joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405919
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x18b4]
mov eax, 0x18b4
call fcn.0040ede0
push 0xffffffffffffffff
push 0x4271b6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x18b0], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18bc]
mov edi, dword [ebp + 0x18c0]
mov esi, dword [ebp + 0x18c4]
push eax
lea eax, [ebp + 0x140]
push eax
call fcn.0040ecd0
lea eax, [ebp + 0x140]
push 0x4291b4
push eax
call fcn.0040ece0
add esp, 0x10
cmp byte [edi], 0x2e
je 0x4059a0
lea eax, [ebp + 0x140]
push 0x428e34
push eax
call fcn.0040ece0
pop ecx
pop ecx
lea eax, [ebp + 0x140]
push edi
push eax
call fcn.0040ece0
pop ecx
pop ecx
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4059ce
xor eax, eax
jmp 0x405a67
lea ecx, [ebp - 0x2c]
call fcn.004057a1
and dword [ebp - 4], 0
push 0x1770
call fcn.0041073c
lea ecx, [ebp + 0x2c]
push ecx
push eax
mov dword [ebp - 0x10], eax
call fcn.0040ecd0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004058f0
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4059da
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
imul eax, eax, 0x1770
push eax
call fcn.0041073c
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [esi], eax
jbe 0x405a53
xor edi, edi
lea ecx, [ebp - 0x2c]
call fcn.00405664
mov ecx, dword [esi]
mov eax, dword [eax]
mov dword [edi + ecx], eax
lea ecx, [ebp - 0x2c]
call fcn.004057d8
add edi, 4
cmp dword [ebp - 0x14], 0
ja 0x405a33
lea ecx, [ebp - 0x2c]
call fcn.0040557a
push dword [ebp - 0x2c]
call fcn.0040eb88
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x18b0]
xor ecx, ebp
call fcn.0040edc8
add ebp, 0x18b4
leave
ret
Function at 0x408a5c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1778
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push edi
push str.SOFTWAREej_technologiesexe4jjvms_
push eax
lea eax, [ebp - 0x1774]
push eax
call fcn.00408a13
add esp, 0xc
xor edi, edi
push edi
lea eax, [ebp - 0x1778]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp - 0x1774]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x408afc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 8
lea eax, [ebp + 0xc]
push eax
push 3
push edi
push str.LastWriteTime
push dword [ebp - 0x1778]
call esi
push ebx
call fcn.0040e8b0
pop ecx
push eax
push ebx
push 1
push edi
push str.Version
push dword [ebp - 0x1778]
call esi
push dword [ebp - 0x1778]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040edc8
leave
ret

Function at 0x408b0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1708]
mov eax, 0x1788
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x1704], eax
mov eax, dword [ebp + 0x1710]
push ebx
push esi
mov esi, dword [ebp + 0x171c]
push str.SOFTWAREej_technologiesexe4jjvms_
push eax
lea eax, [ebp - 0x74]
push eax
xor bl, bl
call fcn.00408a13
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408c41
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x16fc]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.LastWriteTime
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 8
call edi
test eax, eax
jne 0x408c37
cmp dword [ebp - 0x78], 8
jne 0x408c37
push 8
lea eax, [ebp + 0x1714]
push eax
lea eax, [ebp + 0x16fc]
push eax
call fcn.004117c4
add esp, 0xc
test eax, eax
jne 0x408c37
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x80]
push eax
push 0
push str.Version
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 0x1770
call edi
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x408c37
mov eax, dword [ebp - 0x78]
cmp eax, 1
jae 0x408bf7
mov byte [esi], 0
jmp 0x408c02
add eax, esi
cmp byte [eax - 1], 0
je 0x408c02
mov byte [eax], 0
push str.1.7.
push esi
call fcn.00410200
pop ecx
pop ecx
test eax, eax
je 0x408c35
push str.1.6.
push esi
call fcn.00410200
pop ecx
pop ecx
test eax, eax
je 0x408c35
push str.1.5.
push esi
call fcn.00410200
pop ecx
pop ecx
test eax, eax
jne 0x408c37
xor bl, bl
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x1704]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040edc8
add ebp, 0x1708
leave
ret
Function at 0x408f0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408f54
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
Function at 0x408fdd
Capabilities:
Query environment variable
Set environment variable

Disassembly:
sub esp, 0xdc
mov eax, dword [0x431920]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
push esi
push edi
push 0x7d0
call fcn.0040e75d
mov esi, str.javaw.exe
push esi
mov edi, eax
call fcn.0040e8b0
pop ecx
pop ecx
push esi
mov ebp, ebx
push ebx
sub ebp, eax
call fcn.0040e8b0
pop ecx
add eax, ebp
push eax
call fcn.00410200
pop ecx
pop ecx
test eax, eax
jne 0x409032
push esi
jmp 0x409037
push str.java.exe
call fcn.0040e8b0
or ebp, 0xffffffff
push ebx
sub ebp, eax
call fcn.0040e8b0
pop ecx
mov esi, eax
pop ecx
add esi, ebp
push esi
push ebx
push edi
call fcn.0040eba0
push edi
mov byte [esi + edi], 0
call fcn.0040d7a8
mov ebx, 0x5dc0
push ebx
mov dword [esp + 0x30], eax
call fcn.0040e75d
push ebx
mov esi, eax
call fcn.0040e75d
add esp, 0x18
push 0x2ee0
mov ebp, eax
push ebp
mov ebx, str.PATH
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebp
push esi
call fcn.0040ecd0
push 0x428cc4
push esi
call fcn.0040ece0
push edi
push esi
call fcn.0040ece0
add esp, 0x18
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x4090c4
push esi
push str.Setting_PATH__S
call fcn.0040be55
pop ecx
pop ecx
jmp 0x4090d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Setting_PATH__S_failed_with_error__d
call fcn.0040be55
add esp, 0xc
push 0x5dc6
call fcn.0040e75d
push esi
push str.PATH_s
push eax
mov dword [esp + 0x24], eax
call fcn.0040f861
push dword [esp + 0x24]
call fcn.00413161
and dword [esp + 0x24], 0
push 0xc8
lea eax, [esp + 0x38]
push eax
push 0x98
call fcn.004037d0
lea eax, [esp + 0x40]
push eax
call fcn.0040e8b0
add esp, 0x24
test eax, eax
jbe 0x409137
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00408f59
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], str.hotspot
cmp dword [esp + 0x10], 0
jne 0x4091c0
mov eax, dword [esp + 0x18]
push dword [eax]
push edi
call fcn.00408f59
add dword [esp + 0x20], 4
cmp dword [esp + 0x20], 0x42a834
pop ecx
pop ecx
mov dword [esp + 0x10], eax
jl 0x40913f
test eax, eax
jne 0x4091c0
push dword [esp + 0x1c]
call fcn.0040d837
pop ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x409190
push ebp
push str.Setting_PATH__S
call fcn.0040be55
pop ecx
pop ecx
jmp 0x4091a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Setting_PATH__S_failed_with_error__d
call fcn.0040be55
add esp, 0xc
push ebp
push str.PATH_s
push dword [esp + 0x1c]
call fcn.0040f861
push dword [esp + 0x20]
call fcn.00413161
add esp, 0x10
push esi
call fcn.0040eb88
push ebp
call fcn.0040eb88
push dword [esp + 0x1c]
call fcn.0040eb88
push edi
call fcn.0040eb88
mov ecx, dword [esp + 0xf8]
mov eax, dword [esp + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040edc8
add esp, 0xdc
ret
Function at 0x40a4a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x45f0]
mov eax, 0x4670
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x45ec], eax
mov eax, dword [ebp + 0x4600]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x4604]
push ebx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x4608]
push esi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x460c]
push edi
mov edi, dword [ebp + 0x45f8]
mov dword [ebp - 0x7c], eax
mov ebx, 0x1770
push ebx
lea eax, [ebp - 0x64]
push eax
push 0xa0
call fcn.004037d0
mov esi, dword [ebp + 0x45fc]
push edi
push esi
lea eax, [ebp - 0x64]
push eax
push str.checking_app_id__S___d___p_
call fcn.0040be55
lea eax, [ebp - 0x64]
push eax
call fcn.0040e8b0
add esp, 0x20
test eax, eax
je 0x40a657
lea eax, [ebp - 0x68]
push eax
or esi, 0x20019
push esi
xor esi, esi
push esi
push str.SOFTWAREej_technologiesinstall4jinstallations
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x40a64a
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x2e7c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a632
cmp dword [ebp - 0x70], esi
jbe 0x40a632
lea eax, [ebp + 0x2e7c]
push eax
push str.found_installations:__S
call fcn.0040be55
mov ebx, 0x428cc4
lea eax, [ebp + 0x2e7c]
push ebx
push eax
call fcn.0040f6e0
add esp, 0x10
jmp 0x40a622
push edi
call fcn.0040e8b0
pop ecx
test eax, eax
je 0x40a63f
push edi
lea eax, [ebp + 0x170c]
push str._sjre
push eax
call fcn.0040f861
lea eax, [ebp + 0x170c]
push eax
push dword [ebp - 0x6c]
call fcn.00408972
add esp, 0x14
test al, al
je 0x40a606
push 1
push esi
push dword [ebp - 0x7c]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
call fcn.0040a2dd
add esp, 0x18
test al, al
jne 0x40a62e
lea eax, [ebp + 0x170c]
push eax
push str.java_version_did_not_match_in__S
jmp 0x40a612
lea eax, [ebp + 0x170c]
push eax
push str.did_not_find_java_in__S
call fcn.0040be55
pop ecx
pop ecx
push ebx
push esi
call fcn.0040f6e0
pop ecx
pop ecx
mov edi, eax
cmp edi, esi
jne 0x40a5a6
jmp 0x40a63f
mov al, 1
jmp 0x40a659
push esi
push str.could_not_query_value_node__d
call fcn.0040be55
pop ecx
pop ecx
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a657
push eax
push str.could_not_open_installation_node__d
call fcn.0040be55
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp + 0x45ec]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040edc8
add ebp, 0x45f0
leave
ret
Function at 0x40a89a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x177c
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x177c], ecx
push 0x1770
lea ecx, [ebp - 0x1774]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40a95d
and dword [ebp - 0x1778], 0
lea eax, [ebp - 0x1774]
push eax
call fcn.0040e8b0
pop ecx
test eax, eax
jbe 0x40a928
mov eax, dword [ebp - 0x1778]
lea eax, [ebp + eax - 0x1774]
cmp byte [eax], 0x2f
jne 0x40a90d
mov byte [eax], 0x5c
inc dword [ebp - 0x1778]
lea eax, [ebp - 0x1774]
push eax
call fcn.0040e8b0
pop ecx
cmp dword [ebp - 0x1778], eax
jb 0x40a8f8
lea eax, [ebp - 0x1774]
push eax
push esi
call fcn.00408972
pop ecx
pop ecx
test al, al
je 0x40a959
push 1
push 0
push dword [ebp - 0x177c]
push ebx
push edi
push esi
call fcn.0040a2dd
add esp, 0x18
test al, al
je 0x40a959
xor eax, eax
inc eax
jmp 0x40a95f
xor eax, eax
jmp 0x40a95f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040edc8
leave
ret
Function at 0x40ad72
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
push ebx
mov byte [eax], 0
lea eax, [ebp - 0x20]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREej_technologiesexe4jlocatedjvms_
push dword [ebp + 8]
mov byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40aee8
push esi
mov esi, 0x1770
push edi
push esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0040e75d
push esi
mov dword [ebp - 0x1c], eax
call fcn.0040e75d
push esi
mov dword [ebp - 0xc], eax
call fcn.0040e75d
push esi
mov edi, eax
call fcn.0040e75d
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push ebx
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40aeac
mov eax, dword [ebp - 8]
push dword [ebp - 0xc]
mov byte [edi], 0
mov byte [eax], 0
call fcn.0040e8b0
inc eax
pop ecx
test eax, eax
jle 0x40ae2f
mov edx, dword [ebp - 0xc]
mov ecx, edi
sub edx, edi
mov dword [ebp - 0x24], eax
mov al, byte [edx + ecx]
cmp al, 0x2f
jne 0x40ae27
mov byte [ecx], 0x5c
jmp 0x40ae29
mov byte [ecx], al
inc ecx
dec dword [ebp - 0x24]
jne 0x40ae1b
cmp byte [ebp + 0x1c], 0
jne 0x40ae46
push str.i4j_jres
push edi
call fcn.00410920
pop ecx
pop ecx
test eax, eax
je 0x40ae8c
push 1
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push edi
call fcn.0040a2dd
add esp, 0x18
test al, al
je 0x40ae8c
push dword [ebp + 0x10]
push dword [ebp - 8]
call fcn.0040a203
pop ecx
pop ecx
test al, al
je 0x40ae8c
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.0040ecd0
push edi
push dword [ebp + 0xc]
call fcn.0040ecd0
add esp, 0x10
mov byte [ebp - 1], 1
inc dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x20]
call ebx
cmp eax, 0x103
jne 0x40adfa
push edi
call fcn.0040eb88
push dword [ebp - 8]
call fcn.0040eb88
push dword [ebp - 0x1c]
call fcn.0040eb88
push dword [ebp - 0xc]
call fcn.0040eb88
add esp, 0x10
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x40b517
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x4310c4]
mov dword [ebp - 4], 0x4310c4
jmp 0x40b579
mov eax, dword [ebp - 4]
mov edi, dword [eax]
push edi
call fcn.0040e8b0
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040e75d
pop ecx
pop ecx
test esi, esi
jle 0x40b55b
mov ecx, eax
sub edi, eax
mov edx, esi
mov bl, byte [edi + ecx]
xor bl, 0xbb
mov byte [ecx], bl
inc ecx
dec edx
jne 0x40b54f
push esi
push eax
push dword [ebp + 8]
mov byte [eax + esi], 0
call fcn.0040f7a1
add esp, 0xc
test eax, eax
je 0x40b58a
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.0040e8b0
pop ecx
test eax, eax
ja 0x40b52d
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov al, 1
jmp 0x40b585

Function at 0x40b6d5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x40b705
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
movsx edi, byte [edx]
mov eax, dword [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4310c8]
inc edx
dec esi
mov dword [ecx], eax
jne 0x40b6e7
pop edi
pop esi
ret
Function at 0x40bb9a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x465c
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
cmp dword [0x440064], esi
jne 0x40bbee
push 0x18
call fcn.0040ef93
mov edx, eax
pop ecx
cmp edx, esi
je 0x40bbdc
push 6
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [0x440064], edx
jmp 0x40bbe2
mov dword [0x440064], esi
push dword [0x440064]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push dword [0x440064]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x440060]
cmp eax, esi
je 0x40bc1d
cmp dword [0x44005c], esi
jne 0x40bc1d
push str.a_ccsUTF_8
push eax
call fcn.004108cc
pop ecx
pop ecx
mov dword [0x44005c], eax
cmp byte [0x440058], 0
jne 0x40bdd1
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
mov bl, byte [0x441823]
mov edi, 0x1770
push edi
lea eax, [ebp - 0x1774]
push eax
push str.EXE4J_LOG
mov byte [0x440058], 1
call esi
test eax, eax
jbe 0x40bc6f
lea eax, [ebp - 0x1774]
push 0x42afd4
push eax
call fcn.00410200
pop ecx
pop ecx
test eax, eax
jne 0x40bc6f
mov bl, 1
push edi
lea eax, [ebp - 0x1774]
push eax
push str.INSTALL4J_LOG
call esi
test eax, eax
jbe 0x40bc9b
lea eax, [ebp - 0x1774]
push 0x42afd4
push eax
call fcn.00410200
pop ecx
pop ecx
test eax, eax
jne 0x40bc9b
mov bl, 1
test bl, bl
pop ebx
je 0x40bdd1
mov edi, 0x2ee0
push edi
call fcn.0040e75d
mov esi, eax
xor eax, eax
push eax
push esi
mov word [esi], ax
call fcn.00405025
push esi
call fcn.0040f07b
add esp, 0x10
test eax, eax
jne 0x40bcd7
push 0x42afbc
push esi
call fcn.0040f5ea
jmp 0x40bcf3
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
je 0x40bcf5
cmp ax, 0x2f
je 0x40bcf5
push 0x4296a0
push esi
call fcn.0040f5bc
pop ecx
pop ecx
push edi
call fcn.0040e75d
pop ecx
mov dword [0x440060], eax
xor edi, edi
inc edi
push edi
push esi
push str._si4j_nlog__d.log
push dword [0x440060]
call fcn.0040bb24
push dword [0x440060]
call fcn.00404749
add esp, 0x14
test al, al
je 0x40bd30
cmp edi, 0x3e8
jl 0x40bd03
push esi
call fcn.0040eb88
mov esi, str.w_ccsUTF_8
push esi
push dword [0x440060]
call fcn.004108cc
add esp, 0xc
mov dword [0x44005c], eax
test eax, eax
jne 0x40bd6f
mov eax, str.c:i4j_nlog
push esi
push eax
mov dword [0x440060], eax
call fcn.004108cc
pop ecx
pop ecx
mov dword [0x44005c], eax
test eax, eax
je 0x40bdd1
push 0x1770
lea eax, [ebp - 0x4654]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x465c]
push eax
call fcn.00410186
lea eax, [ebp - 0x465c]
push eax
call fcn.0041369e
push eax
lea eax, [ebp - 0x4654]
push eax
push str.Started_executable__s_at__S_n
push dword [0x44005c]
call fcn.004137f4
push dword [0x44005c]
call fcn.0040fc07
add esp, 0x1c
call fcn.0040bb3a
mov dword [0x440068], eax
mov dword [0x44006c], edx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040edc8
leave
ret
Function at 0x40beae
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x16fc]
mov eax, 0x177c
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x16f8], eax
push esi
xor esi, esi
push esi
call fcn.004047a2
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00405359
add esp, 0xc
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREej_technologiesexe4jpids_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40bf2d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 4
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x16f8]
xor ecx, ebp
pop esi
call fcn.0040edc8
add ebp, 0x16fc
leave
ret

Function at 0x40bf43
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1704]
mov eax, 0x1784
call fcn.0040ede0
mov eax, dword [0x431920]
xor eax, ebp
mov dword [ebp + 0x1700], eax
push edi
xor edi, edi
push edi
call fcn.004047a2
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00405359
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push edi
push str.SOFTWAREej_technologiesexe4jpids_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bfcd
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40bfc4
cmp dword [ebp - 0x78], 4
jne 0x40bfc4
mov edi, dword [ebp - 0x7c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1700]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0040edc8
add ebp, 0x1704
leave
ret

Function at 0x40c282
Capabilities:
Create mailslot
Create thread

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040c01f
pop ecx
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, eax
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push esi
mov edi, eax
call fcn.0040eb88
pop ecx
cmp edi, 0xffffffff
jne 0x40c2c0
push str.creating_mailslot_failed
call fcn.0040be55
pop ecx
jmp 0x40c2db
push str.creating_mailslot_successful
call fcn.0040be55
pop ecx
push ebx
push ebx
push edi
push 0x40c05a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret
Function at 0x40c2df
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
call fcn.0040c01f
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call fcn.0040f07b
pop ecx
pop ecx
test eax, eax
jne 0x40c305
mov dword [ebp + 0xc], str.__i4j_empty_command_line
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 0
mov ebx, 0x80
push ebx
push 3
push 0
push 1
mov edi, 0x40000000
push edi
push dword [ebp - 0xc]
call esi
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40c378
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
cmp eax, 0x32
jge 0x40c35d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebx
push 3
push 0
push 1
push edi
push dword [ebp - 0xc]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40c333
cmp dword [ebp - 4], 0xffffffff
jne 0x40c378
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_mailslot_CreateFile__d
call fcn.0040be55
pop ecx
pop ecx
jmp 0x40c3d0
push dword [ebp + 0xc]
call fcn.0040f07b
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
add esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c3b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_mailslot_WriteFile__d
call fcn.0040be55
pop ecx
pop ecx
jmp 0x40c3c7
cmp dword [ebp - 8], esi
je 0x40c3c7
push esi
push dword [ebp - 8]
push str.error_mailslot_WriteFile_length__d__d
call fcn.0040be55
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call fcn.0040eb88
pop ecx
pop edi
pop esi
pop ebx
leave
ret