joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100200b6
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x10066747
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 0x1000
push eax
mov dword [ebp - 4], eax
lea eax, [ebp]
push eax
call fcn.1003cd40
call fcn.10059c4f
push edx
push eax
push 0x100833bc
lea eax, [ebp]
push 0x800
push eax
call fcn.1000758d
add esp, 0x20
lea ecx, [ebp - 0x20]
mov edi, 0x2001f
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push edi
push 0x100833d4
push ebx
call fcn.10059c4f
mov esi, eax
cmp esi, 2
jne 0x1002015a
push str._setSystemWebJavaEnabled:_OK_regkey_does_not_exists
call fcn.10059c4f
pop ecx
jmp 0x10020177
push ecx
mov ecx, esp
push str._setSystemWebJavaEnabled:_open_JavaDeploy_subkey
call fcn.1000155e
push esi
call fcn.100295eb
pop ecx
pop ecx
test eax, eax
je 0x10020238
push 0x10083518
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
xor eax, eax
push ecx
cmp esi, 2
mov ecx, esp
push str._setSystemWebJavaEnabled:_delete_WebDeployJava
cmove esi, eax
call fcn.1000155e
push esi
call fcn.100295eb
pop ecx
pop ecx
test eax, eax
je 0x10020238
push edi
lea eax, [ebp]
push eax
push 0x100835c4
push 0x1008360c
push ebx
call fcn.1001d942
add esp, 0x14
lea ecx, [ebp - 0x10]
mov esi, eax
push 0x10083650
call fcn.1000155e
push ecx
mov ecx, dword [ebp - 0x10]
mov edx, esp
mov byte [ebp - 4], 1
mov dword [edx], ecx
test ecx, ecx
je 0x100201e7
lock inc dword [ecx + 8]
push esi
call fcn.100295eb
push edi
push 0x100836b4
push 0x100836cc
push 0x10083710
push ebx
call fcn.1001d942
add esp, 0x1c
lea ecx, [ebp - 0x10]
mov edi, eax
push str.___Create_HKLM_webjavaswitch_status_enabled
call fcn.100015e9
mov esi, dword [ebp - 0x10]
push ecx
mov ecx, esp
mov dword [ecx], esi
test esi, esi
je 0x10020225
lock inc dword [esi + 8]
push edi
call fcn.100295eb
pop ecx
pop ecx
test esi, esi
je 0x10020238
mov ecx, esi
call fcn.100016f0
lea ecx, [ebp - 0x20]
call fcn.1001ad8c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
Function at 0x100203c0
Capabilities:
Get file version info

Disassembly:
push 0x24
mov eax, 0x100667df
call fcn.1003a5de
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x1002051b
call dword [sym.imp.kernel32.dll_GetLastError]
push str.GetFileVersion_for__
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.10012712
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x10020426
call fcn.100016f0
push str.__FAILED
lea ecx, [ebp - 0x14]
call fcn.10012712
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x10020452
call fcn.100016f0
lea ecx, [ebp - 0x14]
cmp esi, 2
jne 0x1002046a
push str.__file_does_not_exist_
call fcn.10012712
mov byte [ebp - 4], 3
jmp 0x100204e4
push 0x10083cf8
call fcn.10012712
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10020490
call fcn.100016f0
push 0x13
pop eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x14]
call fcn.1000575b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100204c6
call fcn.100016f0
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x30]
mov byte [ebp - 4], bl
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x10083d10
lea ecx, [ebp - 0x14]
call fcn.10012712
mov byte [ebp - 4], 7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100204fc
call fcn.100016f0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x10020505
mov ebx, dword [esi]
push ebx
call fcn.10059c4f
pop ecx
test esi, esi
je 0x10020517
mov ecx, esi
call fcn.100016f0
xor eax, eax
jmp 0x10020564
push esi
call fcn.10059c4f
pop ecx
mov edi, eax
push edi
push esi
push 0
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x10020561
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x10083d34
push edi
call sub.version.dll_VerQueryValueW
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
movzx eax, word [edx + 0xa]
mov dword [ecx], eax
movzx eax, word [edx + 8]
mov dword [ecx + 4], eax
movzx eax, word [edx + 0xe]
mov dword [ecx + 8], eax
xor eax, eax
inc eax
call fcn.1003a5b8
ret
Function at 0x10020be0
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x100668dd
call fcn.1003a5de
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
call fcn.1002da2a
test eax, eax
je 0x10020c2b
call fcn.10059c4f
test eax, eax
je 0x10020c1d
call fcn.10059c4f
test eax, eax
je 0x10020c1d
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
jmp 0x10020c37
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x10020c37
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push str.__get_system_dir__
lea ecx, [ebp + 8]
mov edi, eax
call fcn.10012712
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push esi
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10020c73
call fcn.100016f0
push 0x10084470
lea ecx, [ebp - 0x10]
call fcn.10012712
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 8]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10020ca0
call fcn.100016f0
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10020cb0
lock inc dword [esi + 8]
test edi, edi
setne al
movzx eax, al
push eax
call fcn.10029854
pop ecx
pop ecx
test esi, esi
je 0x10020ccb
mov ecx, esi
call fcn.100016f0
mov eax, edi
call fcn.1003a5b8
ret
Function at 0x10021c65
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4
or dword [esp + 4], 0xffffffff
push ebx
mov ebx, dword [esp + 0xac]
test ebx, ebx
jne 0x10021c84
or eax, 0xffffffff
jmp 0x10021def
call fcn.1002e262
push 0x10
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
pop edx
mov byte [ecx], 0
inc ecx
sub edx, 1
jne 0x10021c94
push ebp
push esi
push edi
xor esi, esi
call fcn.1002db30
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x10021d5d
push str.RunAsDesktopUser___OnVistaOrLater__use_CreateProcessWithTokenW
call fcn.10059c4f
mov dword [esp], str.AdvAPI32.dll
call fcn.10059c4f
mov esi, eax
pop ecx
test esi, esi
jne 0x10021cd9
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_load_advapi32.dll
jmp 0x10021cf2
push str.CreateProcessWithTokenW
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x10021d01
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_GetProcAddress
call fcn.10059c4f
mov ebx, dword [esp + 0x14]
pop ecx
jmp 0x10021dde
push str.RunAsDesktopUser___calling__CreateProcessWithTokenW
call fcn.10059c4f
pop ecx
push 0x44
pop ebp
mov ecx, ebp
lea eax, [esp + 0x70]
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x10021d17
lea eax, [esp + 0x18]
mov dword [esp + 0x70], ebp
push eax
lea eax, [esp + 0x74]
push eax
push edx
push edx
push edx
push dword [esp + 0xd0]
push ebx
mov ebx, dword [esp + 0x2c]
push edx
push ebx
call dword [esp + 0x4c]
test eax, eax
jne 0x10021d56
push str.RunAsDesktopUser:_CreateProcessWithTokenW_failed.
call fcn.10059c4f
pop ecx
jmp 0x10021dde
cmp dword [esp + 0x18], 0
jmp 0x10021dbb
push str.RunAsDesktopUser___OnWinXP__use_CreateProcessAsUser
call fcn.10059c4f
push 0x44
pop ebp
push ebp
lea eax, [esp + 0x34]
push 0
push eax
call fcn.1003cd40
add esp, 0x10
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x34], str.winsta0default
push eax
lea eax, [esp + 0x30]
push eax
xor eax, eax
push eax
push eax
push 0x30
push eax
push eax
push eax
push dword [esp + 0xdc]
push ebx
mov ebx, dword [esp + 0x38]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10021db7
push 0x100852d8
jmp 0x10021d4b
cmp dword [esp + 0x18], esi
je 0x10021dde
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [esp + 0x18]
call edi
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call edi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x100223c9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x10066c75
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x100c]
lea eax, [ebp]
xor ebx, ebx
mov dword [ebp - 0x2c], edi
push 0x1000
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
call fcn.1003cd40
add esp, 0xc
mov ecx, edi
push 0x1007d9e6
call fcn.10012712
xor eax, eax
mov dword [ebp - 0x24], ebx
inc eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
push str.GetLatestJavawsVersion__:
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x800
call fcn.10059c4f
pop ecx
cmp dword [ebp + 0x1010], ebx
je 0x1002246d
mov esi, 0x20219
push str.___checking_32_bit
jmp 0x10022477
mov esi, 0x20119
push str.___checking_64_bit
call fcn.10059c4f
pop ecx
push esi
push str.SOFTWAREJavaSoftJava_Web_Start
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x24]
call fcn.10059c4f
test eax, eax
je 0x100224d4
push str.___failed_to_open_SOFTWAREJavaSoftJava_Web_Start
call fcn.10059c4f
pop ecx
lea ecx, [ebp - 0x24]
call fcn.1001ad8c
lea ecx, [ebp - 0x24]
call fcn.1001ad8c
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1002249f
push str.___Processing_key:
lea ecx, [ebp - 0x14]
call fcn.10012712
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x10022535
call fcn.100016f0
and dword [ebp - 0x10], 0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10022540
mov eax, dword [esi]
jmp 0x10022542
xor eax, eax
push eax
call fcn.10059c4f
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.1001e865
add esp, 0xc
test eax, eax
jne 0x10022592
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.1001e51b
pop ecx
pop ecx
test eax, eax
jne 0x10022592
push str.Ignore_invalid_deploy_version:
call fcn.10059c4f
lea eax, [ebp]
push eax
call fcn.10059c4f
pop ecx
xor eax, eax
pop ecx
mov word [ebp], ax
jmp 0x100225b9
mov eax, dword [edi]
test eax, eax
je 0x1002259c
mov eax, dword [eax]
jmp 0x1002259e
xor eax, eax
push eax
lea eax, [ebp]
push eax
call fcn.10059c4f
pop ecx
pop ecx
test eax, eax
jle 0x100225b9
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.100015e9
inc ebx
mov dword [ebp - 0x18], 0x800
mov byte [ebp - 4], 1
test esi, esi
je 0x100224d4
mov ecx, esi
call fcn.100016f0
and dword [ebp - 0x14], 0
jmp 0x100224d4
Function at 0x10025d38
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x10067363
call fcn.1003a5de
lea eax, [ebp - 0x1c]
push eax
call fcn.10059c4f
pop ecx
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x10025d60
lock inc dword [esi + 8]
push 0x1007dffc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10025d91
call fcn.100016f0
push 0x1007e014
lea ecx, [ebp - 0x10]
call fcn.1000155e
push 0x1007e018
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.1000155e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10025dcf
call fcn.100016f0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
push 0x1007e01c
lea ecx, [ebp - 0x18]
call fcn.1000155e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10025e08
call fcn.100016f0
push 0x1007e020
lea ecx, [ebp - 0x18]
call fcn.1000155e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10025e31
call fcn.100016f0
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.1003cd40
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x2c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10025e57
mov ecx, dword [esi]
jmp 0x10025e59
xor ecx, ecx
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x10025e64
mov edx, dword [edi]
jmp 0x10025e66
xor edx, edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10025e71
mov eax, dword [eax]
jmp 0x10025e73
xor eax, eax
lea ebx, [ebp - 0x2c]
push ebx
lea ebx, [ebp - 0x70]
push ebx
push ecx
xor ecx, ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x10025ec8
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10025eb8
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.10025c89
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
test edi, edi
je 0x10025ed3
mov ecx, edi
call fcn.100016f0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10025ee1
mov ecx, eax
call fcn.100016f0
test esi, esi
je 0x10025eec
mov ecx, esi
call fcn.100016f0
call fcn.1003a5b8
ret
Function at 0x10025ef2
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100673b6
call fcn.1003a5de
lea eax, [ebp - 0x1c]
push eax
call fcn.10059c4f
pop ecx
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x10025f1a
lock inc dword [esi + 8]
push 0x1007e064
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10025f4b
call fcn.100016f0
push 0x1007e07c
lea ecx, [ebp - 0x10]
call fcn.1000155e
push 0x1007e080
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.1000155e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10025f89
call fcn.100016f0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
push 0x1007e084
lea ecx, [ebp - 0x18]
call fcn.1000155e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10025fc2
call fcn.100016f0
push 0x1007e088
lea ecx, [ebp - 0x18]
call fcn.1000155e
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10025feb
call fcn.100016f0
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.1003cd40
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x2c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10026011
mov ecx, dword [esi]
jmp 0x10026013
xor ecx, ecx
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x1002601e
mov edx, dword [edi]
jmp 0x10026020
xor edx, edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002602b
mov eax, dword [eax]
jmp 0x1002602d
xor eax, eax
lea ebx, [ebp - 0x2c]
push ebx
lea ebx, [ebp - 0x70]
push ebx
push ecx
xor ecx, ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x10026082
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10026072
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.10025c89
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
test edi, edi
je 0x1002608d
mov ecx, edi
call fcn.100016f0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002609b
mov ecx, eax
call fcn.100016f0
test esi, esi
je 0x100260a6
mov ecx, esi
call fcn.100016f0
call fcn.1003a5b8
ret
Function at 0x100260ac
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x100673d9
call fcn.1003a5de
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push 0x2001f
push str.SOFTWAREOracleJavaFX
xor esi, esi
mov dword [ebp - 4], ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
inc esi
call fcn.10059c4f
test eax, eax
jne 0x1002611c
push str.Disabled
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x10026114
cmp edi, 2
je 0x10026114
push ecx
mov ecx, esp
push str.cleanupJavaFXDisabledEntry_error
call fcn.1000155e
push edi
call fcn.100295eb
pop ecx
pop ecx
mov esi, ebx
lea ecx, [ebp - 0x1c]
call fcn.1001ad8c
lea ecx, [ebp - 0x1c]
call fcn.1001ad8c
mov eax, esi
call fcn.1003a5b8
ret

Function at 0x1002612c
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x804
mov eax, dword [0x100bc054]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
push esi
mov ebp, 0x800
lea eax, [esp + 8]
push ebp
push 0
push eax
call fcn.1003cd40
add esp, 0xc
lea eax, [esp + 8]
xor esi, esi
push 0x400
push eax
push esi
jmp 0x100261af
push 0xa
lea eax, [esp + 0xc]
push str.JavaPlugin
push eax
call fcn.10059c4f
add esp, 0xc
test eax, eax
jne 0x10026193
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x814]
call fcn.1001b50c
test eax, eax
je 0x10026194
inc esi
push ebp
lea eax, [esp + 0xc]
push 0
push eax
call fcn.1003cd40
add esp, 0xc
lea eax, [esp + 8]
push 0x400
push eax
push esi
push dword [esp + 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10026166
lea ecx, [esp + 0x810]
call fcn.1001ad8c
mov ecx, dword [esp + 0x808]
pop esi
pop ebp
xor ecx, esp
call fcn.1003a5a7
add esp, 0x804
ret
Function at 0x100294b3
Capabilities:
Delete registry value

Disassembly:
push 0x28
mov eax, 0x10067985
call fcn.1003a5de
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov edi, 0x20019
mov byte [ebp - 4], 1
push edi
push 0x10080e48
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x28]
push ebx
call fcn.10059c4f
test eax, eax
jne 0x100295b4
push edi
push 0x10080e5c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.10059c4f
test eax, eax
jne 0x100295a4
lea eax, [ebp - 0x1c]
push 0x10080e70
push eax
call fcn.1001fdc8
pop ecx
pop ecx
test eax, eax
je 0x10029585
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
push 0x20006
push 0x10080ec8
push ebx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10059c4f
test eax, eax
je 0x10029558
push str.DeleteEmptyDeploymentKeysInHLKM:_failed_to_open_JRE_key
call fcn.10059c4f
jmp 0x1002957c
push str.BrowserJavaVersion
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ecx
mov ecx, esp
mov esi, eax
push str.DeleteEmptyDeploymentKeysInHLKM:_Remove_BrowserJavaVersion_value
call fcn.1000155e
push esi
call fcn.100295eb
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.1001ad8c
lea eax, [ebp - 0x1c]
push str.Java_Web_Start
push eax
call fcn.1001fdc8
lea eax, [ebp - 0x1c]
push str.Java_Web_Start_Caps
push eax
call fcn.1001fdc8
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x10080eb4
push eax
call fcn.1001fdc8
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.1001ad8c
lea ecx, [ebp - 0x28]
call fcn.1001ad8c
call fcn.1003a5b8
ret
Function at 0x1002a2c0
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
mov eax, 0x225c
call fcn.1003a680
mov eax, dword [0x100bc054]
xor eax, esp
mov dword [esp + 0x2258], eax
push ebx
mov ebx, dword [esp + 0x2264]
lea eax, [esp + 0x25c]
push ebp
push esi
push edi
mov esi, 0x1000
xor edi, edi
push esi
push edi
push eax
mov dword [esp + 0x1c], edi
call fcn.1003cd40
push esi
lea eax, [esp + 0x1278]
push edi
push eax
call fcn.1003cd40
mov eax, 0x800
push str.SOFTWAREMozillaMozilla_Firefox
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x288]
push eax
call fcn.10059c4f
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x34]
add esp, 0x24
push eax
lea eax, [esp + 0x26c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x1002a377
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x126c]
push eax
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x100881fc
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
test eax, eax
je 0x1002a392
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x2268]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003a5a7
add esp, 0x225c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0x1268]
push eax
lea eax, [esp + 0x26c]
push 0x10088220
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x26c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x1002a377
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
push ebx
xor ebp, ebp
push ebp
push ebp
push 0x10088194
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
test eax, eax
je 0x1002a3fc
call esi
jmp 0x1002a377
call esi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x1002a403
sub ecx, edx
sar ecx, 1
cmp word [ebx + ecx*2 - 2], 0x5c
je 0x1002a430
lea edi, [ebx - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bp
jne 0x1002a41d
mov eax, dword [0x1008821c]
mov dword [edi], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bp
jne 0x1002a433
push 5
pop ecx
mov esi, str.extensions
lea eax, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
push eax
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x1002a46d
push ebp
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x1002a47f
jmp 0x1002a377
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [esp + 0x18], 0x10
je 0x1002a377
xor eax, eax
inc eax
jmp 0x1002a379