43b8c5
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0045407e
add esp, 0x310
ret
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [esp + 0x314]
pop edi
pop esi
xor ecx, esp
call fcn.0045407e
add esp, 0x310
ret
Function at 0x43bc40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa14
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0xa10], eax
push ebx
push esi
mov esi, dword [esp + 0xa20]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x119]
push ebx
push eax
mov byte [esp + 0x120], bl
call fcn.004547c0
push ebx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x128]
push edx
push esi
mov dword [esp + 0x24], 0x104
call fcn.0043b8f0
add esp, 0x1c
test eax, eax
jne 0x43bcc2
push str.Cannot_determine_JavaHome._n
call fcn.00438d20
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0045407e
add esp, 0xa14
ret
push 0x103
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.004547c0
push str.libdeployment.properties
lea ecx, [esp + 0x124]
push ecx
push str._s_s
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push 0x104
push edx
call fcn.00454e68
lea eax, [esp + 0x34]
push eax
call fcn.004386e0
add esp, 0x28
test eax, eax
je 0x43bd30
push str.Deployment_configuration_files_already_exists._n
call fcn.00438d20
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0045407e
add esp, 0xa14
ret
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43bd77
push str.Unable_to_create_deployment_configuration_file._n
call fcn.00438d20
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0045407e
add esp, 0xa14
ret
push 0x7ff
lea edx, [esp + 0x21d]
push ebx
push edx
mov byte [esp + 0x224], bl
call fcn.004547c0
push str.deployment.baseline.url_n
push 0xffffffffffffffff
lea eax, [esp + 0x22c]
push 0x800
push eax
call fcn.00454e68
add esp, 0x1c
push ebx
push ebx
push ebx
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x224]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43be10
push str.Unable_to_write_to_deployment_configuration_file._n
call fcn.00438d20
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0045407e
add esp, 0xa14
ret
push str.Successfully_disabled_dynamic_baselining._n
call fcn.00438d20
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xa18]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0045407e
add esp, 0xa14
ret
Function at 0x43c080
Capabilities:
Create pipe

Disassembly:
push 0xffffffffffffffff
push 0x46f1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
lea eax, [esp + 0x18]
push eax
lea edi, [esi + 0xd4]
push edi
lea ebp, [esi + 0xd0]
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x43c18a
mov eax, dword [edi]
mov ecx, dword [ebp]
or dword [esi + 0xa8], 0x100
push ebx
push 1
push ecx
mov dword [esi + 0xbc], eax
mov dword [esi + 0xb8], eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 1
mov dword [esi + 0x5c], 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x43c186
call fcn.00434cf0
push 0x13
push str.Create_pipe_SUCCESS
lea ecx, [esp + 0x28]
mov esi, eax
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
lea edx, [esp + 0x20]
push edx
push 0x48f1e8
push 0xeb
push 0x48f200
push 1
mov ecx, esi
mov dword [esp + 0x78], ebx
call fcn.00434dd0
cmp dword [esp + 0x34], 0x10
jb 0x43c186
mov eax, dword [esp + 0x20]
push eax
call fcn.004533ae
add esp, 4
mov al, 1
jmp 0x43c1fe
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x43c1fc
call fcn.00434cf0
push 0x13
push str.Create_pipe_FAILURE
lea ecx, [esp + 0x44]
mov esi, eax
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004042b0
lea ecx, [esp + 0x3c]
push ecx
push str.Executor::createPipe
push 0xee
push 0x48f290
push 1
mov ecx, esi
mov dword [esp + 0x78], 1
call fcn.00434dd0
cmp dword [esp + 0x50], 0x10
jb 0x43c1fc
mov edx, dword [esp + 0x3c]
push edx
call fcn.004533ae
add esp, 4
xor al, al
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0045407e
add esp, 0x54
ret
push esi
push edi
mov esi, ecx
push 0x44
lea edi, [esi + 0x7c]
push 0
push edi
call fcn.004547c0
xor eax, eax
mov dword [edi], 0x44
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov eax, 1
add esp, 0xc
cmp dword [esi + 0xc0], eax
jne 0x43c26b
or dword [esi + 0xa8], eax
xor eax, eax
mov word [esi + 0xac], ax
mov dword [esi + 0x60], 0x8000000
cmp byte [esi + 0xcd], 0
pop edi
je 0x43c27d
mov ecx, esi
pop esi
jmp 0x43c080
pop esi
ret
Function at 0x43c220
Capabilities:
Create pipe

Disassembly:
push 0xffffffffffffffff
push 0x46f1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
lea eax, [esp + 0x18]
push eax
lea edi, [esi + 0xd4]
push edi
lea ebp, [esi + 0xd0]
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x43c18a
mov eax, dword [edi]
mov ecx, dword [ebp]
or dword [esi + 0xa8], 0x100
push ebx
push 1
push ecx
mov dword [esi + 0xbc], eax
mov dword [esi + 0xb8], eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 1
mov dword [esi + 0x5c], 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x43c186
call fcn.00434cf0
push 0x13
push str.Create_pipe_SUCCESS
lea ecx, [esp + 0x28]
mov esi, eax
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
lea edx, [esp + 0x20]
push edx
push 0x48f1e8
push 0xeb
push 0x48f200
push 1
mov ecx, esi
mov dword [esp + 0x78], ebx
call fcn.00434dd0
cmp dword [esp + 0x34], 0x10
jb 0x43c186
mov eax, dword [esp + 0x20]
push eax
call fcn.004533ae
add esp, 4
mov al, 1
jmp 0x43c1fe
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x43c1fc
call fcn.00434cf0
push 0x13
push str.Create_pipe_FAILURE
lea ecx, [esp + 0x44]
mov esi, eax
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004042b0
lea ecx, [esp + 0x3c]
push ecx
push str.Executor::createPipe
push 0xee
push 0x48f290
push 1
mov ecx, esi
mov dword [esp + 0x78], 1
call fcn.00434dd0
cmp dword [esp + 0x50], 0x10
jb 0x43c1fc
mov edx, dword [esp + 0x3c]
push edx
call fcn.004533ae
add esp, 4
xor al, al
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0045407e
add esp, 0x54
ret
push esi
push edi
mov esi, ecx
push 0x44
lea edi, [esi + 0x7c]
push 0
push edi
call fcn.004547c0
xor eax, eax
mov dword [edi], 0x44
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov eax, 1
add esp, 0xc
cmp dword [esi + 0xc0], eax
jne 0x43c26b
or dword [esi + 0xa8], eax
xor eax, eax
mov word [esi + 0xac], ax
mov dword [esi + 0x60], 0x8000000
cmp byte [esi + 0xcd], 0
pop edi
je 0x43c27d
mov ecx, esi
pop esi
jmp 0x43c080
pop esi
ret
Function at 0x43d0d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x474670
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
push 1
mov esi, ecx
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x43d16e
lea eax, [esi + 0x38]
push eax
lea eax, [esp + 0x20]
push str.Executor.exec__:
push eax
call fcn.00406d30
add esp, 0xc
push eax
push str.Executor::startExecution
push 0x93
push 0x48ec80
xor ebx, ebx
push 1
mov dword [esp + 0x58], ebx
call fcn.00434cf0
mov ecx, eax
call fcn.00434dd0
cmp dword [esp + 0x30], 0x10
mov dword [esp + 0x44], 0xffffffff
jb 0x43d170
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004533ae
add esp, 4
jmp 0x43d170
xor ebx, ebx
mov ecx, esi
call fcn.0043c220
mov edx, dword [esi + 0x4c]
lea eax, [esi + 0x38]
cmp edx, 0x10
jb 0x43d186
mov edi, dword [eax]
jmp 0x43d188
mov edi, eax
mov ecx, dword [eax + 0x10]
add ecx, edi
cmp edx, 0x10
jb 0x43d194
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push edx
push ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0043d060
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x17]
mov dword [esp + 0x44], 1
mov byte [esp + 0x17], 0
cmp ecx, eax
jae 0x43d1fb
mov edx, ecx
cmp edi, edx
ja 0x43d1fb
mov ebp, ecx
sub ebp, edi
cmp eax, dword [esp + 0x24]
jne 0x43d1f0
push 1
lea ecx, [esp + 0x20]
call fcn.00429570
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp eax, ebx
je 0x43d21b
mov cl, byte [edi + ebp]
mov byte [eax], cl
jmp 0x43d21b
cmp eax, dword [esp + 0x24]
jne 0x43d214
push 1
lea ecx, [esp + 0x20]
call fcn.00429570
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp eax, ebx
je 0x43d21b
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x43d225
mov eax, dword [esi]
jmp 0x43d227
mov eax, esi
lea edx, [esi + 0x6c]
push edx
mov edx, dword [esi + 0x68]
lea ecx, [esi + 0x7c]
push ecx
mov ecx, dword [esi + 0x64]
push edx
mov edx, dword [esi + 0x60]
push ecx
mov ecx, dword [esi + 0x5c]
push edx
mov edx, dword [esi + 0x58]
push ecx
mov ecx, dword [esi + 0x54]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
test edi, edi
je 0x43d261
push edi
call fcn.004533ae
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045407e
add esp, 0x34
ret
Function at 0x43d5f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
cmp dword [edx + 0x14], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0
jb 0x43d60e
mov edx, dword [edx]
mov eax, dword [ecx]
lea ecx, [esp + 4]
push ecx
push 0
lea ecx, [esp + 8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43d632
xor al, al
add esp, 8
ret 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43d63f
mov edx, dword [esp]
mov dword [eax], edx
mov al, 1
add esp, 8
ret 8
Function at 0x43d960
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4747a9
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x88]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x24], 1
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, edx
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x43d9f2
mov edx, dword [ebx]
jmp 0x43d9f4
mov edx, ebx
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
lea edi, [esp + 0x18]
push edi
push eax
mov eax, dword [esp + 0x28]
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [esp + 0x18]
mov edi, eax
cmp edi, 0xea
je 0x43da38
mov ecx, dword [esi]
cmp ecx, dword [esi + 4]
jne 0x43dad0
test edi, edi
jne 0x43dad4
test ebp, ebp
je 0x43db4e
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, ecx
sub edi, edx
cmp edi, ebp
jbe 0x43da64
add ebp, edx
cmp ebp, ecx
je 0x43d9d1
mov edi, ecx
sub edi, ecx
push edi
push ecx
push ebp
call fcn.00453780
add esp, 0xc
add edi, ebp
mov dword [esi + 4], edi
jmp 0x43d9d1
jae 0x43d9d1
mov eax, edx
sub eax, ecx
add eax, ebp
or ecx, 0xffffffff
sub ecx, eax
cmp ecx, edi
jb 0x43db79
add edi, eax
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x43daa9
mov ecx, eax
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
cmp edx, eax
jae 0x43da99
xor eax, eax
jmp 0x43da9b
add eax, ecx
cmp eax, edi
jae 0x43daa1
mov eax, edi
push eax
mov ecx, esi
call fcn.00429350
mov ecx, dword [esi + 4]
mov eax, dword [esi]
sub eax, ecx
add eax, ebp
je 0x43dac0
push eax
push 0
push ecx
call fcn.004547c0
add esp, 0xc
mov eax, dword [esi]
mov ebx, dword [esp + 0x1c]
add eax, ebp
mov dword [esi + 4], eax
jmp 0x43d9d1
test edi, edi
je 0x43db4e
push 0xb
push str.query_value
lea ecx, [esp + 0x40]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
call fcn.004042b0
push edi
push ebx
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x8c], 1
call fcn.0043d770
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x7c], 2
jb 0x43db25
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], eax
call fcn.00453b7a
push 0x498d24
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], vtable.std::runtime_error.0
call fcn.00453ce8
push ebp
mov ecx, esi
call fcn.00429d30
mov eax, esi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0045407e
add esp, 0x6c
ret 0xc
push str.vector_T__too_long
call fcn.00440d57
int3
Function at 0x43db90
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4747f0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, dword [esp + 0x68]
cmp dword [edi + 0x14], 0x10
mov eax, ecx
jb 0x43dbd0
mov ecx, dword [edi]
jmp 0x43dbd2
mov ecx, edi
mov eax, dword [eax]
push 4
lea edx, [esp + 0x70]
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43dc6a
push 0xf
push str.set_dword_value
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.004042b0
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x70], 0
call fcn.0043d770
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x60], 1
jb 0x43dc41
mov edx, dword [eax]
mov dword [esp + 0xc], edx
jmp 0x43dc45
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00453b7a
push 0x498d24
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.00453ce8
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0045407e
add esp, 0x58
ret 8

Function at 0x43dc90
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4747f0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
cmp dword [eax + 0x14], 0x10
mov edi, dword [esp + 0x68]
mov esi, dword [eax + 0x10]
jb 0x43dcd3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x43dcdd
mov edx, dword [edi]
jmp 0x43dcdf
mov edx, edi
mov ecx, dword [ecx]
inc esi
push esi
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43dd73
push 0x10
push str.set_string_value
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.004042b0
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x70], 0
call fcn.0043d770
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x60], 1
jb 0x43dd4a
mov edx, dword [eax]
mov dword [esp + 0xc], edx
jmp 0x43dd4e
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00453b7a
push 0x498d24
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.00453ce8
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0045407e
add esp, 0x58
ret 8
Function at 0x43dda0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4747f0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
cmp dword [eax + 0x14], 0x10
mov edi, dword [esp + 0x68]
mov esi, dword [eax + 0x10]
jb 0x43dde3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x43dded
mov edx, dword [edi]
jmp 0x43ddef
mov edx, edi
mov ecx, dword [ecx]
inc esi
push esi
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43de83
push 0x17
push str.set_Expand_string_value
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.004042b0
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x70], 0
call fcn.0043d770
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x60], 1
jb 0x43de5a
mov edx, dword [eax]
mov dword [esp + 0xc], edx
jmp 0x43de5e
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00453b7a
push 0x498d24
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.00453ce8
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0045407e
add esp, 0x58
ret 8
Function at 0x43edc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4749f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.00440c50
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
call fcn.00440530
cmp dword [esp + 0x1c], 8
je 0x43ee1a
push 0xf7
push str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u25_1514_install_src_ipc_includeipc_SharedMemory.h
push str.sizeof_buffer___impl.getSize__
call fcn.004590c4
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.00440c60
mov edx, dword [eax]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
push ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.00453410
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00440700
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00440600
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x43f640
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [edx + 8]
push esi
mov esi, dword [edx + 4]
sub eax, esi
push eax
mov eax, dword [edx]
mov edx, dword [esp + 0xc]
push esi
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x43f790
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x474bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x3c]
push eax
push 0
push esi
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x43f828
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.00429d30
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x34], 0
mov dword [esi], edx
call fcn.0043f6a0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43f824
push eax
call fcn.004533ae
add esp, 4
mov eax, edi
jmp 0x43f84c
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esi + 4]
call fcn.00429d30
mov edi, dword [esi + 4]
mov eax, dword [ebx + 4]
lea edx, [esp + 0x3c]
push edx
push edi
push esi
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x45407e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a3dc0]
jne 0x454088
repz ret
jmp fcn.0045eecf