joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d2cd430
Capabilities:
Initialize iwebbrowser2

Disassembly:
sub esp, 0x20
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x6d2cd445
xor al, al
pop edi
add esp, 0x20
ret 0xc
push ebx
push ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x38]
push eax
push 0x6d2dc744
push 0x17
push 0
push 0x6d2dee00
mov dword [esp + 0x4c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, eax
test ebp, ebp
js 0x6d2cd514
push esi
mov esi, dword [esp + 0x34]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x64]
push edi
push esi
call edx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x2a4]
push 0
push edi
push esi
call ecx
lea edx, [esp + 0x10]
push edx
mov ebx, eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
push ebx
lea ecx, [esp + 0x24]
mov word [esp + 0x24], ax
call fcn.6d2d5640
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push edx
push edx
push edx
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2a8]
push ebx
push edi
push esi
mov ebp, eax
call edx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
call ebx
test edi, edi
je 0x6d2cd513
mov edx, dword [esi]
mov eax, dword [edx + 0x5c]
push edi
push esi
call eax
pop esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x38]
test ebp, ebp
setns bl
test eax, eax
je 0x6d2cd52f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop ebp
mov al, bl
pop ebx
pop edi
add esp, 0x20
ret 0xc

Function at 0x6d2cddc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x6d2cddd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x6d2cde12
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x6d2cde0e
lea ebx, [ebx]
cmp esi, eax
jae 0x6d2cde12
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x6d2cde00
cmp esi, eax
jb 0x6d2cde18
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x6d2ce1d0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x944]
sub esp, 0x944
push 0xfffffffffffffffe
push 0x6d2dfba0
push 0x6d2d943c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d2e54cc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x940], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x94c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x950]
mov ecx, dword [ebp + 0x954]
xor ebx, ebx
mov byte [ebp + 0x140], bl
push ecx
push eax
push str._s_s
lea ecx, [ebp + 0x140]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp]
push edx
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d2ce2f4
push eax
call dword [sym.imp.kernel32.dll_FindClose]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp + 0x140]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x6d2ce2f4
push edi
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x6d2ce2f4
mov dword [ebp - 4], ebx
push esi
push edi
push ebx
lea eax, [ebp + 0x140]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x6d2ce2e8
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
push str.StringFileInfo040904e4ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x6d2ce2e8
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x6d2ce2e8
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x6d2e54cc
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
lea eax, [ebx + 1]
jmp 0x6d2ce2f6
mov dword [ebp - 4], 0xfffffffe
call fcn.6d2ce31e
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x940]
xor ecx, ebp
call fcn.6d2d932c
lea esp, [ebp + 0x944]
pop ebp
ret
Function at 0x6d2ce410
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
sub esp, 0x30
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebp
call dword [sym.imp.kernel32.dll_GetTickCount]
push 1
push 0
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x6d2ce44b
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x30
ret
push esi
push 0x24
push str.JavaQuickStarterService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x6d2ce47a
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x30
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
call edi
test eax, eax
jne 0x6d2ce4b6
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x30
ret
mov eax, dword [esp + 0x18]
push ebx
cmp eax, 1
je 0x6d2ce580
mov ebx, dword [sym.imp.kernel32.dll_Sleep]
cmp eax, 3
jne 0x6d2ce50b
nop
mov edx, dword [esp + 0x30]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
push 0x24
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
call edi
test eax, eax
je 0x6d2ce50b
cmp dword [esp + 0x1c], 1
je 0x6d2ce50b
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
ja 0x6d2ce50b
cmp dword [esp + 0x1c], 3
je 0x6d2ce4d0
lea edx, [esp + 0x18]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x6d2ce53e
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x30
ret
cmp dword [esp + 0x1c], 1
je 0x6d2ce580
mov eax, dword [esp + 0x30]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call edi
test eax, eax
je 0x6d2ce580
cmp dword [esp + 0x1c], 1
je 0x6d2ce580
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, 0x7530
ja 0x6d2ce580
cmp dword [esp + 0x1c], 1
jne 0x6d2ce545
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call edi
push esi
call edi
mov ecx, dword [esp + 0x3c]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.6d2d932c
add esp, 0x30
ret

Function at 0x6d2ce5b0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
push 0x800
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, 1
jl 0x6d2ce5d4
cmp eax, 0x800
jle 0x6d2ce5df
push 0x6d2dccbc
push esi
call edi
add esp, 8
push esi
push str._sjqs.log
push esi
call edi
add esp, 0xc
pop edi
pop esi
ret
Function at 0x6d2cf030
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x828
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x824], eax
push ebp
push esi
mov esi, dword [esp + 0x834]
xor ebp, ebp
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.6d2c2d40
test eax, eax
je 0x6d2cf0b7
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x6d2cf09e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x828
ret
push ebx
mov ebx, dword [esp + 0x24]
push 0x2001f
push str.JavaSoft
push ebx
lea ecx, [esp + 0x18]
call fcn.6d2c2d40
test eax, eax
je 0x6d2cf106
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x6d2cf0e5
push eax
call esi
cmp ebx, ebp
je 0x6d2cf0ec
push ebx
call esi
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x828
ret
push edi
push 0x2001f
lea ecx, [esp + 0x20]
cmp dword [esp + 0x844], ebp
jne 0x6d2cf152
mov edi, dword [esp + 0x14]
push str.Java_Runtime_Environment
push edi
call fcn.6d2c2d40
test eax, eax
je 0x6d2cf18c
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x6d2cf13d
push eax
call esi
cmp edi, ebp
je 0x6d2cf144
push edi
call esi
cmp ebx, ebp
je 0x6d2cf188
push ebx
call esi
xor eax, eax
jmp 0x6d2cf20a
mov eax, dword [esp + 0x14]
push str.Java_Development_Kit
push eax
call fcn.6d2c2d40
test eax, eax
je 0x6d2cf18c
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebp
je 0x6d2cf176
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x6d2cf181
push eax
call esi
cmp ebx, ebp
je 0x6d2cf188
push ebx
call esi
xor eax, eax
jmp 0x6d2cf20a
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x400
lea ecx, [esp + 0x38]
push ecx
push ebp
push edi
mov byte [esi], 0
call ebx
test eax, eax
jne 0x6d2cf1e2
jmp 0x6d2cf1b0
push esi
lea edx, [esp + 0x38]
push edx
inc ebp
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jle 0x6d2cf1d0
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x400
lea ecx, [esp + 0x38]
push ecx
push ebp
push edi
call ebx
test eax, eax
je 0x6d2cf1b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x6d2cf1ef
push edi
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6d2cf1fa
push eax
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x6d2cf205
push eax
call esi
mov eax, 1
mov ecx, dword [esp + 0x834]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.6d2d932c
add esp, 0x828
ret
Function at 0x6d2cfc00
Capabilities:
Set registry value

Disassembly:
sub esp, 0x18
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
push 0x20019
lea ecx, [esp + 8]
cmp dword [esp + 0x30], edi
jne 0x6d2cfc56
push str.SOFTWAREJavaSoftJava_Runtime_Environment
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.6d2c2d40
test eax, eax
je 0x6d2cfc5d
mov eax, dword [esp + 4]
cmp eax, edi
je 0x6d2cfc4f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
add esp, 0x18
ret
push str.SOFTWAREJavaSoftJava_Development_Kit
jmp 0x6d2cfc32
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 8]
push esi
push 0x20019
push eax
push ebx
lea ecx, [esp + 0x24]
call fcn.6d2c2d40
test eax, eax
jne 0x6d2cfc97
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push ecx
push str.JavaHome
push esi
lea ecx, [esp + 0x24]
call fcn.6d2c2e10
test eax, eax
je 0x6d2cfcb8
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x6d2cfca8
push eax
call esi
cmp ebx, edi
je 0x6d2cfcaf
push ebx
call esi
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x18
ret
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
push ebp
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
mov ebp, dword [esp + 0x1c]
jne 0x6d2cfcf6
mov byte [eax + esi - 1], 0
test esi, esi
jne 0x6d2cfce0
push 0x80004005
call fcn.6d2c1d60
push esi
call edi
inc eax
push eax
push esi
push 1
push 0
push str.JavaHome
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x6d2cfd03
push ebp
call esi
test ebx, ebx
je 0x6d2cfd0a
push ebx
call esi
pop ebp
pop esi
pop ebx
mov eax, 1
pop edi
add esp, 0x18
ret
Function at 0x6d2cff90
Capabilities:
Copy file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x2464
call fcn.6d2d9470
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x2460], eax
mov eax, dword [esp + 0x2468]
push ebx
push ebp
mov ebp, dword [esp + 0x2474]
push esi
push edi
push eax
lea eax, [esp + 0x1c74]
push str._s_bin_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
add esp, 0xc
lea ecx, [esp + 0x1c70]
push ecx
lea edx, [esp + 0x474]
xor ebx, ebx
push edx
mov byte [esp + 0x478], bl
call esi
push ebp
lea eax, [esp + 0xc74]
push eax
mov byte [esp + 0xc78], bl
call esi
mov dword [esp + 0x14], 3
cmp dword [esp + 0x2480], ebx
je 0x6d2d001d
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x14], ebx
jle 0x6d2d01c9
mov dword [esp + 0x10], 0x6d2dcbc8
jmp 0x6d2d0040
lea ecx, [esp + 0x1c70]
push ecx
lea edx, [esp + 0x1474]
push edx
mov byte [esp + 0x1478], bl
call esi
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1474]
push ecx
call esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1474]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x6d2d01aa
jmp 0x6d2d0090
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x474]
push edx
call esi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0xc74]
push ecx
call esi
push ebx
lea edx, [esp + 0xc74]
push edx
lea eax, [esp + 0x478]
push eax
call dword [sym.imp.kernel32.dll_CopyFileA]
test eax, eax
jne 0x6d2d016b
cmp dword [esp + 0x2480], ebx
jne 0x6d2d01e7
lea ecx, [esp + 0xc70]
push ecx
lea edx, [esp + 0x370]
push str._s..
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
lea eax, [esp + 0x268]
push eax
push 0x105
lea ecx, [esp + 0x378]
push ecx
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
test eax, eax
je 0x6d2d016b
lea edx, [esp + 0x15c]
push edx
push ebx
push 0x6d2dce68
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x6d2d016b
push ebx
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x478]
push edx
call dword [sym.imp.kernel32.dll_CopyFileA]
test eax, eax
je 0x6d2d016b
lea eax, [esp + 0xc70]
push eax
lea ecx, [esp + 0x160]
push ecx
call fcn.6d2cf230
add esp, 8
lea edx, [esp + 0x1c70]
push edx
lea eax, [esp + 0x474]
push eax
mov byte [esp + 0x478], bl
call esi
push ebp
lea ecx, [esp + 0xc74]
push ecx
mov byte [esp + 0xc78], bl
call esi
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d2d0090
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], 0xf
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x14]
jl 0x6d2d0040
mov eax, 1
mov ecx, dword [esp + 0x2470]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.6d2d932c
add esp, 0x2464
ret
push edi
call dword [sym.imp.kernel32.dll_FindClose]
xor eax, eax
jmp 0x6d2d01ce
Function at 0x6d2d0ae0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x19a0
call fcn.6d2d9470
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x199c], eax
push esi
mov esi, dword [esp + 0x19a8]
push 0x7ff
lea eax, [esp + 0x9a5]
push 0
push eax
mov byte [esp + 0x9ac], 0
call sub.MSVCR100.dll_memset
push 0x7ff
lea ecx, [esp + 0x11b1]
push 0
push ecx
mov byte [esp + 0x11b8], 0
call sub.MSVCR100.dll_memset
push 0x7ff
lea edx, [esp + 0x1bd]
push 0
push edx
mov byte [esp + 0x1c4], 0
call sub.MSVCR100.dll_memset
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1cc]
push ecx
push esi
mov dword [esp + 0x3c], 0x800
call fcn.6d2cfc00
add esp, 0x34
test eax, eax
jne 0x6d2d0b90
xor eax, eax
pop esi
mov ecx, dword [esp + 0x199c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x19a0
ret
lea edx, [esp + 0x1a0]
push edx
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp byte [esp + eax + 0x19f], 0x5c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x6d2d0bc3
lea eax, [esp + 0x1a0]
push eax
mov ecx, eax
push 0x6d2dcf3c
push ecx
call esi
add esp, 0xc
push str.jqs.exe
lea edx, [esp + 0x1a4]
push edx
lea eax, [esp + 0x9a8]
push str._sbin_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x9a4]
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d2d0b78
push eax
call dword [sym.imp.kernel32.dll_FindClose]
call fcn.6d2ce410
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
lea edx, [esp + 0x9ac]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x11b0]
xor ecx, ecx
push str.__s___unregister
push eax
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x60], 1
mov word [esp + 0x64], cx
call esi
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0x2000000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6d2d0b78
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x8000008
push 0
push 0
push 0
lea ecx, [esp + 0x11c0]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x6d2d0b78
mov eax, dword [esp + 0xc]
push 0x7530
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x19a0]
pop esi
xor ecx, esp
mov eax, 1
call fcn.6d2d932c
add esp, 0x19a0
ret
Function at 0x6d2d1f80
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d2d1fe7
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x6d2d1fc3
cmp eax, 2
jne 0x6d2d1fd6
mov eax, dword [esp + 0x14]
test esi, esi
je 0x6d2d1fe3
test eax, eax
je 0x6d2d1fe0
cmp byte [eax + esi - 1], 0
je 0x6d2d1fe3
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x6d2d1ff0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x208], eax
cmp dword [0x6d2e56bc], 0
je 0x6d2d2027
mov eax, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x20c
ret
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, 0x104
ja 0x6d2d2094
test eax, eax
je 0x6d2d2094
lea ecx, [esp + 0x104]
push ecx
push 0
push 0x6d2dd188
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x6d2d2094
push 0x6d2dbae0
lea eax, [esp + 0x108]
push eax
push 0x6d2e56bc
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.6d2d932c
add esp, 0x20c
ret

Function at 0x6d2d20f0
Capabilities:
Set registry value

Disassembly:
push ecx
cmp dword [esp + 8], 0
push esi
mov dword [esp + 4], 0
mov esi, str.false
jne 0x6d2d210b
mov esi, str.true
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6d2d2164
cmp dword [esp + 0xc], eax
je 0x6d2d2159
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov edx, dword [esp + 0xc]
push eax
push esi
push 1
push 0
push str.Disabled
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x6d2d2170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x81c
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf_s]
push esi
push edi
mov edi, dword [esp + 0x82c]
push edi
push str.SOFTWAREJavaSoftJava_Plug_in_s
lea eax, [esp + 0x2c]
push 0x800
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 1
call ebx
add esp, 0x10
push 0x20019
lea ecx, [esp + 0x28]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x20]
call fcn.6d2c2d40
test eax, eax
je 0x6d2d2212
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
test eax, eax
je 0x6d2d21f8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x81c
ret
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UseJava2IExplorer
push esi
mov dword [esp + 0x38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d2d226a
cmp dword [esp + 0x10], 4
jne 0x6d2d226a
mov edx, dword [esp + 0xc]
push edx
push edi
push str.SOFTWAREJavaSoftJava_Plug_in_sUseJava2IExplorer_is__d_n
lea eax, [esp + 0x30]
push 0x800
push eax
call ebx
lea ecx, [esp + 0x38]
push ecx
call fcn.6d2d20b0
add esp, 0x18
mov edi, dword [esp + 0xc]
test esi, esi
je 0x6d2d2279
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x824]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.6d2d932c
add esp, 0x81c
ret
Function at 0x6d2d23b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x81c
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x818], eax
mov eax, dword [esp + 0x820]
push esi
push 0x20019
xor esi, esi
push str.SOFTWAREJavaSoftJava_Plug_in
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x800
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
call fcn.6d2c2d40
test eax, eax
je 0x6d2d242d
mov eax, dword [esp + 8]
cmp eax, esi
je 0x6d2d2415
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x81c
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x6d2d2497
call fcn.6d2d1ff0
test eax, eax
je 0x6d2d2471
mov edx, dword [0x6d2e56bc]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_fprintf_s]
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x38]
push edx
inc esi
push esi
push edi
mov dword [esp + 0x2c], 0x800
call ebx
test eax, eax
je 0x6d2d2453
mov ebx, 1
cmp eax, 0x103
je 0x6d2d24a7
mov ebx, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x6d2d24b6
push edi
call esi
xor edi, edi
mov ecx, dword [esp + 0x830]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push 0x6d2dcc48
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x10
test edi, edi
je 0x6d2d24dd
push edi
call esi
mov ecx, dword [esp + 0x824]
pop edi
mov eax, ebx
pop ebx
pop esi
xor ecx, esp
call fcn.6d2d932c
add esp, 0x81c
ret