joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001dfe7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x10066330
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x100c]
xor eax, eax
mov ebx, dword [ebp + 0x1018]
push 0x1000
push eax
lea eax, [ebp]
push eax
call fcn.1003cd40
add esp, 0xc
mov dword [ebp - 0x14], 0x800
mov edi, 0x20019
test ebx, ebx
je 0x1001e067
xor edx, edx
mov eax, 0x100
cmp dword [ebx], edx
mov ecx, 0x200
cmovne eax, ecx
or edi, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
push edi
cmp dword [ebp + 0x1014], eax
je 0x1001e08b
push 0x1008182c
jmp 0x1001e0a7
push str.SOFTWAREJavaSoftJRE
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1004cb7f
test eax, eax
je 0x1001e0c4
push edi
push 0x100818c8
lea ecx, [ebp - 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1004cb7f
test eax, eax
je 0x1001e0c4
lea ecx, [ebp - 0x20]
call fcn.1001ad8c
xor eax, eax
jmp 0x1001e1f0
xor ecx, ecx
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ecx
push eax
lea eax, [ebp]
push eax
push ecx
jmp 0x1001e17b
cmp dword [ebp + 0x1014], 0
je 0x1001e124
lea eax, [ebp]
push ebx
push eax
call fcn.1001e51b
pop ecx
pop ecx
test eax, eax
je 0x1001e107
lea eax, [ebp]
push ebx
push eax
call fcn.1001e865
pop ecx
pop ecx
test eax, eax
jne 0x1001e124
push 0x10081920
call fcn.1004cb7f
lea eax, [ebp]
push eax
call fcn.1004cb7f
pop ecx
xor eax, eax
pop ecx
mov word [ebp], ax
jmp 0x1001e128
mov ax, word [ebp]
test ax, ax
je 0x1001e15b
cmp dword [ebp - 0x10], 0
je 0x1001e143
lea eax, [ebp]
push esi
push eax
call fcn.1004cb7f
pop ecx
pop ecx
test eax, eax
jle 0x1001e15b
lea eax, [ebp]
push eax
push 0x10081960
push dword [ebp + 0x1010]
push esi
call fcn.1000758d
add esp, 0x10
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
push ecx
inc eax
mov dword [ebp - 0x14], 0x800
xor ecx, ecx
mov dword [ebp - 0x10], eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp]
push ecx
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
je 0x1001e0de
cmp dword [ebp + 0x1014], 0
je 0x1001e19e
push str.Latest_deploy_version:
jmp 0x1001e1a3
push str.Latest_JRE_version:
call fcn.1004cb7f
pop ecx
push esi
call fcn.1004cb7f
pop ecx
test edi, edi
je 0x1001e1bc
cmp edi, 0x103
jne 0x1001e1c1
xor edx, edx
inc edx
jmp 0x1001e1c4
mov edx, dword [ebp - 0x24]
lea ecx, [esi + 2]
xor edi, edi
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x1001e1c9
sub esi, ecx
lea ecx, [ebp - 0x20]
sar esi, 1
push 0
pop esi
cmovne esi, edx
call fcn.1001ad8c
lea ecx, [ebp - 0x20]
call fcn.1001ad8c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
Function at 0x1001f5c2
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x810
mov eax, dword [0x100bc054]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
mov ebx, dword [esp + 0x818]
lea eax, [esp + 8]
push ebp
push eax
push 0x20019
xor ebp, ebp
push ebp
push 0x10081e48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001f6d9
push esi
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x1c]
mov esi, ebp
push eax
lea eax, [esp + 0x2c]
push eax
push ebp
jmp 0x1001f6b4
mov eax, ebp
mov ecx, ebp
cmp dword [esp + 0xc], eax
jbe 0x1001f6a4
cmp word [esp + ecx*2 + 0x18], 0x2e
jne 0x1001f633
inc eax
cmp eax, 1
jg 0x1001f63f
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x1001f625
cmp eax, 1
jle 0x1001f6a4
push 0x10081dc4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
js 0x1001f6a4
lea eax, [esp + 0x18]
push eax
call fcn.1002eaf4
pop ecx
test eax, eax
je 0x1001f6a4
mov eax, dword [esp + 0xc]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004cb7f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
push ecx
mov ecx, dword [esp + 0x14]
push 0x10081ea0
inc ecx
push ecx
push eax
call fcn.1000758d
add esp, 0x14
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.10029a3d
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x1c]
inc esi
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1001f61b
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x814]
pop ebp
pop ebx
xor ecx, esp
call fcn.1003a5a7
add esp, 0x810
ret

Function at 0x1001fdc8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x790]
sub esp, 0x810
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x78c], eax
push ebx
mov ebx, dword [ebp + 0x79c]
lea eax, [ebp - 0x74]
push esi
push edi
mov edi, dword [ebp + 0x798]
xor esi, esi
push 0x800
push esi
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
call fcn.1003cd40
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x2001f
push ebx
push dword [edi]
call fcn.1004cb7f
test eax, eax
jne 0x1001fe51
push 0x400
lea eax, [ebp - 0x74]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1001fe5a
lea ecx, [ebp - 0x80]
call fcn.1001ad8c
push ebx
mov ecx, edi
call fcn.1001ae15
test eax, eax
jne 0x1001fe5a
inc esi
jmp 0x1001fe5a
xor ecx, ecx
inc ecx
cmp eax, 2
cmove esi, ecx
lea ecx, [ebp - 0x80]
call fcn.1001ad8c
mov ecx, dword [ebp + 0x78c]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a5a7
add ebp, 0x790
leave
ret
Function at 0x1001fe7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x1006670f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
push 0x20019
push edi
push 0x10082fb8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001ff35
push str._Cannot_open_registry_key
lea ecx, [ebp - 0x14]
call fcn.10012712
push 0x10083030
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001ff11
call fcn.100016f0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1001ff1a
mov edi, dword [esi]
push edi
call fcn.1004cb7f
pop ecx
test esi, esi
je 0x10020027
mov ecx, esi
call fcn.100016f0
jmp 0x10020027
push 0x1000
lea eax, [ebp]
mov dword [ebp - 0x18], 0x800
push edi
push eax
call fcn.1003cd40
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x100830a0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002001c
push str._WebJava_value:
lea ecx, [ebp - 0x10]
call fcn.10012712
lea eax, [ebp]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001ffad
call fcn.100016f0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1001ffb8
mov eax, dword [esi]
jmp 0x1001ffba
mov eax, edi
push eax
call fcn.1004cb7f
pop ecx
lea ecx, [ebp]
mov eax, 0x100830f4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001ffed
test dx, dx
je 0x1001fff2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001ffed
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001ffc9
jmp 0x1001fff2
sbb edi, edi
or edi, 1
test edi, edi
jne 0x10020011
push str._System_WebJava_DISABLED
call fcn.1004cb7f
pop ecx
test esi, esi
je 0x1002000c
mov ecx, esi
call fcn.100016f0
xor eax, eax
inc eax
jmp 0x10020029
test esi, esi
je 0x1002001c
mov ecx, esi
call fcn.100016f0
push str._System_WebJava_ENABLED
call fcn.1004cb7f
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
Function at 0x100200b6
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x10066747
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 0x1000
push eax
mov dword [ebp - 4], eax
lea eax, [ebp]
push eax
call fcn.1003cd40
call fcn.1004cb7f
push edx
push eax
push 0x100833bc
lea eax, [ebp]
push 0x800
push eax
call fcn.1000758d
add esp, 0x20
lea ecx, [ebp - 0x20]
mov edi, 0x2001f
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push edi
push 0x100833d4
push ebx
call fcn.1004cb7f
mov esi, eax
cmp esi, 2
jne 0x1002015a
push str._setSystemWebJavaEnabled:_OK_regkey_does_not_exists
call fcn.1004cb7f
pop ecx
jmp 0x10020177
push ecx
mov ecx, esp
push str._setSystemWebJavaEnabled:_open_JavaDeploy_subkey
call fcn.1000155e
push esi
call fcn.100295eb
pop ecx
pop ecx
test eax, eax
je 0x10020238
push 0x10083518
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
xor eax, eax
push ecx
cmp esi, 2
mov ecx, esp
push str._setSystemWebJavaEnabled:_delete_WebDeployJava
cmove esi, eax
call fcn.1000155e
push esi
call fcn.100295eb
pop ecx
pop ecx
test eax, eax
je 0x10020238
push edi
lea eax, [ebp]
push eax
push 0x100835c4
push 0x1008360c
push ebx
call fcn.1001d942
add esp, 0x14
lea ecx, [ebp - 0x10]
mov esi, eax
push 0x10083650
call fcn.1000155e
push ecx
mov ecx, dword [ebp - 0x10]
mov edx, esp
mov byte [ebp - 4], 1
mov dword [edx], ecx
test ecx, ecx
je 0x100201e7
lock inc dword [ecx + 8]
push esi
call fcn.100295eb
push edi
push 0x100836b4
push 0x100836cc
push 0x10083710
push ebx
call fcn.1001d942
add esp, 0x1c
lea ecx, [ebp - 0x10]
mov edi, eax
push str.___Create_HKLM_webjavaswitch_status_enabled
call fcn.100015e9
mov esi, dword [ebp - 0x10]
push ecx
mov ecx, esp
mov dword [ecx], esi
test esi, esi
je 0x10020225
lock inc dword [esi + 8]
push edi
call fcn.100295eb
pop ecx
pop ecx
test esi, esi
je 0x10020238
mov ecx, esi
call fcn.100016f0
lea ecx, [ebp - 0x20]
call fcn.1001ad8c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
Function at 0x100203c0
Capabilities:
Get file version info

Disassembly:
push 0x24
mov eax, 0x100667df
call fcn.1003a5de
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x1002051b
call dword [sym.imp.kernel32.dll_GetLastError]
push str.GetFileVersion_for__
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.10012712
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.1000155e
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x10020426
call fcn.100016f0
push str.__FAILED
lea ecx, [ebp - 0x14]
call fcn.10012712
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x10020452
call fcn.100016f0
lea ecx, [ebp - 0x14]
cmp esi, 2
jne 0x1002046a
push str.__file_does_not_exist_
call fcn.10012712
mov byte [ebp - 4], 3
jmp 0x100204e4
push 0x10083cf8
call fcn.10012712
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10020490
call fcn.100016f0
push 0x13
pop eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x14]
call fcn.1000575b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100204c6
call fcn.100016f0
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x30]
mov byte [ebp - 4], bl
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x10083d10
lea ecx, [ebp - 0x14]
call fcn.10012712
mov byte [ebp - 4], 7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001697
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100204fc
call fcn.100016f0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x10020505
mov ebx, dword [esi]
push ebx
call fcn.1004cb7f
pop ecx
test esi, esi
je 0x10020517
mov ecx, esi
call fcn.100016f0
xor eax, eax
jmp 0x10020564
push esi
call fcn.1004cb7f
pop ecx
mov edi, eax
push edi
push esi
push 0
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x10020561
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x10083d34
push edi
call sub.version.dll_VerQueryValueW
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
movzx eax, word [edx + 0xa]
mov dword [ecx], eax
movzx eax, word [edx + 8]
mov dword [ecx + 4], eax
movzx eax, word [edx + 0xe]
mov dword [ecx + 8], eax
xor eax, eax
inc eax
call fcn.1003a5b8
ret
Function at 0x10020be0
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x100668dd
call fcn.1003a5de
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
call fcn.1002da2a
test eax, eax
je 0x10020c2b
call fcn.1004cb7f
test eax, eax
je 0x10020c1d
call fcn.1004cb7f
test eax, eax
je 0x10020c1d
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
jmp 0x10020c37
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x10020c37
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push str.__get_system_dir__
lea ecx, [ebp + 8]
mov edi, eax
call fcn.10012712
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push esi
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10020c73
call fcn.100016f0
push 0x10084470
lea ecx, [ebp - 0x10]
call fcn.10012712
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 8]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10020ca0
call fcn.100016f0
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10020cb0
lock inc dword [esi + 8]
test edi, edi
setne al
movzx eax, al
push eax
call fcn.10029854
pop ecx
pop ecx
test esi, esi
je 0x10020ccb
mov ecx, esi
call fcn.100016f0
mov eax, edi
call fcn.1003a5b8
ret
Function at 0x10021c65
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4
or dword [esp + 4], 0xffffffff
push ebx
mov ebx, dword [esp + 0xac]
test ebx, ebx
jne 0x10021c84
or eax, 0xffffffff
jmp 0x10021def
call fcn.1002e262
push 0x10
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
pop edx
mov byte [ecx], 0
inc ecx
sub edx, 1
jne 0x10021c94
push ebp
push esi
push edi
xor esi, esi
call fcn.1002db30
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x10021d5d
push str.RunAsDesktopUser___OnVistaOrLater__use_CreateProcessWithTokenW
call fcn.1004cb7f
mov dword [esp], str.AdvAPI32.dll
call fcn.1004cb7f
mov esi, eax
pop ecx
test esi, esi
jne 0x10021cd9
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_load_advapi32.dll
jmp 0x10021cf2
push str.CreateProcessWithTokenW
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x10021d01
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_GetProcAddress
call fcn.1004cb7f
mov ebx, dword [esp + 0x14]
pop ecx
jmp 0x10021dde
push str.RunAsDesktopUser___calling__CreateProcessWithTokenW
call fcn.1004cb7f
pop ecx
push 0x44
pop ebp
mov ecx, ebp
lea eax, [esp + 0x70]
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x10021d17
lea eax, [esp + 0x18]
mov dword [esp + 0x70], ebp
push eax
lea eax, [esp + 0x74]
push eax
push edx
push edx
push edx
push dword [esp + 0xd0]
push ebx
mov ebx, dword [esp + 0x2c]
push edx
push ebx
call dword [esp + 0x4c]
test eax, eax
jne 0x10021d56
push str.RunAsDesktopUser:_CreateProcessWithTokenW_failed.
call fcn.1004cb7f
pop ecx
jmp 0x10021dde
cmp dword [esp + 0x18], 0
jmp 0x10021dbb
push str.RunAsDesktopUser___OnWinXP__use_CreateProcessAsUser
call fcn.1004cb7f
push 0x44
pop ebp
push ebp
lea eax, [esp + 0x34]
push 0
push eax
call fcn.1003cd40
add esp, 0x10
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x34], str.winsta0default
push eax
lea eax, [esp + 0x30]
push eax
xor eax, eax
push eax
push eax
push 0x30
push eax
push eax
push eax
push dword [esp + 0xdc]
push ebx
mov ebx, dword [esp + 0x38]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10021db7
push 0x100852d8
jmp 0x10021d4b
cmp dword [esp + 0x18], esi
je 0x10021dde
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [esp + 0x18]
call edi
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call edi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x100223c9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x10066c75
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x100c]
lea eax, [ebp]
xor ebx, ebx
mov dword [ebp - 0x2c], edi
push 0x1000
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
call fcn.1003cd40
add esp, 0xc
mov ecx, edi
push 0x1007d9e6
call fcn.10012712
xor eax, eax
mov dword [ebp - 0x24], ebx
inc eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
push str.GetLatestJavawsVersion__:
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x800
call fcn.1004cb7f
pop ecx
cmp dword [ebp + 0x1010], ebx
je 0x1002246d
mov esi, 0x20219
push str.___checking_32_bit
jmp 0x10022477
mov esi, 0x20119
push str.___checking_64_bit
call fcn.1004cb7f
pop ecx
push esi
push str.SOFTWAREJavaSoftJava_Web_Start
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x24]
call fcn.1004cb7f
test eax, eax
je 0x100224d4
push str.___failed_to_open_SOFTWAREJavaSoftJava_Web_Start
call fcn.1004cb7f
pop ecx
lea ecx, [ebp - 0x24]
call fcn.1001ad8c
lea ecx, [ebp - 0x24]
call fcn.1001ad8c
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1002249f
push str.___Processing_key:
lea ecx, [ebp - 0x14]
call fcn.10012712
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x10022535
call fcn.100016f0
and dword [ebp - 0x10], 0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10022540
mov eax, dword [esi]
jmp 0x10022542
xor eax, eax
push eax
call fcn.1004cb7f
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.1001e865
add esp, 0xc
test eax, eax
jne 0x10022592
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.1001e51b
pop ecx
pop ecx
test eax, eax
jne 0x10022592
push str.Ignore_invalid_deploy_version:
call fcn.1004cb7f
lea eax, [ebp]
push eax
call fcn.1004cb7f
pop ecx
xor eax, eax
pop ecx
mov word [ebp], ax
jmp 0x100225b9
mov eax, dword [edi]
test eax, eax
je 0x1002259c
mov eax, dword [eax]
jmp 0x1002259e
xor eax, eax
push eax
lea eax, [ebp]
push eax
call fcn.1004cb7f
pop ecx
pop ecx
test eax, eax
jle 0x100225b9
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.100015e9
inc ebx
mov dword [ebp - 0x18], 0x800
mov byte [ebp - 4], 1
test esi, esi
je 0x100224d4
mov ecx, esi
call fcn.100016f0
and dword [ebp - 0x14], 0
jmp 0x100224d4
Function at 0x10025c89
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x108c]
mov eax, 0x110c
call fcn.1003a680
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1088], eax
lea eax, [ebp - 0x80]
push eax
push 0x1000
lea eax, [ebp - 0x7c]
push eax
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x10025d23
mov eax, dword [ebp - 0x80]
shr eax, 2
push esi
xor esi, esi
mov dword [ebp - 0x80], eax
test eax, eax
je 0x10025d22
push edi
push dword [ebp + esi*4 - 0x7c]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp + 0xf84]
push 0x104
push eax
push edi
call sub.psapi.dll_GetProcessImageFileNameA
lea eax, [ebp + 0xf84]
push 0x1007dfec
push eax
call fcn.1003eb70
pop ecx
pop ecx
test eax, eax
je 0x10025d14
push 0
push edi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x80]
jb 0x10025ccf
pop edi
pop esi
mov ecx, dword [ebp + 0x1088]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x108c
leave
ret