joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031ba9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1005e2a0
push 0xffffffffffffffff
push 0x100cf264
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.1005e144
pop ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [ebp - 4], edi
test eax, eax
je 0x10031c05
mov ecx, eax
call fcn.10031445
mov ebx, eax
jmp 0x10031c07
mov ebx, edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
push eax
call fcn.10031a66
pop ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
push 0x20019
push edi
push 0x100fbc58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x10031d7f
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp]
push eax
push edi
jmp 0x10031d5e
cmp dword [ebp - 0x10], 0
mov eax, edi
mov ecx, edi
jbe 0x10031d4a
cmp word [ebp + ecx*2], 0x2e
jne 0x10031c72
inc eax
cmp eax, 1
jg 0x10031c81
inc ecx
cmp ecx, dword [ebp - 0x10]
jb 0x10031c64
cmp eax, 1
jle 0x10031d4a
lea eax, [ebp]
push 0x100fbc4c
push eax
call fcn.1008f3e4
pop ecx
pop ecx
test eax, eax
js 0x10031d4a
lea eax, [ebp]
push eax
call fcn.10039eff
pop ecx
test al, al
je 0x10031d4a
push 0x10
call fcn.1005e144
pop ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10031ccc
push edi
lea ecx, [ebp]
push ecx
mov ecx, eax
call fcn.10031462
mov edi, eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.1002d275
test al, al
je 0x10031d48
test esi, esi
je 0x10031d3e
cmp dword [esi], 0
je 0x10031cee
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
jmp 0x10031cf0
xor eax, eax
test eax, eax
je 0x10031d3e
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10031cff
mov ecx, dword [ecx]
jmp 0x10031d01
xor ecx, ecx
test esi, esi
je 0x10031d09
mov eax, dword [esi]
jmp 0x10031d0b
xor eax, eax
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10031d31
test dx, dx
je 0x10031d2d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10031d31
add eax, 4
add ecx, 4
test dx, dx
jne 0x10031d0b
xor eax, eax
jmp 0x10031d36
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10031d3e
mov byte [edi + 0xc], 1
push edi
push dword [ebx]
mov ecx, ebx
call fcn.10031394
xor edi, edi
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push edi
push edi
push edi
push edi
push ecx
lea ecx, [ebp]
inc eax
push ecx
mov dword [ebp - 0x18], eax
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10031c56
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10031d8a
mov ecx, esi
call fcn.10001b13
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x1004
leave
ret
Function at 0x10031f88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
or dword [ebp - 8], 0xffffffff
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x800
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10031fd2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x10032a19
Capabilities:
Get memory capacity

Disassembly:
push esi
push 0x40
mov esi, ecx
push 0
push esi
call fcn.100621d0
add esp, 0xc
mov dword [esi], 0x40
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, esi
pop esi
ret

Function at 0x10032f48
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100cf341
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x208], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10100044
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1008a969
add esp, 0xc
test eax, eax
jne 0x10033039
push dword [ebp - 0x18]
call fcn.1006f635
cmp dword [0x101335a8], 0
pop ecx
je 0x10032fb7
xor eax, eax
inc eax
jmp 0x1003303b
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x10033039
test eax, eax
je 0x10033039
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10001719
xor edi, edi
lea ecx, [ebp - 0x10]
push str.JavaDeployReg.log
mov dword [ebp - 4], edi
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10033009
call fcn.10001b13
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10033012
mov edi, dword [esi]
push 0x101000f0
push edi
push 0x101335a8
call fcn.1008b681
add esp, 0xc
neg eax
sbb edi, edi
test esi, esi
je 0x10033034
mov ecx, esi
call fcn.10001b13
lea eax, [edi + 1]
jmp 0x1003303b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x20c
leave
ret
Function at 0x10033422
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100334a8
cmp eax, edi
ja 0x100334a8
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.100621d0
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x100ffaa8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100334aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005e187
leave
ret

Function at 0x100334cf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.100621d0
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x14]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x28], ax
xor edi, edi
lea eax, [ebp - 4]
inc edi
push eax
push 0x2000000
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10033567
cmp dword [ebp + 8], ebx
je 0x10033567
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000008
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x10033567
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
jmp 0x10033569
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003369d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100cf395
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x214]
xor eax, eax
xor esi, esi
mov dword [ebp - 4], esi
mov word [ebx], ax
lea eax, [ebp]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
js 0x10033789
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10001719
mov eax, dword [eax]
test eax, eax
je 0x10033716
mov esi, dword [eax]
push 0x104
push esi
push dword [ebp + 0x218]
push ebx
call fcn.1008ab60
mov ecx, dword [ebp - 0x14]
add esp, 0x10
test ecx, ecx
je 0x1003375f
call fcn.10001b13
jmp 0x1003375f
xor eax, eax
test edi, edi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x20c
leave
ret
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.1003856f
pop ecx
pop ecx
push esi
push edi
call fcn.10060fc0
int3

Function at 0x10033a75
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100cf3bf
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x214]
xor eax, eax
xor esi, esi
mov dword [ebp - 4], esi
mov word [ebx], ax
lea eax, [ebp]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
js 0x10033b61
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10001719
mov eax, dword [eax]
test eax, eax
je 0x10033aee
mov esi, dword [eax]
push 0x104
push esi
push dword [ebp + 0x218]
push ebx
call fcn.1008ab60
mov ecx, dword [ebp - 0x14]
add esp, 0x10
test ecx, ecx
je 0x10033b37
call fcn.10001b13
jmp 0x10033b37
xor eax, eax
test edi, edi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x20c
leave
ret
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.1003856f
pop ecx
pop ecx
push esi
push edi
call fcn.10060fc0
int3
Function at 0x10033fe7
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1040
call fcn.1005e2a0
mov eax, dword [0x10130aa4]
xor eax, esp
mov dword [esp + 0x103c], eax
push ebx
push ebp
push esi
push edi
push 0x1000
xor ebx, ebx
lea eax, [esp + 0x50]
push ebx
push eax
call fcn.100621d0
add esp, 0xc
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x4c]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x10034194
call fcn.100344d3
test eax, eax
lea eax, [esp + 0x4c]
push eax
je 0x10034117
lea ecx, [esp + 0x14]
call fcn.10001719
push str._system32javaws.exe
lea ecx, [esp + 0x18]
call fcn.10001719
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.1000186b
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1003407c
call fcn.10001b13
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Wow64DisableWow64FsRedirection
push 0x100fef9c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push 0x100fefd0
mov ebp, eax
call edi
push eax
call esi
mov esi, dword [esp + 0x10]
mov edi, eax
test ebp, ebp
je 0x10034106
test edi, edi
je 0x10034106
lea eax, [esp + 0x18]
push eax
call ebp
test eax, eax
je 0x10034106
test esi, esi
je 0x100340c7
mov ebx, dword [esi]
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.1008d780
pop ecx
pop ecx
push dword [esp + 0x18]
test eax, eax
jne 0x10034104
call edi
test esi, esi
je 0x1003416f
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1003416f
mov ecx, esi
call fcn.10001b86
push 0xc
push esi
call fcn.1005e174
pop ecx
pop ecx
jmp 0x1003416f
call edi
test esi, esi
je 0x10034194
mov ecx, esi
call fcn.10001b13
jmp 0x10034194
lea ecx, [esp + 0x18]
call fcn.10001719
push str._sysWow64javaws.exe
lea ecx, [esp + 0x14]
call fcn.10001719
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.1000186b
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10034149
call fcn.10001b13
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10034153
mov ebx, dword [esi]
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.1008d780
pop ecx
pop ecx
test eax, eax
jne 0x10034174
test esi, esi
je 0x1003416f
mov ecx, esi
call fcn.10001b13
xor eax, eax
inc eax
jmp 0x10034196
test esi, esi
je 0x10034194
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10034194
mov ecx, esi
call fcn.10001b86
push 0xc
push esi
call fcn.1005e174
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x104c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005e187
add esp, 0x1040
ret
Function at 0x100342ee
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x94], eax
cmp dword [0x101335bc], 0
je 0x10034319
mov eax, dword [0x101335c0]
jmp 0x1003435e
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.100621d0
add esp, 0xc
mov dword [ebp - 0x80], 0x114
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x70], 2
jne 0x10034350
cmp dword [ebp - 0x7c], 6
jb 0x10034350
mov esi, eax
mov dword [0x101335bc], eax
mov eax, esi
mov dword [0x101335c0], esi
pop esi
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x98
leave
ret

Function at 0x100344a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 9
pop esi
xor eax, eax
lea edi, [ebp - 0x24]
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], si
pop edi
sete al
pop esi
leave
ret

Function at 0x100349e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100349f0
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret

Function at 0x10034c29
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10034c4d
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
ret
Function at 0x10035690
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x3014
call fcn.1005e2a0
mov eax, dword [0x10130aa4]
xor eax, esp
mov dword [esp + 0x3010], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3024]
lea eax, [esp + 0x1c]
push edi
mov ebp, 0x1000
xor ebx, ebx
push ebp
push ebx
push eax
mov edi, ebx
call fcn.100621d0
push ebp
lea eax, [esp + 0x1030]
push ebx
push eax
call fcn.100621d0
add esp, 0x18
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
push 0x10101b50
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10035809
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x34]
call ebp
test eax, eax
jne 0x10035809
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x20]
push eax
push 0x10101ba8
push 0x10101c00
lea eax, [esp + 0x102c]
push 0x800
push eax
call fcn.1000af1e
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea eax, [esp + 0x102c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100357df
push 0x1000
push eax
lea eax, [esp + 0x2028]
push eax
call fcn.100621d0
add esp, 0xc
mov dword [esp + 0x10], 0x800
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2024]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x10101c0c
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x100357df
cmp dword [esp + 0x10], eax
jbe 0x100357df
mov eax, dword [esp + 0x302c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push 0x10101c24
push dword [esp + 0x28]
call ebx
xor eax, eax
mov dword [esp + 0x10], 0x800
push eax
push eax
push eax
push eax
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call ebp
test eax, eax
je 0x1003572e
xor ebx, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x1003580c
sub esi, ecx
xor eax, eax
mov ecx, dword [esp + 0x3020]
sar esi, 1
cmp eax, esi
pop edi
pop esi
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.1005e187
add esp, 0x3014
ret
Function at 0x10035890
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x2b0
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push ebx
push 0x208
xor ebx, ebx
lea eax, [ebp + 0x24]
push ebx
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [ebp + 0x24]
push eax
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x100358da
xor eax, eax
jmp 0x100359d1
push esi
push edi
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0xc]
call fcn.1000d933
push str.JavaJava_Updatejucheck.exe
mov ecx, eax
call fcn.100355b1
push eax
lea ecx, [ebp - 0x24]
call fcn.1000d878
lea ecx, [ebp - 0xc]
call fcn.10013862
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push 0x22
push eax
call fcn.10034fc7
add esp, 0xc
mov esi, eax
mov ecx, esi
push 0x22
call fcn.10015011
push esi
lea ecx, [ebp + 0xc]
call fcn.1000d878
lea ecx, [ebp - 0xc]
call fcn.10013862
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.100621d0
xor eax, eax
mov dword [ebp - 0x80], esi
lea edi, [ebp - 0x3c]
add esp, 0xc
cmp dword [ebp + 0x20], 8
lea ecx, [ebp + 0xc]
stosd dword es:[edi], eax
lea edx, [ebp - 0x25]
cmovae ecx, dword [ebp + 0xc]
push edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
lea eax, [ecx + eax*2]
lea ecx, [ebp + 0xc]
cmovae ecx, dword [ebp + 0xc]
push eax
push ecx
lea ecx, [ebp]
call fcn.10034f52
lea eax, [ebp - 0x2a]
mov dword [ebp - 0x2a], ebx
push eax
lea ecx, [ebp]
call fcn.100350ab
cmp dword [ebp - 0x10], 8
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push ebx
push 0x8000000
push 1
push ebx
push ebx
push dword [ebp]
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call fcn.100349e3
add esp, 0x28
neg eax
sbb esi, esi
lea ecx, [ebp]
neg esi
call fcn.1003557d
lea ecx, [ebp + 0xc]
call fcn.10013862
lea ecx, [ebp - 0x24]
call fcn.10013862
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
pop ebx
call fcn.1005e187
add ebp, 0x230
leave
ret

Function at 0x10035af3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
xor esi, esi
inc edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
call fcn.1008a987
pop ecx
test eax, eax
je 0x10035b29
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100897cc
add esp, 0xc
test eax, eax
jne 0x10035b48
mov eax, edi
jmp 0x10035b74
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push dword [0x101307a0]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10035b4c
xor eax, eax
jmp 0x10035b74
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
cmove esi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x10035b78
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x2010
call fcn.1005e2a0
mov eax, dword [0x10130aa4]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
mov ebx, dword [esp + 0x2018]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x2028]
mov ebp, 0x1000
xor esi, esi
mov dword [esp + 0x18], 1
push ebp
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.100621d0
push ebp
lea eax, [esp + 0x102c]
push esi
push eax
call fcn.100621d0
push ebx
call fcn.1008a987
add esp, 0x1c
test eax, eax
je 0x10035c11
push eax
push dword [esp + 0x2030]
push edi
call fcn.100897cc
add esp, 0xc
test eax, eax
je 0x10035daa
xor eax, eax
mov ecx, dword [esp + 0x201c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005e187
add esp, 0x2010
ret
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push dword [0x1013079c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10035bf6
lea eax, [esp + 0x202c]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10035d8e
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x10101d1c
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10035c8c
xor esi, esi
inc esi
jmp 0x10035d8e
push dword [esp + 0x10]
call ebp
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10035c84
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x1020]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push str.deployment.modified.timestamp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10035c84
mov dword [esp + 0x14], 0x800
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x101c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10035d18
test dx, dx
je 0x10035d14
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10035d18
add eax, 4
add ecx, 4
test dx, dx
jne 0x10035cf2
mov eax, esi
jmp 0x10035d1d
sbb eax, eax
or eax, 1
test eax, eax
js 0x10035daa
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10035c84
push dword [esp + 0x10]
call ebp
call fcn.10034e11
test eax, eax
jne 0x10035daa
lea eax, [esp + 0x10]
push eax
push 0x20006
push esi
push dword [0x1013079c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10035bf6
push dword [esp + 0x14]
push edi
push 1
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10035d9b
push dword [esp + 0x10]
call ebp
mov eax, esi
jmp 0x10035bf8
push dword [esp + 0x10]
call ebp
push edi
push ebx
call fcn.10035eaf
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x10035bf8