joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001df93
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x814
mov eax, dword [0x10130aa4]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
mov ebx, dword [esp + 0x820]
lea eax, [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x820]
push esi
push edi
xor esi, esi
mov dword [esp + 0x10], ebx
push 0x800
push esi
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.100621d0
add esp, 0xc
lea ecx, [esp + 0x14]
push 0x2001f
push ebx
push dword [ebp]
call fcn.10017b89
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x1001e031
push 0x400
lea eax, [esp + 0x24]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1001e03a
test edi, edi
je 0x1001e01d
push edi
call ebx
mov edi, esi
push dword [esp + 0x10]
mov ecx, ebp
call fcn.100176df
test eax, eax
jne 0x1001e03a
xor esi, esi
inc esi
jmp 0x1001e03a
xor ecx, ecx
inc ecx
cmp eax, 2
cmove esi, ecx
test edi, edi
je 0x1001e041
push edi
call ebx
mov ecx, dword [esp + 0x820]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005e187
add esp, 0x814
ret

Function at 0x1001e05c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 2
push dword [ebp + 0xc]
xor eax, eax
lea ecx, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.10017b89
mov edi, eax
test edi, edi
jne 0x1001e092
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
cmp dword [ebp - 0xc], 0
je 0x1001e0a1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret
Function at 0x1001e165
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100ccf87
call fcn.1005e1c7
lea eax, [ebp - 0x1c]
push eax
call fcn.1001e600
pop ecx
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1001e18d
lock inc dword [esi + 8]
push 0x100e8fec
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x1001e1be
call fcn.10001b13
push 0x100e8dd4
lea ecx, [ebp - 0x10]
call fcn.10001719
push 0x100e8f84
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x1001e1fc
call fcn.10001b13
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
push 0x100e9004
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x1001e235
call fcn.10001b13
push str.__wait__fix__shortcut__silent
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1001e25e
call fcn.10001b13
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.100621d0
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x2c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x1001e284
mov ecx, dword [esi]
jmp 0x1001e286
xor ecx, ecx
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x1001e291
mov edx, dword [edi]
jmp 0x1001e293
xor edx, edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001e29e
mov eax, dword [eax]
jmp 0x1001e2a0
xor eax, eax
lea ebx, [ebp - 0x2c]
push ebx
lea ebx, [ebp - 0x70]
push ebx
push ecx
xor ecx, ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1001e2f5
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001e2e5
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.10029b75
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
test edi, edi
je 0x1001e300
mov ecx, edi
call fcn.10001b13
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001e30e
mov ecx, eax
call fcn.10001b13
test esi, esi
je 0x1001e319
mov ecx, esi
call fcn.10001b13
call fcn.1005e195
ret
Function at 0x1001ed78
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1005e2a0
push 0xffffffffffffffff
push 0x100cd0a6
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x100c]
lea eax, [ebp]
xor ebx, ebx
mov dword [ebp - 0x30], edi
push 0x1000
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
call fcn.100621d0
add esp, 0xc
mov ecx, edi
push 0x100e43ca
call fcn.1000dcc0
xor eax, eax
mov dword [ebp - 0x2c], ebx
inc eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
push str.GetLatestJavawsVersion__:
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0x800
call fcn.100333b3
pop ecx
cmp dword [ebp + 0x1010], ebx
je 0x1001ee1f
mov esi, 0x20219
mov eax, str.___checking_32_bit
jmp 0x1001ee29
mov esi, 0x20119
mov eax, str.___checking_64_bit
push eax
call fcn.100333b3
pop ecx
push esi
push 0x100e60b0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.10017b89
mov ebx, dword [ebp - 0x2c]
test eax, eax
je 0x1001ee85
push str.___failed_to_open_SOFTWAREJavaSoftJava_Web_Start
call fcn.100333b3
pop ecx
test ebx, ebx
je 0x1001ee60
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x1004
leave
ret
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1001ee55
push str.___Processing_key:
lea ecx, [ebp - 0x18]
call fcn.1000dcc0
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10001719
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x18]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x1001eee7
call fcn.10001b13
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x1001eef2
mov eax, dword [esi]
jmp 0x1001eef4
xor eax, eax
push eax
call fcn.100333b3
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.100292d1
add esp, 0xc
test eax, eax
jne 0x1001ef44
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.10028ea9
pop ecx
pop ecx
test eax, eax
jne 0x1001ef44
push 0x100e6178
call fcn.100333b3
lea eax, [ebp]
push eax
call fcn.100333b3
pop ecx
xor eax, eax
pop ecx
mov word [ebp], ax
jmp 0x1001ef6b
mov eax, dword [edi]
test eax, eax
je 0x1001ef4e
mov eax, dword [eax]
jmp 0x1001ef50
xor eax, eax
push eax
lea eax, [ebp]
push eax
call fcn.1001da13
pop ecx
pop ecx
test eax, eax
jle 0x1001ef6b
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.100017b4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], 0x800
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test esi, esi
je 0x1001ee88
mov ecx, esi
call fcn.10001b13
and dword [ebp - 0x18], 0
jmp 0x1001ee85
Function at 0x1001f106
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x100cd172
call fcn.1005e1c7
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
call fcn.1003428b
test eax, eax
je 0x1001f151
call fcn.100344a4
test eax, eax
je 0x1001f143
call fcn.100344d3
test eax, eax
je 0x1001f143
push 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x1001f15d
push 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1001f15d
push 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.__get_system_dir__
lea ecx, [ebp + 8]
mov edi, eax
call fcn.1000dcc0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push esi
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f199
call fcn.10001b13
push 0x100e4ed8
lea ecx, [ebp - 0x10]
call fcn.1000dcc0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 8]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f1c6
call fcn.10001b13
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1001f1d6
lock inc dword [esi + 8]
test edi, edi
setne al
movzx eax, al
push eax
call fcn.1001cdef
pop ecx
pop ecx
test esi, esi
je 0x1001f1f1
mov ecx, esi
call fcn.10001b13
mov eax, edi
call fcn.1005e195
ret
Function at 0x1001f526
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1005e2a0
push 0xffffffffffffffff
push 0x100cd23e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
push 0x20019
push edi
push 0x100e4530
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001f5df
push 0x100e4568
lea ecx, [ebp - 0x10]
call fcn.1000dcc0
push 0x100e45a0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.10001719
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001f5bb
call fcn.10001b13
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1001f5c4
mov edi, dword [esi]
push edi
call fcn.100333b3
pop ecx
test esi, esi
je 0x1001f6e6
mov ecx, esi
call fcn.10001b13
jmp 0x1001f6e6
push 0x1000
lea eax, [ebp]
mov dword [ebp - 0x18], 0x800
push edi
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x100e4584
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001f6db
push str._WebJava_value:
lea ecx, [ebp - 0x14]
call fcn.1000dcc0
lea eax, [ebp]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001f657
call fcn.10001b13
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1001f662
mov eax, dword [esi]
jmp 0x1001f664
mov eax, edi
push eax
call fcn.100333b3
pop ecx
lea ecx, [ebp]
mov eax, 0x100e460c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001f697
test dx, dx
je 0x1001f69c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001f697
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001f673
jmp 0x1001f69c
sbb edi, edi
or edi, 1
test edi, edi
jne 0x1001f6bb
push str._System_WebJava_DISABLED
call fcn.100333b3
pop ecx
test esi, esi
je 0x1001f6b6
mov ecx, esi
call fcn.10001b13
xor eax, eax
inc eax
jmp 0x1001f6e8
test esi, esi
je 0x1001f6db
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001f6db
mov ecx, esi
call fcn.10001b86
push 0xc
push esi
call fcn.1005e174
pop ecx
pop ecx
push str._System_WebJava_ENABLED
call fcn.100333b3
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x1004
leave
ret
Function at 0x1001f70a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1001f7b0
cmp eax, edi
ja 0x1001f7b0
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.100621d0
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x100e5894
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.1001c9e3
add esp, 0x24
test eax, eax
jg 0x1001f78e
push str.LoadSystemLibrary:__snprintf_failed.
jmp 0x1001f7b5
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x1001f7ac
push str.LoadSystemLibrary:_LoadLibrary___failed.
call fcn.100333b3
pop ecx
mov eax, esi
jmp 0x1001f7bd
push str.LoadSystemLibrary:_GetSystemDirectory_failed.
call fcn.100333b3
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005e187
leave
ret
Function at 0x1002193c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.1005e2a0
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1000
xor esi, esi
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.100621d0
add esp, 0xc
mov ebx, 0x800
jmp 0x100219fb
lea eax, [ebp - 0x1004]
push 0x100eafb4
push eax
call fcn.100655df
pop ecx
pop ecx
test eax, eax
je 0x100219bb
lea eax, [ebp - 0x1004]
push str.CAFEEFAC_DEC7_0000_0001_ABCDEFFEDCBA
push eax
call fcn.1008f3e4
pop ecx
pop ecx
test eax, eax
je 0x100219bb
lea eax, [ebp - 0x1004]
push str.CAFEEFAC_DEC7_0000_0000_ABCDEFFEDCBA
push eax
call fcn.1008f3e4
pop ecx
pop ecx
test eax, eax
jne 0x100219ec
lea eax, [ebp - 0x1004]
push 0x100eb080
push eax
call fcn.1008f3e4
pop ecx
pop ecx
test eax, eax
je 0x100219ec
lea eax, [ebp - 0x1004]
push 0x100eb0d0
push eax
call fcn.1008f3e4
pop ecx
pop ecx
test eax, eax
je 0x100219ec
inc esi
jmp 0x100219fb
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp + 8]
call fcn.10017e54
push ebx
lea eax, [ebp - 0x1004]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10021976
lea ecx, [ebp + 8]
call fcn.10017647
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005e187
leave
ret
Function at 0x10022c78
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4
or dword [esp + 4], 0xffffffff
push ebx
mov ebx, dword [esp + 0xac]
test ebx, ebx
jne 0x10022c97
or eax, 0xffffffff
jmp 0x10022e02
call fcn.100337a3
push 0x10
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
pop edx
mov byte [ecx], 0
inc ecx
sub edx, 1
jne 0x10022ca7
push ebp
push esi
push edi
xor esi, esi
call fcn.100342ee
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10022d70
push 0x100e5978
call fcn.100333b3
mov dword [esp], str.AdvAPI32.dll
call fcn.1001f70a
mov esi, eax
pop ecx
test esi, esi
jne 0x10022cec
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_load_advapi32.dll
jmp 0x10022d05
push str.CreateProcessWithTokenW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x10022d14
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_GetProcAddress
call fcn.100333b3
mov ebx, dword [esp + 0x14]
pop ecx
jmp 0x10022df1
push str.RunAsDesktopUser___calling__CreateProcessWithTokenW
call fcn.100333b3
pop ecx
push 0x44
pop ebp
mov ecx, ebp
lea eax, [esp + 0x70]
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x10022d2a
lea eax, [esp + 0x18]
mov dword [esp + 0x70], ebp
push eax
lea eax, [esp + 0x74]
push eax
push edx
push edx
push edx
push dword [esp + 0xd0]
push ebx
mov ebx, dword [esp + 0x2c]
push edx
push ebx
call dword [esp + 0x4c]
test eax, eax
jne 0x10022d69
push str.RunAsDesktopUser:_CreateProcessWithTokenW_failed.
call fcn.100333b3
pop ecx
jmp 0x10022df1
cmp dword [esp + 0x18], 0
jmp 0x10022dce
push 0x100e5be0
call fcn.100333b3
push 0x44
pop ebp
push ebp
lea eax, [esp + 0x34]
push 0
push eax
call fcn.100621d0
add esp, 0x10
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x34], str.winsta0default
push eax
lea eax, [esp + 0x30]
push eax
xor eax, eax
push eax
push eax
push 0x30
push eax
push eax
push eax
push dword [esp + 0xdc]
push ebx
mov ebx, dword [esp + 0x38]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10022dca
push str.RunAsDesktopUser:_CreateProcessAsUser_failed.
jmp 0x10022d5e
cmp dword [esp + 0x18], esi
je 0x10022df1
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x18]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call edi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x100263f2
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100cdcb5
call fcn.1005e1c7
lea eax, [ebp - 0x1c]
push eax
call fcn.1001e600
pop ecx
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1002641a
lock inc dword [esi + 8]
push 0x100e8f6c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x1002644b
call fcn.10001b13
push 0x100e8bfc
lea ecx, [ebp - 0x10]
call fcn.10001719
push 0x100e8c7c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10026489
call fcn.10001b13
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
push 0x100e8d44
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x100264c2
call fcn.10001b13
push 0x100e9008
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100264eb
call fcn.10001b13
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.100621d0
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x2c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10026511
mov ecx, dword [esi]
jmp 0x10026513
xor ecx, ecx
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x1002651e
mov edx, dword [edi]
jmp 0x10026520
xor edx, edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002652b
mov eax, dword [eax]
jmp 0x1002652d
xor eax, eax
lea ebx, [ebp - 0x2c]
push ebx
lea ebx, [ebp - 0x70]
push ebx
push ecx
xor ecx, ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10026582
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10026572
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.10029b75
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
test edi, edi
je 0x1002658d
mov ecx, edi
call fcn.10001b13
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002659b
mov ecx, eax
call fcn.10001b13
test esi, esi
je 0x100265a6
mov ecx, esi
call fcn.10001b13
call fcn.1005e195
ret
Function at 0x10026fa1
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x100cdddf
call fcn.1005e1c7
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 0x2001f
push str.SOFTWAREOracleJavaFX
xor edi, edi
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
inc edi
call fcn.10017b89
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x10027017
push str.Disabled
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test ebx, ebx
je 0x1002700a
cmp ebx, 2
je 0x1002700a
push ecx
mov ecx, esp
push str.cleanupJavaFXDisabledEntry_error
call fcn.10001719
push ebx
call fcn.1001cae2
pop ecx
pop ecx
xor edi, edi
test esi, esi
je 0x10027022
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test esi, esi
je 0x10027022
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.1005e195
ret
Function at 0x10027fa5
Capabilities:
Get file version info

Disassembly:
push 0x24
mov eax, 0x100ce158
call fcn.1005e1c7
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x10028100
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.GetFileVersion_for__
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.1000dcc0
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10001719
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x1002800b
call fcn.10001b13
push str.__FAILED
lea ecx, [ebp - 0x14]
call fcn.1000dcc0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x10028037
call fcn.10001b13
lea ecx, [ebp - 0x14]
cmp esi, 2
jne 0x1002804f
push str.__file_does_not_exist_
call fcn.1000dcc0
mov byte [ebp - 4], 3
jmp 0x100280c9
push 0x100e4c50
call fcn.1000dcc0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10028075
call fcn.10001b13
push 0x13
pop eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x14]
call fcn.1001d194
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100280ab
call fcn.10001b13
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x30]
mov byte [ebp - 4], bl
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x100e4c60
lea ecx, [ebp - 0x14]
call fcn.1000dcc0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100280e1
call fcn.10001b13
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x100280ea
mov ebx, dword [esi]
push ebx
call fcn.100333b3
pop ecx
test esi, esi
je 0x100280fc
mov ecx, esi
call fcn.10001b13
xor eax, eax
jmp 0x10028149
push esi
call fcn.1005e96c
pop ecx
mov edi, eax
push edi
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10028146
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x100e4c64
push edi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
movzx eax, word [edx + 0xa]
mov dword [ecx], eax
movzx eax, word [edx + 8]
mov dword [ecx + 4], eax
movzx eax, word [edx + 0xe]
mov dword [ecx + 8], eax
xor eax, eax
inc eax
call fcn.1005e195
ret