joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e612
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov byte [ebp - 1], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e78d
push ebx
push esi
mov esi, 0x1770
push edi
push esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call fcn.0041375e
push esi
mov dword [ebp - 0x18], eax
call fcn.0041375e
push esi
mov dword [ebp - 8], eax
call fcn.0041375e
push esi
mov edi, eax
call fcn.0041375e
add esp, 0x10
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 0x18]
mov ebx, eax
xor eax, eax
push eax
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
push eax
jmp 0x40e74e
push dword [ebp - 8]
mov byte [edi], 0
mov byte [ebx], 0
call fcn.00414100
inc eax
pop ecx
test eax, eax
jle 0x40e6c6
mov ebx, dword [ebp - 8]
mov ecx, edi
sub ebx, edi
mov dl, byte [ebx + ecx]
cmp dl, 0x2f
jne 0x40e6bd
mov byte [ecx], 0x5c
jmp 0x40e6bf
mov byte [ecx], dl
inc ecx
dec eax
jne 0x40e6b0
mov ebx, dword [ebp - 0x20]
push str.i4j_jres
push edi
call fcn.00416320
test eax, eax
pop ecx
setne al
cmp byte [ebp + 0x20], 0
pop ecx
je 0x40e6e2
test al, al
je 0x40e6ec
cmp byte [ebp + 0x24], 0
je 0x40e72e
test al, al
je 0x40e72e
push 1
push 1
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ebx
push edi
call fcn.0040dead
add esp, 0x1c
test al, al
je 0x40e72e
push dword [ebp + 0x14]
push ebx
call fcn.0040d65f
pop ecx
pop ecx
test al, al
je 0x40e72e
push ebx
push dword [ebp + 0x14]
call fcn.00414580
push edi
push dword [ebp + 0x10]
call fcn.00414580
add esp, 0x10
mov byte [ebp - 1], 1
inc dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push 0
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40e695
push edi
call fcn.00414445
push ebx
call fcn.00414445
push dword [ebp - 0x18]
call fcn.00414445
push dword [ebp - 8]
call fcn.00414445
add esp, 0x10
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov al, byte [ebp - 1]
leave
ret
Function at 0x40f5e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x43e37c]
mov dword [ebp - 4], 0x43e37c
jmp 0x40f649
mov eax, dword [ebp - 4]
mov edi, dword [eax]
push edi
call fcn.00414100
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.0041375e
pop ecx
pop ecx
test esi, esi
jle 0x40f62b
mov ecx, eax
sub edi, eax
mov edx, esi
mov bl, byte [edi + ecx]
xor bl, 0xbb
mov byte [ecx], bl
inc ecx
dec edx
jne 0x40f61f
push esi
push eax
push dword [ebp + 8]
mov byte [eax + esi], 0
call fcn.00415051
add esp, 0xc
test eax, eax
je 0x40f65a
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00414100
pop ecx
test eax, eax
ja 0x40f5fd
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov al, 1
jmp 0x40f655

Function at 0x40f7a5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x40f7d5
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
movsx edi, byte [edx]
mov eax, dword [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x43e380]
inc edx
dec esi
mov dword [ecx], eax
jne 0x40f7b7
pop edi
pop esi
ret
Function at 0x40fcbd
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x465c
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
cmp dword [0x44bca4], esi
jne 0x40fd11
push 0x18
call fcn.00414843
mov edx, eax
pop ecx
cmp edx, esi
je 0x40fcff
push 6
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [0x44bca4], edx
jmp 0x40fd05
mov dword [0x44bca4], esi
push dword [0x44bca4]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push dword [0x44bca4]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44bca0]
cmp eax, esi
je 0x40fd40
cmp dword [0x44bc9c], esi
jne 0x40fd40
push str.a_ccsUTF_8
push eax
call fcn.004162d5
pop ecx
pop ecx
mov dword [0x44bc9c], eax
cmp byte [0x44bc98], 0
jne 0x40fef4
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
mov bl, byte [0x44d463]
mov edi, 0x1770
push edi
lea eax, [ebp - 0x1774]
push eax
push str.EXE4J_LOG
mov byte [0x44bc98], 1
call esi
test eax, eax
jbe 0x40fd92
lea eax, [ebp - 0x1774]
push 0x436bf4
push eax
call fcn.00415ec0
pop ecx
pop ecx
test eax, eax
jne 0x40fd92
mov bl, 1
push edi
lea eax, [ebp - 0x1774]
push eax
push str.INSTALL4J_LOG
call esi
test eax, eax
jbe 0x40fdbe
lea eax, [ebp - 0x1774]
push 0x436bf4
push eax
call fcn.00415ec0
pop ecx
pop ecx
test eax, eax
jne 0x40fdbe
mov bl, 1
test bl, bl
pop ebx
je 0x40fef4
mov edi, 0x2ee0
push edi
call fcn.0041375e
mov esi, eax
xor eax, eax
push eax
push esi
mov word [esi], ax
call fcn.00405ecc
push esi
call fcn.0041492b
add esp, 0x10
test eax, eax
jne 0x40fdfa
push 0x436bdc
push esi
call fcn.00414e9a
jmp 0x40fe16
movzx eax, word [esi + eax*2 - 2]
cmp ax, 0x5c
je 0x40fe18
cmp ax, 0x2f
je 0x40fe18
push 0x434a10
push esi
call fcn.00414e6c
pop ecx
pop ecx
push edi
call fcn.0041375e
pop ecx
mov dword [0x44bca0], eax
xor edi, edi
inc edi
push edi
push esi
push str._si4j_nlog__d.log
push dword [0x44bca0]
call fcn.0040fc47
push dword [0x44bca0]
call fcn.00405107
add esp, 0x14
test al, al
je 0x40fe53
cmp edi, 0x3e8
jl 0x40fe26
push esi
call fcn.00414445
mov esi, str.w_ccsUTF_8
push esi
push dword [0x44bca0]
call fcn.004162d5
add esp, 0xc
mov dword [0x44bc9c], eax
test eax, eax
jne 0x40fe92
mov eax, str.c:i4j_nlog
push esi
push eax
mov dword [0x44bca0], eax
call fcn.004162d5
pop ecx
pop ecx
mov dword [0x44bc9c], eax
test eax, eax
je 0x40fef4
push 0x1770
lea eax, [ebp - 0x4654]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x465c]
push eax
call fcn.00415a54
lea eax, [ebp - 0x465c]
push eax
call fcn.004197ae
push eax
lea eax, [ebp - 0x4654]
push eax
push str.Started_executable__s_at__S_n
push dword [0x44bc9c]
call fcn.004198ca
push dword [0x44bc9c]
call fcn.004154d5
add esp, 0x1c
call fcn.0040fc5d
mov dword [0x44bca8], eax
mov dword [0x44bcac], edx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00414678
leave
ret
Function at 0x40ffd1
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x16fc]
mov eax, 0x177c
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp + 0x16f8], eax
push esi
xor esi, esi
push esi
call fcn.00405160
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004061f8
add esp, 0xc
push esi
lea eax, [ebp - 0x7c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREej_technologiesexe4jpids_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x410050
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 4
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x16f8]
xor ecx, ebp
pop esi
call fcn.00414678
add ebp, 0x16fc
leave
ret

Function at 0x410066
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1704]
mov eax, 0x1784
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp + 0x1700], eax
push edi
xor edi, edi
push edi
call fcn.00405160
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004061f8
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push edi
push str.SOFTWAREej_technologiesexe4jpids_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4100f0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4100e7
cmp dword [ebp - 0x78], 4
jne 0x4100e7
mov edi, dword [ebp - 0x7c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1700]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00414678
add ebp, 0x1704
leave
ret

Function at 0x4103a5
Capabilities:
Create mailslot
Create thread

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00410142
pop ecx
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, eax
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push esi
mov edi, eax
call fcn.00414445
pop ecx
cmp edi, 0xffffffff
jne 0x4103e3
push str.creating_mailslot_failed
call fcn.0040ff78
pop ecx
jmp 0x4103fe
push str.creating_mailslot_successful
call fcn.0040ff78
pop ecx
push ebx
push ebx
push edi
push 0x41017d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret
Function at 0x410402
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
call fcn.00410142
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call fcn.0041492b
pop ecx
pop ecx
test eax, eax
jne 0x410428
mov dword [ebp + 0xc], str.__i4j_empty_command_line
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 0
mov ebx, 0x80
push ebx
push 3
push 0
push 1
mov edi, 0x40000000
push edi
push dword [ebp - 0xc]
call esi
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x41049b
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
cmp eax, 0x32
jge 0x410480
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebx
push 3
push 0
push 1
push edi
push dword [ebp - 0xc]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x410456
cmp dword [ebp - 4], 0xffffffff
jne 0x41049b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_mailslot_CreateFile__d
call fcn.0040ff78
pop ecx
pop ecx
jmp 0x4104f3
push dword [ebp + 0xc]
call fcn.0041492b
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
add esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4104d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_mailslot_WriteFile__d
call fcn.0040ff78
pop ecx
pop ecx
jmp 0x4104ea
cmp dword [ebp - 8], esi
je 0x4104ea
push esi
push dword [ebp - 8]
push str.error_mailslot_WriteFile_length__d__d
call fcn.0040ff78
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call fcn.00414445
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411d55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x44d465], 0
push esi
je 0x411d95
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x411d95
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00414100
pop ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x411dad
push dword [ebp + 8]
call fcn.00419cad
call fcn.0041564d
add eax, 0x20
push eax
call fcn.004154d5
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x411df2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x411e78
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00415e40
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
jne 0x411e56
cmp dword [ebp - 0x90], 0
je 0x411e78
push str.SetDefaultDllDirectories
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411e78
push 0xc00
call eax
push str.restrict_DLL_directories
call fcn.0040ff78
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00414678
leave
ret

Function at 0x411e85
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1774
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, 0x44bce0
lea eax, [ebp - 0x1774]
push eax
call fcn.00405f29
push 0
call fcn.00415a54
push edx
push eax
lea eax, [ebp - 0x1774]
push eax
push str._s_dir_d
push esi
call fcn.00415111
push esi
push str.Temp_dir3:__S
call fcn.0040ff78
add esp, 0x24
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x411f18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x437c14
call fcn.0040ff78
inc edi
cmp edi, 0xa
pop ecx
pop ecx
jl 0x411ea5
push 0x437c10
push 0x3f1
mov byte [0x44bce0], 0
call fcn.0040488a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00414678
leave
ret

Function at 0x411f26
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x411f94
push esi
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x411f93
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x412080
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
push esi
push edi
mov ebx, 0xbb80
push ebx
call fcn.0041375e
mov esi, eax
mov dword [esp], 0x2ee0
call fcn.0041375e
mov edi, eax
mov dword [esp], 0x1770
push edi
push 0x2714
call fcn.00403846
push edi
push str.native_lib_dir_is__S
call fcn.0040ff78
push edi
call fcn.00407c99
push 0x412063
push edi
push esi
call fcn.0040634d
push esi
call fcn.00414100
add esp, 0x28
test eax, eax
je 0x4120f5
push esi
call fcn.00414100
cmp byte [eax + esi - 1], 0x3b
pop ecx
je 0x4120f5
push 0x433d5c
push esi
call fcn.00414590
pop ecx
pop ecx
push esi
call fcn.00414100
pop ecx
sub ebx, eax
push ebx
push esi
call fcn.00414100
pop ecx
add eax, esi
push eax
mov ebx, 0x435c9c
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x412130
push esi
push str.Setting_PATH__native_libs___S
call fcn.0040ff78
pop ecx
pop ecx
jmp 0x412145
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Setting_PATH__native_libs___S_failed_with_error__d
call fcn.0040ff78
add esp, 0xc
push esi
call fcn.00414100
add eax, 6
push eax
call fcn.0041375e
push esi
mov ebx, eax
push str.PATH_s
push ebx
call fcn.00415111
push ebx
call fcn.00419203
push ebx
call fcn.00414445
push esi
call fcn.00414445
push edi
call fcn.00414445
add esp, 0x24
pop edi
pop esi
pop ebx
ret

Function at 0x412181
Capabilities:
Set environment variable

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push edi
xor edi, edi
push edi
mov ebp, str._JAVA_OPTIONS
push ebp
call esi
push edi
mov ebx, str.JDK_JAVA_OPTIONS
push ebx
call esi
push edi
mov edi, str.JAVA_TOOL_OPTIONS
push edi
call esi
mov esi, 0x435273
push esi
push ebp
call fcn.00419248
push esi
push ebx
call fcn.00419248
push esi
push edi
call fcn.00419248
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4129fd
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 8
mov eax, 0x432038
call fcn.00414d62
push 0x271a
call fcn.004038fd
pop ecx
test eax, eax
je 0x412b85
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
mov ebx, str.PATH
push ebx
call esi
mov edi, eax
test edi, edi
jle 0x412b85
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041375e
pop ecx
push edi
push eax
push ebx
mov dword [ebp - 0x10], eax
call esi
test eax, eax
jbe 0x412b7c
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x412b7c
lea eax, [ebp + 0x1c]
push eax
call fcn.0041492b
pop ecx
test eax, eax
jbe 0x412b7c
lea eax, [ebp + 0x1c]
push eax
call fcn.0041492b
pop ecx
push 0
lea ecx, [ebp]
mov dword [ebp - 0x14], eax
mov dword [ebp + 0x18], 7
call fcn.00412441
push dword [ebp - 0x10]
and dword [ebp - 4], 0
push edi
push dword [ebp - 0x14]
push str.reducing_PATH__d__d__s
call fcn.0040ff78
mov esi, 0x434474
push esi
push dword [ebp - 0x10]
call fcn.0041604b
add esp, 0x18
jmp 0x412b24
push edi
call fcn.0041492b
pop ecx
test eax, eax
je 0x412b2a
push dword [ebp - 0x14]
lea eax, [ebp + 0x1c]
push eax
push edi
call fcn.00419e5c
add esp, 0xc
test eax, eax
jne 0x412b1a
cmp dword [ebp + 0x14], eax
jbe 0x412b11
push esi
lea ecx, [ebp]
call fcn.004129e0
push edi
lea ecx, [ebp]
call fcn.004129e0
push esi
push 0
call fcn.0041604b
pop ecx
pop ecx
mov edi, eax
test edi, edi
jne 0x412ae4
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x412b36
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x14]
push str.reduced_PATH__d_to__s
call fcn.0040ff78
add esp, 0xc
cmp dword [ebp + 0x14], 0
jbe 0x412b70
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x412b59
lea eax, [ebp + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x412b70
push str.ERROR_setting_path
call fcn.0040ff78
pop ecx
push 0
push 1
lea ecx, [ebp]
call fcn.0041249b
push dword [ebp - 0x10]
call fcn.00414445
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00414678
add ebp, 0x228
leave
ret
Function at 0x413389
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x462c]
mov eax, 0x46ac
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp + 0x4628], eax
mov eax, dword [ebp + 0x4634]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x4638]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00414580
push str..pack
call fcn.00414100
lea esi, [ebp - 0x28]
sub esi, eax
lea eax, [ebp - 0x28]
push eax
call fcn.00414100
xor ebx, ebx
push edi
mov byte [eax + esi], bl
call fcn.004050ae
add esp, 0x14
test al, al
jne 0x4133fd
push str.pack_path_doesnt_exists
call fcn.0040ff78
jmp 0x4134f8
push dword [ebp - 0x2c]
lea eax, [ebp + 0x2eb8]
push str._s_binunpack200.exe
push eax
call fcn.00415111
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp + 0x1748]
push str._r___s____s_
push eax
call fcn.00415111
lea eax, [ebp + 0x2eb8]
push eax
mov esi, 0x433c08
push esi
call fcn.0040ff78
lea eax, [ebp + 0x1748]
push eax
push esi
call fcn.0040ff78
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00415e40
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00415e40
add esp, 0x44
xor ecx, ecx
mov word [ebp - 0x50], cx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ebx
push ebx
xor eax, eax
push 0x20
inc eax
push eax
push ebx
mov dword [ebp - 0x54], eax
push ebx
lea eax, [ebp + 0x1748]
push eax
lea eax, [ebp + 0x2eb8]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4134b1
push str.could_not_create_unpack_process
call fcn.0040ff78
push ebx
push 0x3fd
call fcn.0040488a
add esp, 0xc
push str.waiting_for_unpack200_to_finish
call fcn.0040ff78
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.unpack_done
call fcn.0040ff78
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4134f9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x4134f9
call esi
push eax
push str.could_not_delete_packed_file__error__d_
call fcn.0040ff78
pop ecx
pop ecx
mov ecx, dword [ebp + 0x4628]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414678
add ebp, 0x462c
leave
ret
Function at 0x413511
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2fa8]
mov eax, 0x3028
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp + 0x2fa4], eax
mov eax, dword [ebp + 0x2fb0]
push ebx
push edi
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x1834]
push str._s_s.jar.pack
push eax
call fcn.00415111
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1834]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x413648
call fcn.00403d57
test al, al
jne 0x413648
lea eax, [ebp - 0x50]
push eax
push eax
call fcn.00414100
pop ecx
sub eax, 5
push eax
push edi
push esi
lea eax, [ebp + 0x1834]
push str._s_s_.s
push eax
call fcn.00415111
lea eax, [ebp + 0x1834]
push eax
push str.checking__S
call fcn.0040ff78
lea eax, [ebp + 0x1834]
push eax
call fcn.004050ae
add esp, 0x24
test al, al
jne 0x41362e
mov eax, dword [ebp - 0x80]
cmp byte [eax], 0
jne 0x4135e4
push str.Unpacking_JRE
call fcn.0040ff78
mov dword [esp], str.Preparing_JRE_..._n
call fcn.00411d55
mov eax, dword [ebp - 0x80]
pop ecx
mov byte [eax], 1
lea eax, [ebp - 0x50]
push eax
push eax
call fcn.00414100
pop ecx
sub eax, 5
push eax
push edi
lea eax, [ebp + 0x1834]
push str._s_.s
push eax
call fcn.00415111
lea eax, [ebp + 0x1834]
push eax
push esi
lea eax, [ebp + 0xc4]
push str._s_s.pack
push eax
call fcn.00415111
lea eax, [ebp + 0xc4]
push eax
push esi
call fcn.00413389
add esp, 0x2c
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41356c
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x2fa4]
xor ecx, ebp
pop ebx
call fcn.00414678
add ebp, 0x2fa8
leave
ret

Function at 0x414678
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43ec80]
jne 0x414682
repz ret
jmp fcn.0041bef5