joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4228e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x422924
cmp dword [ebp + 0x14], edi
je 0x422924
cmp ecx, edi
jne 0x42292b
call fcn.00424eb1
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004292f4
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x42293f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x422960
cmp ebx, 0xffffffff
je 0x42294f
push ebx
push edi
push ecx
call fcn.004249b0
add esp, 0xc
cmp esi, edi
je 0x42290c
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x42290c
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x42297c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x422983
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x422a74
test word [esi + 0xc], 0x10c
je 0x4229d7
mov eax, dword [esi + 4]
test eax, eax
je 0x4229d7
jl 0x422ad5
cmp ebx, eax
mov edi, ebx
jb 0x4229a8
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x422a7c
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004238df
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x422a6c
cmp ebx, dword [ebp - 0xc]
jb 0x422a44
cmp dword [ebp - 0xc], 0
je 0x422a01
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4229f6
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4229fd
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x422a0c
mov eax, SysReAllocString
cmp ebx, eax
ja 0x422a0c
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x422aa8
push eax
push dword [ebp - 8]
push esi
call fcn.004299ef
pop ecx
push eax
call fcn.0042c3de
add esp, 0xc
test eax, eax
je 0x422ae7
cmp eax, 0xffffffff
je 0x422ad5
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x422a6c
push esi
call fcn.0042bcfd
cmp eax, 0xffffffff
pop ecx
je 0x422ad9
cmp dword [ebp - 4], 0
je 0x422aa8
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x42298b
mov eax, dword [ebp + 0x14]
jmp 0x422926
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x422a93
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004249b0
add esp, 0xc
call fcn.00424eb1
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x42291c
cmp dword [ebp + 0xc], 0xffffffff
je 0x422abe
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004249b0
add esp, 0xc
call fcn.00424eb1
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x42291c
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x422926
or dword [esi + 0xc], 0x10
jmp 0x422ad9
Function at 0x42d08f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x44b0d8]
je 0x42d0aa
inc edi
cmp edi, 0x17
jb 0x42d09b
cmp edi, 0x17
jae 0x42d22a
push ebp
push 3
call fcn.004347fa
cmp eax, 1
pop ecx
je 0x42d1f6
push 3
call fcn.004347fa
test eax, eax
pop ecx
jne 0x42d0de
cmp dword [0x44a44c], 1
je 0x42d1f6
cmp ebx, 0xfc
je 0x42d229
push 0x43efa8
mov ebx, 0x314
push ebx
mov ebp, 0x44dcd0
push ebp
call fcn.00424d46
add esp, 0xc
test eax, eax
je 0x42d114
push esi
push esi
push esi
push esi
push esi
call fcn.004291f8
add esp, 0x14
push 0x104
mov esi, 0x44dce9
push esi
push 0
mov byte [0x44dded], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42d158
push 0x43ef90
push 0x2fb
push esi
call fcn.00424d46
add esp, 0xc
test eax, eax
je 0x42d158
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004291f8
add esp, 0x14
push esi
call fcn.00424db0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42d19d
push esi
call fcn.00424db0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x44dfe4
push 0x43ef8c
sub ecx, eax
push ecx
push eax
call fcn.0042690b
add esp, 0x14
test eax, eax
je 0x42d19d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004291f8
add esp, 0x14
jmp 0x42d19f
xor esi, esi
push 0x43ef88
push ebx
push ebp
call fcn.00424f7c
add esp, 0xc
test eax, eax
je 0x42d1bf
push esi
push esi
push esi
push esi
push esi
call fcn.004291f8
add esp, 0x14
push dword [edi*8 + 0x44b0dc]
push ebx
push ebp
call fcn.00424f7c
add esp, 0xc
test eax, eax
je 0x42d1e1
push esi
push esi
push esi
push esi
push esi
call fcn.004291f8
add esp, 0x14
push 0x12010
push 0x43ef60
push ebp
call fcn.0043463d
add esp, 0xc
jmp 0x42d229
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x42d229
cmp ebp, 0xffffffff
je 0x42d229
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44b0dc]
push dword [esi]
call fcn.00424db0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43463d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004280b2
xor ebx, ebx
cmp dword [0x44e228], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x434713
push 0x440160
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4347f3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x440154
push edi
call esi
cmp eax, ebx
je 0x4347f3
push eax
call fcn.00428044
mov dword [esp], 0x440144
push edi
mov dword [0x44e228], eax
call esi
push eax
call fcn.00428044
mov dword [esp], 0x440130
push edi
mov dword [0x44e22c], eax
call esi
push eax
call fcn.00428044
mov dword [0x44e230], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00424ad3
test eax, eax
pop ecx
pop ecx
je 0x4346e1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004291f8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x434713
push 0x440114
push edi
call esi
push eax
call fcn.00428044
cmp eax, ebx
pop ecx
mov dword [0x44e238], eax
je 0x434713
push 0x4400fc
push edi
call esi
push eax
call fcn.00428044
pop ecx
mov dword [0x44e234], eax
mov eax, dword [0x44e234]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x434798
cmp dword [0x44e238], ecx
je 0x434798
push eax
call fcn.004280bb
push dword [0x44e238]
mov esi, eax
call fcn.004280bb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x434798
cmp edi, ebx
je 0x434798
call esi
cmp eax, ebx
je 0x434765
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x434765
test byte [ebp - 0x18], 1
jne 0x434798
lea eax, [ebp - 0x10]
push eax
call fcn.00424b0a
test eax, eax
pop ecx
je 0x434780
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004291f8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43478f
or dword [ebp + 0x10], 0x200000
jmp 0x4347d3
or dword [ebp + 0x10], 0x40000
jmp 0x4347d3
mov eax, dword [0x44e22c]
cmp eax, dword [ebp - 8]
je 0x4347d3
push eax
call fcn.004280bb
cmp eax, ebx
pop ecx
je 0x4347d3
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4347d3
mov eax, dword [0x44e230]
cmp eax, dword [ebp - 8]
je 0x4347d3
push eax
call fcn.004280bb
cmp eax, ebx
pop ecx
je 0x4347d3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44e228]
call fcn.004280bb
cmp eax, ebx
pop ecx
je 0x4347f3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4347f5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43890c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44a5d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004388a1
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004249b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43895b
cmp dword [ebp - 0x1c], 5
jb 0x438973
jmp 0x43896f
cmp dword [ebp - 0x10], 1
jne 0x438973
cmp dword [ebp - 0x1c], 4
ja 0x43896f
jne 0x438973
cmp dword [ebp - 0x18], 0
jbe 0x438973
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4409f8
call fcn.00438775
test eax, eax
jge 0x438994
mov byte [0x44e37c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00421f10
add ebp, 0x78
leave
ret
Function at 0x8f86a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x775015
lea edi, [esi - 0x374015]
lea eax, [edi + 0x383a00]
push dword [eax]
mov dword [eax], 0xe16cc877
push eax
push edi
or ebp, 0xffffffff
jmp 0x8f86d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8f86d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f86c8
mov eax, 1
add ebx, ebx
jne 0x8f86eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8f86fc
jne 0x8f871b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f871b
dec eax
add ebx, ebx
jne 0x8f8708
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8f86e0
add ebx, ebx
jne 0x8f8717
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8f876d
xor ecx, ecx
sub eax, 3
jb 0x8f8733
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8f87a2
sar eax, 1
mov ebp, eax
jmp 0x8f873e
add ebx, ebx
jne 0x8f873e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f870c
inc ecx
add ebx, ebx
jne 0x8f874c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f870c
add ebx, ebx
jne 0x8f8759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8f874e
jne 0x8f876a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8f874e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8f878c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8f877e
jmp 0x8f86ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8f878c
add edi, ecx
jmp 0x8f86ce
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x1496c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8f87ae
cmp byte [edi], 0xa2
jne 0x8f87ae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8f87b3
lea edi, [esi + 0x4f4000]
mov eax, dword [edi]
or eax, eax
je 0x8f8822
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x507e34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x507fa8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8f87e0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x507fb0]
or eax, eax
je 0x8f881c
mov dword [ebx], eax
add ebx, 4
jmp 0x8f87fd
call dword [esi + 0x507fac]
mov ebp, dword [esi + 0x507fb4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x4f887d]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8f886e
sub esp, 0xffffff80
jmp 0x403220
Function at 0x65ba2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.65ba21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x65ba207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x65ba206a
add dl, dl
jne 0x65ba2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x65ba20dc
xor eax, eax
add dl, dl
jne 0x65ba2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x65ba217d
add dl, dl
jne 0x65ba20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65ba20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65ba20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65ba20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x65ba20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x65ba2075
mov eax, 1
add dl, dl
jne 0x65ba20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x65ba20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x65ba20e1
sub eax, ebx
mov ebx, 1
jne 0x65ba2128
mov ecx, 1
add dl, dl
jne 0x65ba210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65ba2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x65ba2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x65ba2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x65ba213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x65ba214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x65ba2136
cmp eax, 0x7d00
jae 0x65ba216d
cmp eax, 0x500
jb 0x65ba2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x65ba2075
cmp eax, 0x7f
ja 0x65ba2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x65ba2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x65ba219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x65ba2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x6d5320d8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
add eax, eax
mov dword [ecx], eax
push esi
mov esi, dword [esp + 8]
shl eax, 2
push eax
push dword [esi]
call dword [sym.imp.MSVCR100.dll_realloc]
pop ecx
pop ecx
test eax, eax
jne 0x6d53210d
push 0x6d53c1e0
call dword [sym.imp.MSVCR100.dll_perror]
pop ecx
push 1
call dword [sym.imp.MSVCR100.dll_exit]
mov dword [esi], eax
pop esi
ret 8

Function at 0x6d5328bd
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x17e8]
mov eax, 0x1868
call fcn.6d539990
mov eax, dword [0x6d541910]
xor eax, ebp
mov dword [ebp + 0x17e4], eax
push esi
lea eax, [ebp + 0xc8]
mov esi, ecx
push eax
mov dword [ebp - 0x80], esi
call fcn.6d539c2d
pop ecx
test al, al
jne 0x6d532902
lea eax, [ebp + 0xc8]
push eax
lea ecx, [esi + 0x20]
call fcn.6d53467c
lea eax, [ebp + 0xc8]
push 0x6d53bea0
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x6d532a73
push ebx
push edi
mov edi, 0x104
push edi
lea eax, [ebp + 0x12d0]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
lea eax, [ebp + 0x12d0]
push eax
lea eax, [ebp + 0x14d8]
push str._sSunJavaDeploymentLibTrusted
push eax
call esi
mov ebx, dword [sym.imp.kernel32.dll_FindFirstFileA]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x14d8]
push eax
call ebx
mov dword [ebp - 0x7c], eax
push edi
lea eax, [ebp + 0x13d4]
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x13d4]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_strrchr]
pop ecx
pop ecx
test eax, eax
je 0x6d53298f
mov byte [eax], 0
lea eax, [ebp + 0x13d4]
push eax
lea eax, [ebp + 0x15dc]
push str._sjss
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x15dc]
push eax
call ebx
or ebx, 0xffffffff
mov edi, eax
cmp dword [ebp - 0x7c], ebx
jne 0x6d5329c6
cmp edi, ebx
je 0x6d532a71
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x16e0]
push eax
call fcn.6d539c2d
cmp dword [ebp - 0x7c], ebx
je 0x6d532a38
cmp edi, ebx
je 0x6d532a14
lea eax, [ebp + 0x15dc]
push eax
lea eax, [ebp + 0x14d8]
push eax
lea eax, [ebp + 0x16e0]
push eax
lea eax, [ebp + 0x10c8]
push str._Djava.ext.dirs_slibext__s__s
push eax
call esi
mov esi, dword [sym.imp.kernel32.dll_FindClose]
add esp, 0x14
push dword [ebp - 0x7c]
call esi
push edi
call esi
jmp 0x6d532a62
lea eax, [ebp + 0x14d8]
push eax
lea eax, [ebp + 0x16e0]
push eax
lea eax, [ebp + 0x10c8]
push 0x6d53bf04
push eax
call esi
add esp, 0x10
push dword [ebp - 0x7c]
jmp 0x6d532a5c
cmp edi, ebx
je 0x6d532a62
lea eax, [ebp + 0x15dc]
push eax
lea eax, [ebp + 0x16e0]
push eax
lea eax, [ebp + 0x10c8]
push str._Djava.ext.dirs_slibext__s
push eax
call esi
add esp, 0x10
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x10c8]
push eax
call fcn.6d532113
pop edi
pop ebx
mov ecx, dword [ebp + 0x17e4]
xor ecx, ebp
pop esi
call fcn.6d539821
add ebp, 0x17e8
leave
ret
Function at 0x6d535bc0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d541910]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d539c2d
mov ebx, eax
cmp ebx, esi
je 0x6d535c33
lea ecx, [ebp - 0x74]
call fcn.6d5354cf
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d539821
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d535c4b
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d535bc0
cmp eax, esi
jne 0x6d535c7d
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d535c3b
lea ecx, [ebp - 0x74]
call fcn.6d5354cf
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d535460
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d5354cf
mov eax, esi
jmp 0x6d535c19
Function at 0x6d53828f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x6d5382b2
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x6d5382b2
mov bl, 1
mov al, bl
pop ebx
ret

Function at 0x6d5389a2
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x6d53ac61
call fcn.6d53987b
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x6d53d7e8
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x6d538a16
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.6d5394e6
pop ecx
pop ecx
push edi
push esi
call fcn.6d539c2d
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.6d539254
push eax
push esi
push 0x6d53d4ac
call fcn.6d5394e6
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x6d538a0f
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x6d538ac7
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x6d538a73
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x6d5389da
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x6d538ac7
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x6d538ac7
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x6d5389da
mov eax, esi
call fcn.6d5398e7
ret

Function at 0x6d539821
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d541910]
jne 0x6d53982b
repz ret
jmp fcn.6d539f78
Function at 0x6d6253aa
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d6253f8
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d625409
push 0xd
pop eax
jmp 0x6d625433
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d62540c
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d6258d1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d62e944]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d6293f2
mov ebx, eax
cmp ebx, esi
je 0x6d625944
lea ecx, [ebp - 0x74]
call fcn.6d624b0c
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6289ea
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d62595c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d6258d1
cmp eax, esi
jne 0x6d62598e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d62594c
lea ecx, [ebp - 0x74]
call fcn.6d624b0c
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d624a9d
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d624b0c
mov eax, esi
jmp 0x6d62592a
Function at 0x6d6289ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d62e944]
jne 0x6d6289f4
repz ret
jmp fcn.6d629069

Function at 0x6d6293f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x6d629401
pop dword [ebp - 0x14]
mov eax, 0x6d629401
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xd0c5f0fa
sub dword [ebp - 0x24], 0x8273abaf
mov dword [ebp - 0x20], 0xd1583ef1
sub dword [ebp - 0x20], 0x9f24f2ac
mov dword [ebp - 0x1c], 0x5279c352
sub dword [ebp - 0x1c], 0x62d7f24
mov dword [ebp - 0x18], 0xa567733e
add dword [ebp - 0x18], 0x5a988cc2
lea eax, [ebp - 0x24]
push eax
mov eax, 0x133c1deb
sub eax, 0xa5d97dc7
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x7cec5ab
sub dword [ebp - 0x24], 0x935c5c55
mov dword [ebp - 0x20], 0xc62de16f
sub dword [ebp - 0x20], 0x84c17ffa
mov dword [ebp - 0x1c], 0x295b5d7e
add dword [ebp - 0x1c], 0x3a140eee
mov dword [ebp - 0x18], 0x896a0b04
sub dword [ebp - 0x18], 0x896a0b04
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xa0fd72c4
add eax, 0xcc652d5c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x358f0
push 0
call eax
mov ecx, 0xced337f2
add ecx, 0x312d0aae
xor ebx, ebx
add ebx, eax
mov edx, 0x2a11dfec
add edx, 0x43513414
add edx, dword [ebp - 0x14]
mov edi, 0x7776af49
sub edi, 0xf2443a51
mov dword [ebp - 0xc], 0x98d9f41b
mov esi, dword [edx]
xor dword [ebp - 0x10], esi
add esi, edi
add dword [ebp - 0xc], edi
mov dword [ebx], esi
mov dword [ebp - 8], 0xf217f3d2
add ebx, 0x259fd4b5
add ebx, 0xda602b4f
add edx, 0x92505cc5
add edx, 0x6dafa33f
loop 0x6d629520
add eax, 0x6b47e5bb
sub eax, 0x6b46e868
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6d620000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret