joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404aab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x177c
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1774]
push eax
call fcn.00404b95
lea eax, [ebp - 0x1774]
push eax
push str.tempPath_is__S
call fcn.0040f3f5
add esp, 0xc
lea eax, [ebp - 0x1774]
push edi
push 0
push 0x4418ac
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x404b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4418b0
call fcn.0040f3f5
lea eax, [ebp - 0x1774]
push eax
call fcn.0041f750
add esp, 0xc
test eax, eax
jle 0x404b45
mov al, byte [ebp + eax - 0x1775]
cmp al, 0x5c
je 0x404b45
cmp al, 0x2f
je 0x404b45
lea eax, [ebp - 0x1774]
push 0x441284
push eax
call fcn.0041f660
pop ecx
pop ecx
push esi
push 0
call fcn.004201af
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, esi
push eax
call fcn.00420243
call fcn.00420222
push eax
lea eax, [ebp - 0x1774]
push eax
push str._se4j_d
push edi
call fcn.00403394
add esp, 0x14
pop esi
push edi
push str.tempFile_is__S
call fcn.0040f3f5
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00413c4b
leave
ret
Function at 0x40555f
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
push edi
mov byte [ebp], bl
call fcn.0041f750
pop ecx
test eax, eax
je 0x405597
cmp byte [esp + 0x18], bl
je 0x405588
push edi
call fcn.00420704
pop ecx
push edi
call fcn.00404c23
pop ecx
test al, al
je 0x40559e
mov byte [ebp], 1
xor al, al
pop edi
pop ebp
pop ebx
pop ecx
ret
cmp byte [esp + 0x1c], bl
jne 0x4055ae
cmp byte [esp + 0x20], bl
je 0x40565a
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov dword [esp + 0xc], eax
test eax, eax
jle 0x40565a
push esi
lea esi, [eax + 0xa]
push esi
call fcn.004137f4
pop ecx
push esi
mov ebx, eax
mov byte [esp + 0x2c], 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
pop esi
test eax, eax
je 0x405645
push ebx
call fcn.00404c23
mov byte [ebp], al
pop ecx
test al, al
jne 0x405633
push 0x3f
push ebx
call fcn.004147b0
pop ecx
pop ecx
test eax, eax
jne 0x405633
cmp byte [esp + 0x20], al
je 0x405645
cmp dword [esp + 0xc], 0x1770
jge 0x405645
push ebx
push edi
call fcn.00420470
pop ecx
pop ecx
test eax, eax
je 0x405645
push ebx
push str.using_long_path__S
call fcn.0040f3f5
push ebx
push edi
call fcn.0041f650
add esp, 0x10
jmp 0x405645
cmp byte [ebp], 0
jne 0x405640
cmp byte [esp + 0x1c], 0
je 0x405645
mov byte [esp + 0x24], 0
push 1
push ebx
call fcn.004137e6
cmp byte [esp + 0x2c], 0
pop ecx
pop ecx
je 0x405597
push edi
call fcn.0040580d
pop ecx
jmp 0x405599
Function at 0x405666
Capabilities:
Create directory

Disassembly:
mov eax, 0x2ee4
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x2ee0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2efc]
push esi
push edi
mov edi, dword [esp + 0x2ef8]
push edi
mov byte [ebp], 0
call fcn.0041f337
pop ecx
test eax, eax
je 0x4057f2
cmp byte [esp + 0x2efc], 0
je 0x4056b4
push edi
call fcn.00420255
pop ecx
push edi
call fcn.00404c5e
pop ecx
test al, al
je 0x4056c8
mov byte [ebp], 1
jmp 0x4057f2
xor eax, eax
push 0x176f
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push edi
push 0x20
call dword [sym.imp.KERNEL32.dll_FoldStringW]
test eax, eax
je 0x4057cb
push edi
call fcn.0041f337
mov esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.0041f337
pop ecx
pop ecx
cmp esi, eax
jne 0x4057cb
cmp byte [esp + 0x2f00], 0
je 0x40578a
push 0x2ee0
call fcn.004137f4
mov ebx, eax
mov dword [esp], 0x1770
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push ebx
call fcn.00404c5e
mov byte [ebp], al
pop ecx
test al, al
jne 0x4057c2
push 0x3f
push ebx
call fcn.0041592b
pop ecx
pop ecx
test eax, eax
jne 0x4057c2
push 0x176f
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
push 0x20
call dword [sym.imp.KERNEL32.dll_FoldStringW]
test eax, eax
je 0x405793
push ebx
call fcn.0041f337
mov esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.0041f337
pop ecx
pop ecx
cmp esi, eax
jne 0x405793
push ebx
call fcn.00413d73
pop ecx
push edi
call fcn.004058b9
pop ecx
jmp 0x4057f4
push ebx
call fcn.0041f337
pop ecx
push eax
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0041f337
pop ecx
push eax
lea eax, [esp + 0x1c]
push eax
push str.folding_error2__s__d__s__d
call fcn.0040f3f5
push ebx
call fcn.00413d73
add esp, 0x18
jmp 0x4057f2
push ebx
call fcn.00413d73
pop ecx
jmp 0x4057f2
push edi
call fcn.0041f337
pop ecx
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0041f337
pop ecx
push eax
lea eax, [esp + 0x1c]
push eax
push str.folding_error__s__d__s__d
call fcn.0040f3f5
add esp, 0x14
xor al, al
mov ecx, dword [esp + 0x2ef0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413c4b
add esp, 0x2ee4
ret

Function at 0x40580d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x177c
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
call fcn.004201af
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, esi
push eax
call fcn.00420243
pop ecx
call fcn.00420222
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
lea eax, [ebp - 0x1774]
push 0x441684
push eax
call fcn.00403394
lea eax, [ebp - 0x1774]
push eax
call fcn.0042076e
lea eax, [ebp - 0x1774]
push eax
call fcn.00420704
add esp, 0x1c
pop esi
pop ebx
test eax, eax
jne 0x4058ab
lea eax, [ebp - 0x1774]
push eax
call fcn.00403e71
test al, al
lea eax, [ebp - 0x1774]
pop ecx
push eax
je 0x4058a5
call fcn.0042076e
pop ecx
mov al, 1
jmp 0x4058ad
call fcn.0042076e
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c4b
leave
ret
Function at 0x4058b9
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2eec
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
call fcn.004201af
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, esi
push eax
call fcn.00420243
pop ecx
call fcn.00420222
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
lea eax, [ebp - 0x2ee4]
push str._se4jtw_d_d
push eax
call fcn.00403b2b
lea eax, [ebp - 0x2ee4]
push eax
call fcn.0042027f
lea eax, [ebp - 0x2ee4]
push eax
call fcn.00420255
add esp, 0x1c
pop esi
pop ebx
test eax, eax
jne 0x405957
lea eax, [ebp - 0x2ee4]
push eax
call fcn.00403f2b
test al, al
lea eax, [ebp - 0x2ee4]
pop ecx
push eax
je 0x405951
call fcn.0042027f
pop ecx
mov al, 1
jmp 0x405959
call fcn.0042027f
pop ecx
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c4b
leave
ret

Function at 0x405adf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405b03
cmp dword [ebp - 8], 2
jae 0x405b21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x441300
call fcn.0040f3f5
push str.Internal_Error:_readShort
call fcn.00403a91
add esp, 0xc
mov ax, word [ebp - 4]
leave
ret

Function at 0x405b73
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00405a4a
mov edi, eax
xor ecx, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004137f4
pop ecx
mov ebx, eax
xor eax, eax
pop ecx
push eax
mov word [ebx + esi*2], ax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405bc5
cmp dword [ebp - 4], edi
jae 0x405bd0
push str.Internal_Error:_readWString
call fcn.00403a91
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x405cbb
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x18b4]
mov eax, 0x18b4
call fcn.00413d20
push 0xffffffffffffffff
push 0x43ed1d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x455834]
xor eax, ebp
mov dword [ebp + 0x18b0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18bc]
mov esi, dword [ebp + 0x18c0]
mov ebx, dword [ebp + 0x18c4]
push eax
lea eax, [ebp + 0x140]
push eax
call fcn.0041f650
lea eax, [ebp + 0x140]
push 0x441928
push eax
call fcn.0041f660
add esp, 0x10
cmp byte [esi], 0x2e
je 0x405d43
lea eax, [ebp + 0x140]
push 0x441268
push eax
call fcn.0041f660
pop ecx
pop ecx
lea eax, [ebp + 0x140]
push esi
push eax
call fcn.0041f660
pop ecx
pop ecx
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405d71
xor eax, eax
jmp 0x405e12
lea ecx, [ebp - 0x14]
call fcn.00403cfe
xor esi, esi
mov dword [ebp - 4], esi
push 0x1770
call fcn.00420217
lea ecx, [ebp + 0x2c]
mov dword [ebp - 0x18], eax
push ecx
push eax
call fcn.0041f650
add esp, 0xc
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
call fcn.00403be9
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405d7e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x10]
imul eax, edi, 0x1770
push eax
call fcn.00420217
pop ecx
mov dword [ebx], eax
cmp dword [ebp - 0x10], esi
jbe 0x405df7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebx]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [esi + ecx], eax
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.00403d7d
cmp dword [ebp - 0x10], 0
lea esi, [esi + 4]
ja 0x405dd4
push dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.00403c4a
push 0xc
push dword [ebp - 0x14]
call fcn.004137e6
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x18b0]
xor ecx, ebp
call fcn.00413c4b
add ebp, 0x18b4
leave
ret
Function at 0x4077dd
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1784
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x1780], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1798]
mov ebx, 0x1770
push ebx
call fcn.004137f4
push 0
mov ebp, eax
push 0x442d1a
push ebp
call fcn.00404297
push ebx
call fcn.004137f4
mov esi, eax
push esi
mov dword [esp + 0x34], esi
call fcn.00404b95
push ebp
push str._EXE4J_EXEDIR_
push edi
call fcn.004092ef
push ebp
push str._INSTALL4J_EXEDIR_
push edi
call fcn.004092ef
mov ebx, 0x4623a0
push ebx
push str._EXE4J_TEMPDIR_
push edi
call fcn.004092ef
push ebx
push str._INSTALL4J_TEMPDIR_
push edi
call fcn.004092ef
add esp, 0x48
mov ebx, 0x4410e4
push ebx
push str._EXE4J_PATHLIST_SEPARATOR_
push edi
call fcn.004092ef
push ebx
push str._INSTALL4J_PATHLIST_SEPARATOR_
push edi
call fcn.004092ef
mov ebx, 0x460bb8
push ebx
push str._EXE4J_JVM_HOME_
push edi
call fcn.004092ef
push ebx
push str._INSTALL4J_JVM_HOME_
push edi
call fcn.004092ef
push ebp
push str._EXE4J_EXEDIR
push edi
call fcn.004092ef
push ebp
push str._INSTALL4J_EXEDIR
push edi
call fcn.004092ef
add esp, 0x48
push 0x4623a0
push str._EXE4J_TEMPDIR
push edi
call fcn.004092ef
push 0x4623a0
push str._INSTALL4J_TEMPDIR
push edi
call fcn.004092ef
push 0x4410e4
push str._EXE4J_PATHLIST_SEPARATOR
push edi
call fcn.004092ef
push 0x4410e4
push str._INSTALL4J_PATHLIST_SEPARATOR
push edi
call fcn.004092ef
push ebx
push str._EXE4J_JVM_HOME
push edi
call fcn.004092ef
push ebx
push str._INSTALL4J_JVM_HOME
push edi
call fcn.004092ef
add esp, 0x48
push ebp
push str._launcher:sys.launcherDirectory
push edi
call fcn.004092ef
push 0x4623a0
push str._launcher:sys.launcherTempDirectory
push edi
call fcn.004092ef
push 0x4410e4
push str._launcher:sys.pathlistSeparator
push edi
call fcn.004092ef
push ebx
push str._launcher:sys.jvmHome
push edi
call fcn.004092ef
push esi
push str._launcher:sys.tempDir
push edi
call fcn.004092ef
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [esp + 0x18], eax
test eax, eax
je 0x407a0d
cmp byte [eax], 0
mov ebx, eax
je 0x407a0d
push ebx
call fcn.0041f750
inc eax
push eax
call fcn.004137f4
mov esi, eax
push ebx
push esi
mov dword [esp + 0x24], esi
call fcn.0041f650
push 0x3d
push esi
call fcn.004147b0
add esp, 0x18
mov dword [esp + 0x10], eax
test eax, eax
je 0x4079eb
push esi
mov byte [eax], 0
lea eax, [esp + 0x24]
push 0x442f24
push eax
call fcn.00406607
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
inc esi
push esi
push eax
push edi
call fcn.004092ef
lea eax, [esp + 0x38]
push 0x1770
push eax
call fcn.00425d10
push esi
lea eax, [esp + 0x44]
push eax
push edi
call fcn.004092ef
mov esi, dword [esp + 0x40]
add esp, 0x2c
push ebx
call fcn.0041f750
inc eax
push esi
add ebx, eax
call fcn.00413d73
cmp byte [ebx], 0
pop ecx
pop ecx
jne 0x407978
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00413d73
push ebp
call fcn.00413d73
pop ecx
pop ecx
mov ecx, dword [esp + 0x1790]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413c4b
add esp, 0x1784
ret
Function at 0x407a3b
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1784
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x1780], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1798]
mov esi, 0x1770
push esi
call fcn.004137f4
push 0
mov ebp, eax
push 0x442d1a
push ebp
call fcn.00404297
push esi
call fcn.004137f4
mov esi, eax
push esi
mov dword [esp + 0x34], esi
call fcn.00404b95
push ebp
push str._EXE4J_EXEDIR_
push edi
call fcn.00407651
push ebp
push str._INSTALL4J_EXEDIR_
push edi
call fcn.00407651
mov ebx, 0x4623a0
push ebx
push str._EXE4J_TEMPDIR_
push edi
call fcn.00407651
push ebx
push str._INSTALL4J_TEMPDIR_
push edi
call fcn.00407651
add esp, 0x48
mov ebx, 0x4410e4
push ebx
push str._EXE4J_PATHLIST_SEPARATOR_
push edi
call fcn.00407651
push ebx
push str._INSTALL4J_PATHLIST_SEPARATOR_
push edi
call fcn.00407651
mov ebx, 0x460bb8
push ebx
push str._EXE4J_JVM_HOME_
push edi
call fcn.00407651
push ebx
push str._INSTALL4J_JVM_HOME_
push edi
call fcn.00407651
push ebp
push str._EXE4J_EXEDIR
push edi
call fcn.00407651
push ebp
push str._INSTALL4J_EXEDIR
push edi
call fcn.00407651
add esp, 0x48
push 0x4623a0
push str._EXE4J_TEMPDIR
push edi
call fcn.00407651
push 0x4623a0
push str._INSTALL4J_TEMPDIR
push edi
call fcn.00407651
push 0x4410e4
push str._EXE4J_PATHLIST_SEPARATOR
push edi
call fcn.00407651
push 0x4410e4
push str._INSTALL4J_PATHLIST_SEPARATOR
push edi
call fcn.00407651
push ebx
push str._EXE4J_JVM_HOME
push edi
call fcn.00407651
push ebx
push str._INSTALL4J_JVM_HOME
push edi
call fcn.00407651
add esp, 0x48
push ebp
push str._launcher:sys.launcherDirectory
push edi
call fcn.00407651
push 0x4623a0
push str._launcher:sys.launcherTempDirectory
push edi
call fcn.00407651
push 0x4410e4
push str._launcher:sys.pathlistSeparator
push edi
call fcn.00407651
push ebx
push str._launcher:sys.jvmHome
push edi
call fcn.00407651
push esi
push str._launcher:sys.tempDir
push edi
call fcn.00407651
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [esp + 0x18], eax
test eax, eax
je 0x407c69
cmp byte [eax], 0
mov ebx, eax
je 0x407c69
push ebx
call fcn.0041f750
inc eax
push eax
call fcn.004137f4
mov esi, eax
push ebx
push esi
mov dword [esp + 0x24], esi
call fcn.0041f650
push 0x3d
push esi
call fcn.004147b0
add esp, 0x18
mov dword [esp + 0x10], eax
test eax, eax
je 0x407c44
push esi
mov byte [eax], 0
lea eax, [esp + 0x24]
push 0x442f24
push eax
call fcn.00403394
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
inc esi
push esi
push eax
push edi
call fcn.00407651
lea eax, [esp + 0x38]
push eax
call fcn.00425cb4
push esi
lea eax, [esp + 0x40]
push eax
push edi
call fcn.00407651
mov esi, dword [esp + 0x3c]
add esp, 0x28
push ebx
call fcn.0041f750
inc eax
push 1
push esi
add ebx, eax
call fcn.004137e6
add esp, 0xc
cmp byte [ebx], 0
jne 0x407bd6
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 1
push ebp
call fcn.004137e6
push 1
push esi
call fcn.004137e6
mov ecx, dword [esp + 0x17a0]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413c4b
add esp, 0x1784
ret
Function at 0x40c170
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4668
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x4664], eax
mov eax, dword [esp + 0x467c]
push ebx
mov ebx, dword [esp + 0x4678]
push ebp
mov ebp, dword [esp + 0x4680]
push esi
push edi
mov edi, dword [esp + 0x467c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4690]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push 0x1770
push eax
push 0xa0
call fcn.00401668
mov esi, dword [esp + 0x468c]
lea eax, [esp + 0x30]
push edi
push esi
push eax
push str.checking_app_id__S___d___p_
call fcn.0040f3f5
lea eax, [esp + 0x40]
push eax
call fcn.0041f750
add esp, 0x20
test eax, eax
je 0x40c337
lea eax, [esp + 0x14]
or esi, 0x20019
push eax
push esi
xor esi, esi
push esi
push str.SOFTWAREej_technologiesinstall4jinstallations
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c32a
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1770
push eax
lea eax, [esp + 0x1798]
push eax
lea eax, [esp + 0x28]
push eax
push esi
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c311
cmp dword [esp + 0x10], esi
jbe 0x40c311
lea eax, [esp + 0x1794]
push eax
push str.found_installations:__S
call fcn.0040f3f5
lea eax, [esp + 0x179c]
push 0x4410e4
push eax
call fcn.0041f984
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c31e
mov edi, dword [esp + 0x18]
push esi
call fcn.0041f750
pop ecx
test eax, eax
je 0x40c31e
push esi
lea eax, [esp + 0x2f08]
push str._sjre
push eax
call fcn.00403394
lea eax, [esp + 0x2f10]
push eax
push ebx
call fcn.0040c776
add esp, 0x14
test al, al
je 0x40c2e3
push 1
push 1
push 0
push dword [esp + 0x28]
push edi
push ebp
push ebx
call fcn.0040baf8
add esp, 0x1c
test al, al
jne 0x40c30d
mov eax, str.java_version_did_not_match_in__S
jmp 0x40c2e8
mov eax, str.did_not_find_java_in__S
lea ecx, [esp + 0x2f04]
push ecx
push eax
call fcn.0040f3f5
push 0x4410e4
push 0
call fcn.0041f984
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x40c28c
jmp 0x40c31e
mov al, 1
jmp 0x40c339
push esi
push str.could_not_query_value_node__d
call fcn.0040f3f5
pop ecx
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c337
push eax
push str.could_not_open_installation_node__d
call fcn.0040f3f5
pop ecx
pop ecx
xor al, al
mov ecx, dword [esp + 0x4674]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413c4b
add esp, 0x4668
ret
Function at 0x40c4df
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x14]
push eax
xor ecx, ecx
push 0x20019
push ecx
push dword [esp + 0x44]
mov byte [esp + 0x17], cl
push dword [esp + 0x44]
mov byte [ebx], cl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c695
push ebp
push esi
push edi
mov edi, 0x1770
push edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.004137f4
push edi
mov dword [esp + 0x24], eax
call fcn.004137f4
mov ebp, eax
push edi
mov dword [esp + 0x38], ebp
call fcn.004137f4
push edi
mov esi, eax
call fcn.004137f4
add esp, 0x10
mov edi, eax
lea eax, [esp + 0x34]
xor ecx, ecx
mov dword [esp + 0x24], ecx
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x24]
push ecx
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebp
push ecx
push dword [esp + 0x3c]
mov dword [esp + 0x50], eax
call eax
jmp 0x40c658
mov byte [esi], 0
push ebp
mov byte [edi], 0
call fcn.0041f750
pop ecx
lea edx, [eax + 1]
test edx, edx
jle 0x40c5b9
mov ebx, ebp
mov ebp, esi
sub ebx, esi
cmp byte [ebx + ebp], 0x2f
movzx ecx, byte [ebx + ebp]
mov dword [esp + 0x28], 0x5c
cmove ecx, dword [esp + 0x28]
mov byte [ebp], cl
inc ebp
sub edx, 1
jne 0x40c593
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x2c]
push str.i4j_jres
push esi
call fcn.004156c0
test eax, eax
pop ecx
setne al
cmp byte [esp + 0x5c], 0
pop ecx
je 0x40c5d6
test al, al
je 0x40c5e1
cmp byte [esp + 0x5c], 0
je 0x40c623
test al, al
je 0x40c623
push 1
push 1
push 1
push dword [esp + 0x60]
push dword [esp + 0x60]
push edi
push esi
call fcn.0040baf8
add esp, 0x1c
test al, al
je 0x40c623
push ebx
push edi
call fcn.0040dafa
pop ecx
pop ecx
test al, al
je 0x40c623
push edi
push ebx
call fcn.0041f650
push esi
push dword [esp + 0x54]
call fcn.0041f650
add esp, 0x10
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x24]
mov ecx, 0x1770
mov dword [esp + 0x14], ecx
inc eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
push ecx
push dword [esp + 0x24]
lea ecx, [esp + 0x24]
push 0
push ecx
push ebp
push eax
push dword [esp + 0x3c]
call dword [esp + 0x50]
cmp eax, 0x103
jne 0x40c579
xor ebx, ebx
inc ebx
push ebx
push esi
call fcn.004137e6
push ebx
push edi
call fcn.004137e6
push ebx
push dword [esp + 0x30]
call fcn.004137e6
push ebx
push ebp
call fcn.004137e6
add esp, 0x20
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, byte [esp + 7]
pop ebx
add esp, 0x2c
ret
Function at 0x40c69e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x177c
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x1778], eax
mov ecx, dword [esp + 0x178c]
mov eax, dword [esp + 0x1788]
push ebp
mov ebp, dword [esp + 0x1788]
push edi
mov edi, dword [esp + 0x1788]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1798]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
push 0x1770
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40c75d
push ebx
push esi
lea eax, [esp + 0x18]
xor esi, esi
push eax
call fcn.0041f750
pop ecx
test eax, eax
je 0x40c727
cmp byte [esp + esi + 0x18], 0x2f
jne 0x40c717
mov byte [esp + esi + 0x18], 0x5c
lea eax, [esp + 0x18]
inc esi
push eax
call fcn.0041f750
pop ecx
cmp esi, eax
jb 0x40c70b
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040c776
pop ecx
pop ecx
test al, al
je 0x40c755
xor ebx, ebx
inc ebx
push ebx
push ebx
push 0
push dword [esp + 0x1c]
push dword [esp + 0x24]
push ebp
push edi
call fcn.0040baf8
add esp, 0x1c
test al, al
jne 0x40c757
xor bl, bl
pop esi
mov al, bl
pop ebx
jmp 0x40c75f
xor al, al
mov ecx, dword [esp + 0x1780]
pop edi
pop ebp
xor ecx, esp
call fcn.00413c4b
add esp, 0x177c
ret