joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f1ed
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x100463b8
call fcn.10021546
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001f27b
call fcn.10021514
test eax, eax
jne 0x1001f211
xor eax, eax
jmp 0x1001f347
call fcn.10020948
test eax, eax
jne 0x1001f221
call fcn.10021532
jmp 0x1001f20a
call fcn.100214c8
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10193274], eax
call fcn.100264e3
mov dword [0x101913dc], eax
call fcn.100264e3
test eax, eax
jns 0x1001f24b
call fcn.10020621
jmp 0x1001f21a
call fcn.100264e3
test eax, eax
js 0x1001f274
call fcn.10021100
test eax, eax
js 0x1001f274
push 0
call fcn.100264e3
pop ecx
test eax, eax
jne 0x1001f274
inc dword [0x101913d8]
jmp 0x1001f344
call fcn.100210ad
jmp 0x1001f244
xor edi, edi
cmp eax, edi
jne 0x1001f2da
cmp dword [0x101913d8], edi
jle 0x1001f20a
dec dword [0x101913d8]
mov dword [ebp - 4], edi
cmp dword [0x10191744], edi
jne 0x1001f29f
call fcn.10020e3b
cmp dword [ebp + 0x10], edi
jne 0x1001f2b3
call fcn.100210ad
call fcn.10020621
call fcn.10021532
mov dword [ebp - 4], 0xfffffffe
call fcn.1001f2c6
jmp 0x1001f344
cmp eax, 2
jne 0x1001f338
call fcn.100205ed
push 0x214
push 1
call fcn.100264e3
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1001f20a
push esi
push dword [0x1004a940]
push dword [0x10191724]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x1001f32c
push edi
push esi
call fcn.10020662
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1001f344
push esi
call fcn.100264e3
pop ecx
jmp 0x1001f20a
cmp eax, 3
jne 0x1001f344
push edi
call fcn.100264e3
pop ecx
xor eax, eax
inc eax
call fcn.1002158b
ret 0xc

Function at 0x1001f4a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a900]
jne 0x1001fc43
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10191500], eax
mov dword [0x101914fc], ecx
mov dword [0x101914f8], edx
mov dword [0x101914f4], ebx
mov dword [0x101914f0], esi
mov dword [0x101914ec], edi
mov word [0x10191518], ss
mov word [0x1019150c], cs
mov word [0x101914e8], ds
mov word [0x101914e4], es
mov word [0x101914e0], fs
mov word [0x101914dc], gs
pushfd
pop dword [0x10191510]
mov eax, dword [ebp]
mov dword [0x10191504], eax
mov eax, dword [ebp + 4]
mov dword [0x10191508], eax
lea eax, [ebp + 8]
mov dword [0x10191514], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10191450], 0x10001
mov eax, dword [0x10191508]
mov dword [0x10191404], eax
mov dword [0x101913f8], 0xc0000409
mov dword [0x101913fc], 1
mov eax, dword [0x1004a900]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1004a904]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10191448], eax
push 1
call fcn.10022bfb
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10003a64
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10191448], 0
jne 0x1001fd2f
push 1
call fcn.10022bfb
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x100264e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100264f2
pop dword [ebp - 0x4c]
mov eax, 0x4c6fa406
add eax, 0xc392c0ec
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x428be
push 0
mov eax, 0xea5b14f8
add eax, 0x25a4fc88
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xefacc4d8
add ecx, 0x10538a48
xor edi, edi
add edi, eax
mov edx, 0x4bd6fbf1
sub edx, 0x3bbd03f1
add edx, dword [ebp - 0x4c]
mov esi, 0x11a54139
xor dword [ebp - 4], 0x7a80c570
mov ebx, dword [edx]
add dword [ebp - 0x48], eax
xor ebx, esi
xor dword [ebp - 0x44], 0xb9c3de5c
mov dword [edi], ebx
add edi, 0x1d5cfd0
sub edi, 0x1d5cfcc
add edx, 0xef7cd17c
add edx, 0x10832e88
loop 0x1002654d
add eax, 0x1f53445a
sub eax, 0x1f521507
xor ebx, ebx
add ebx, eax
add eax, 0xa7d51d74
sub eax, 0xa7d51d6f
mov ecx, 0x41f98aa1
add ecx, 0xce06755f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x10033620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x10033636
push dword [esi + 0x34]
call fcn.100264e3
mov dword [esi + 0x34], ebx
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033646
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x44], ebx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10033656
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x48], ebx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10033666
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x50], ebx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10033676
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x4c], ebx
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x10033686
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x54], ebx
push edi
push 7
lea edi, [esi + 0x58]
pop ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x1003369c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [edi], 0
add edi, 4
dec ebx
jne 0x1003368d
mov ecx, dword [esi + 0x7c]
pop edi
test ecx, ecx
je 0x100336b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x7c], ebx
jmp 0x100336b7
xor ebx, ebx
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x100336c7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x78], ebx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x100336d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x264], ebx
cmp dword [esi + 0x260], ebx
je 0x100336f1
mov dword [esi + 0x260], ebx
mov eax, dword [esi + 0x2d4]
test eax, eax
je 0x10033708
push eax
call fcn.100264e3
pop ecx
mov dword [esi + 0x2d4], ebx
mov eax, dword [esi + 0x150]
test eax, eax
je 0x1003371f
push eax
call fcn.100264e3
pop ecx
mov dword [esi + 0x150], ebx
mov ecx, esi
pop esi
pop ebx
Function at 0x6d691090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x6d6910a0
push 3
pop eax
jmp 0x6d69124d
cmp byte [eax + 3], 0
jbe 0x6d6910aa
push 8
jmp 0x6d69109a
movzx ecx, word [eax]
mov edx, 0xa4
cmp cx, dx
jb 0x6d691098
mov word [0x6d6e1a00], cx
mov cx, word [eax + 2]
mov word [0x6d6e1a02], cx
mov ecx, dword [eax + 0x3c]
mov dword [0x6d6e1a3c], ecx
mov ecx, dword [eax + 4]
mov dword [0x6d6e1a04], ecx
mov ecx, dword [eax + 0x40]
mov dword [0x6d6e1a40], ecx
mov ecx, dword [eax + 8]
mov dword [0x6d6e1a08], ecx
mov ecx, dword [eax + 0xc]
mov dword [0x6d6e1a0c], ecx
mov ecx, dword [eax + 0x10]
mov dword [0x6d6e1a10], ecx
mov ecx, dword [eax + 0x14]
mov dword [0x6d6e1a14], ecx
mov ecx, dword [eax + 0x18]
mov dword [0x6d6e1a18], ecx
mov ecx, dword [eax + 0x1c]
mov dword [0x6d6e1a1c], ecx
mov ecx, dword [eax + 0x20]
mov dword [0x6d6e1a20], ecx
mov ecx, dword [eax + 0x24]
mov dword [0x6d6e1a24], ecx
mov ecx, dword [eax + 0x28]
mov dword [0x6d6e1a28], ecx
mov ecx, dword [eax + 0x2c]
mov dword [0x6d6e1a2c], ecx
mov ecx, dword [eax + 0x30]
mov dword [0x6d6e1a30], ecx
mov ecx, dword [eax + 0x34]
mov dword [0x6d6e1a34], ecx
mov ecx, dword [eax + 0x38]
mov dword [0x6d6e1a38], ecx
mov ecx, dword [eax + 0x44]
mov dword [0x6d6e1a44], ecx
mov ecx, dword [eax + 0x48]
mov dword [0x6d6e1a48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [0x6d6e1a4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [0x6d6e1a50], ecx
mov ecx, dword [eax + 0x54]
mov dword [0x6d6e1a54], ecx
mov ecx, dword [eax + 0x58]
mov dword [0x6d6e1a58], ecx
mov ecx, dword [eax + 0x5c]
mov dword [0x6d6e1a5c], ecx
mov ecx, dword [eax + 0x60]
mov dword [0x6d6e1a60], ecx
mov ecx, dword [eax + 0x64]
mov dword [0x6d6e1a64], ecx
mov ecx, dword [eax + 0x68]
mov dword [0x6d6e1a68], ecx
mov ecx, dword [eax + 0x6c]
mov dword [0x6d6e1a6c], ecx
mov ecx, dword [eax + 0x70]
mov dword [0x6d6e1a70], ecx
mov ecx, dword [eax + 0x74]
mov dword [0x6d6e1a74], ecx
mov ecx, dword [eax + 0x78]
mov dword [0x6d6e1a78], ecx
mov ecx, dword [eax + 0x7c]
mov dword [0x6d6e1a7c], ecx
mov ecx, dword [eax + 0x80]
mov dword [0x6d6e1a80], ecx
mov ecx, dword [eax + 0x84]
mov dword [0x6d6e1a84], ecx
mov ecx, dword [eax + 0x88]
mov dword [0x6d6e1a88], ecx
mov ecx, dword [eax + 0x8c]
mov dword [0x6d6e1a8c], ecx
mov ecx, dword [eax + 0x90]
mov dword [0x6d6e1a90], ecx
mov ecx, dword [eax + 0x94]
mov dword [0x6d6e1a94], ecx
mov ecx, dword [eax + 0x98]
mov dword [0x6d6e1a98], ecx
mov ecx, dword [eax + 0x9c]
mov dword [0x6d6e1a9c], ecx
mov eax, dword [eax + 0xa0]
mov dword [0x6d6e1aa0], eax
xor eax, eax
ret 4
Function at 0x6d691876
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call fcn.6d69166d
xor eax, eax
push str.browserJVM
mov dword [esi], vtable.ScriptablePluginObject.0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.6d6913ab
mov dword [esi + 0x24], eax
mov dword [esp], str.runningJVM
call fcn.6d6913ab
mov dword [esi + 0x28], eax
mov dword [esp], str.jvms
call fcn.6d6913ab
mov dword [esi + 0x2c], eax
mov dword [esp], str.installLatestJRE
call fcn.6d6913ab
mov dword [esi + 0x30], eax
mov dword [esp], str.installJRE
call fcn.6d6913ab
mov dword [esi + 0x34], eax
mov dword [esp], str.launch
call fcn.6d6913ab
mov dword [esi + 0x38], eax
mov dword [esp], str.compareVersion
call fcn.6d6913ab
mov dword [esi + 0x60], eax
mov dword [esp], 0x6d6d2b10
call fcn.6d6913ab
mov dword [esi + 0x64], eax
mov dword [esp], str.getStaticMimeType
call fcn.6d6913ab
mov dword [esi + 0x68], eax
mov dword [esp], str.getDynamicMimeType
call fcn.6d6913ab
mov dword [esi + 0x6c], eax
mov dword [esp], str.setInstallerType
call fcn.6d6913ab
mov dword [esi + 0x3c], eax
mov dword [esp], str.setAdditionalPackages
call fcn.6d6913ab
mov dword [esi + 0x40], eax
mov dword [esp], str.isAutoUpdateEnabled
call fcn.6d6913ab
mov dword [esi + 0x44], eax
mov dword [esp], str.setAutoUpdateEnabled
call fcn.6d6913ab
mov dword [esi + 0x48], eax
mov dword [esp], str.isPlugin2
call fcn.6d6913ab
mov dword [esi + 0x4c], eax
mov dword [esp], str.getInstalledFXVersion
call fcn.6d6913ab
mov dword [esi + 0x50], eax
mov dword [esp], str.installJavaFX
call fcn.6d6913ab
mov dword [esi + 0x54], eax
mov dword [esp], str.getJavaFXEnabled
call fcn.6d6913ab
mov dword [esi + 0x58], eax
mov dword [esp], str.enableJavaFX
call fcn.6d6913ab
mov dword [esi + 0x5c], eax
pop ecx
mov eax, esi
pop esi
ret 4
Function at 0x6d692c42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x790], eax
mov eax, dword [ebp + 0x79c]
push ebx
push esi
mov esi, dword [ebp + 0x7a0]
push eax
push 0x6d6d30f8
lea eax, [ebp - 0x70]
push 0x6d6d3124
xor ebx, ebx
push eax
mov byte [ebp - 0x71], 1
mov byte [ebp - 0x70], bl
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d692ccc
lea eax, [ebp - 0x7c]
push eax
push esi
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x6d6d312c
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x6d692ccf
mov byte [ebp - 0x71], bl
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x790]
mov al, byte [ebp - 0x71]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0x794
leave
ret
Function at 0x6d6935b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xfa0]
mov eax, 0x1020
call fcn.6d6a89f0
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0xf9c], eax
mov eax, dword [ebp + 0xfa8]
push esi
mov esi, dword [ebp + 0xfac]
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor edi, edi
push edi
push 0x6d6d32a4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d693792
push ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x79c]
push eax
mov dword [ebp - 0x70], edi
mov ebx, 0x800
push edi
jmp 0x6d693774
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x6c], edi
jbe 0x6d69375f
cmp byte [ebp + eax + 0x79c], 0x2e
jne 0x6d693644
inc ecx
cmp ecx, 1
jg 0x6d693653
inc eax
cmp eax, dword [ebp - 0x6c]
jb 0x6d693634
cmp ecx, 1
jle 0x6d69375f
push 0x6d6d32d0
lea eax, [ebp + 0x79c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d69375f
lea eax, [ebp + 0x79c]
push eax
call fcn.6d697031
pop ecx
test al, al
je 0x6d69375f
lea eax, [ebp + 0x79c]
push eax
push 0x6d6d32d8
lea eax, [ebp - 0x64]
push 0x6d6d3304
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d69375f
mov eax, dword [esi]
imul eax, eax, 0xc
add eax, dword [ebp - 0x68]
push eax
call fcn.6d692ac3
mov ecx, dword [ebp - 0x68]
lea eax, [ebp + 0x79c]
push eax
mov eax, dword [esi]
imul eax, eax, 0xc
push ebx
push dword [eax + ecx]
call fcn.6d6aa5f6
mov ecx, dword [ebp - 0x68]
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [esi]
imul eax, eax, 0xc
push dword [eax + ecx + 4]
lea eax, [ebp - 0x80]
push eax
push edi
push 0x6d6d330c
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d693745
lea eax, [ebp + 0x79c]
push eax
call fcn.6d6aa5f6
mov ecx, dword [esi]
mov edx, dword [ebp - 0x68]
imul ecx, ecx, 0xc
mov byte [ecx + edx + 8], al
lea eax, [ebp + 0x79c]
push eax
call fcn.6d6aa5f6
mov edx, dword [ebp - 0x68]
pop ecx
pop ecx
mov ecx, dword [esi]
imul ecx, ecx, 0xc
mov byte [ecx + edx + 9], al
jmp 0x6d693754
mov eax, dword [esi]
imul eax, eax, 0xc
add eax, dword [ebp - 0x68]
push eax
call fcn.6d692a84
pop ecx
push dword [ebp - 0x78]
inc dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x70]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x79c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x74]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6d693624
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp + 0xf9c]
pop edi
xor ecx, ebp
pop esi
call fcn.6d6a886c
add ebp, 0xfa0
leave
ret
Function at 0x6d6943ca
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d694418
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d694429
push 0xd
pop eax
jmp 0x6d694453
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d69442c
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d694b91
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d6aa5f6
mov ebx, eax
cmp ebx, esi
je 0x6d694c04
lea ecx, [ebp - 0x74]
call fcn.6d694310
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d694c1c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d694b91
cmp eax, esi
jne 0x6d694c4e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d694c0c
lea ecx, [ebp - 0x74]
call fcn.6d694310
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d6942e2
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d694310
mov eax, esi
jmp 0x6d694bea
Function at 0x6d697031
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1794]
mov eax, 0x1814
call fcn.6d6a89f0
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x1790], eax
mov eax, dword [ebp + 0x179c]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push eax
push 0x6d6d3914
lea eax, [ebp - 0x70]
push 0x6d6d3940
push eax
mov byte [ebp - 0x71], 0
call esi
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor edi, edi
push edi
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d69718c
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x790]
push eax
push edi
push edi
push 0x6d6d3948
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x6d69718b
push str.binjava.exe
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d6d3964
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
test eax, eax
je 0x6d69718b
push str.binclientjvm.dll
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d6d3980
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
mov ebx, eax
push str.bin_serverjvm.dll
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d6d399c
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
mov dword [ebp - 0x7c], eax
push str.binkerneljvm.dll
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d6d39b8
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
test ebx, ebx
jne 0x6d697187
cmp dword [ebp - 0x7c], ebx
jne 0x6d697187
test eax, eax
je 0x6d69718b
mov byte [ebp - 0x71], 1
pop ebx
mov ecx, dword [ebp + 0x1790]
mov al, byte [ebp - 0x71]
pop edi
xor ecx, ebp
pop esi
call fcn.6d6a886c
add ebp, 0x1794
leave
ret

Function at 0x6d6971a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x188], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push 0x6d6d39c0
push SysReAllocString
mov dword [ebp - 0x80], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d697213
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x6d6d39e8
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x6d697213
xor al, al
jmp 0x6d697215
mov al, 1
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.6d6a886c
add ebp, 0x18c
leave
ret
Function at 0x6d6976ae
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x790], eax
mov eax, dword [ebp + 0x79c]
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor esi, esi
push esi
push 0x6d6d38e0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d6977a2
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x7c], esi
push esi
jmp 0x6d69778d
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x74], esi
jbe 0x6d69777b
cmp byte [ebp + eax - 0x70], 0x2e
jne 0x6d697729
inc ecx
cmp ecx, 1
jg 0x6d697734
inc eax
cmp eax, dword [ebp - 0x74]
jb 0x6d69771c
cmp ecx, 1
jle 0x6d69777b
push str.1.3.1
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d69777b
lea eax, [ebp - 0x70]
push eax
call fcn.6d697031
pop ecx
test al, al
je 0x6d69777b
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jle 0x6d69777b
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x7a0]
push dword [ebp - 0x80]
call fcn.6d6aa5f6
add esp, 0xc
inc dword [ebp - 0x7c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x800
call edi
test eax, eax
je 0x6d697713
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x790]
xor ecx, ebp
pop esi
call fcn.6d6a886c
add ebp, 0x794
leave
ret
Function at 0x6d697d86
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1fc4]
mov eax, 0x2044
call fcn.6d6a89f0
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x1fc0], eax
cmp dword [0x6d6e6388], 0
je 0x6d697f0f
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x78]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x6d6d3b74
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x800
call esi
test eax, eax
jne 0x6d697f0c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xfc0]
push eax
push 0
push 0
push str.CurrentVersion
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0xfc0]
push eax
push str.SOFTWAREJavaSoftJava_Runtime_Environment
lea eax, [ebp - 0x40]
push 0x6d6d3bdc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp - 0x74], 0
jne 0x6d697f03
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
lea eax, [ebp - 0x40]
push eax
push edi
call esi
test eax, eax
jne 0x6d697f03
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x7c0]
push eax
xor edi, edi
push edi
push edi
push 0x6d6d3be4
push dword [ebp - 0x80]
mov esi, 0x800
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d697f03
lea eax, [ebp + 0x7c0]
push eax
lea eax, [ebp + 0x17c0]
push str._slib_bundles
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x17c0]
push eax
call fcn.6d6aa5f6
add esp, 0x14
test eax, eax
jne 0x6d697efa
push str._requested.list
lea eax, [ebp + 0x17c0]
push esi
push eax
mov dword [ebp - 0x74], edi
call fcn.6d6aa5f6
push 0x6d6d3c10
lea eax, [ebp + 0x17c0]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.6d6aa5f6
add esp, 0x18
test eax, eax
jne 0x6d697efa
mov ecx, dword [0x6d6e6388]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x6d697eda
push dword [ebp - 0x74]
sub eax, esi
push eax
push 1
push ecx
call fcn.6d6aac85
push dword [ebp - 0x74]
call fcn.6d6aaaba
add esp, 0x14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1fc0]
xor ecx, ebp
call fcn.6d6a886c
add ebp, 0x1fc4
leave
ret