joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436c70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46e453
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004603a6
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00465b19
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00467071
test eax, eax
je 0x436d8c
mov ecx, dword [esp + 0x3c]
call fcn.00465b46
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x436d50
push edi
mov ecx, esi
call fcn.00463104
mov ecx, esi
call fcn.00436ef0
cmp dword [esp + 0x38], 1
jne 0x436d85
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046326e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4397b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4397e3
push esi
call fcn.0043c8c0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4397dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x439869
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x439852
mov eax, dword [esi + 8]
test eax, eax
je 0x439807
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43984e
cmp eax, 2
je 0x439852
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4397fa
cmp eax, 3
je 0x43982d
cmp eax, 1
jne 0x4397fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4397fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4397fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00439890
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x439878
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00439890
add esp, 4
pop esi
ret

Function at 0x46119c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4611d4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045f253
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045f22b
jmp 0x4611e0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46288d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4628cf
call fcn.00468578
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4628cf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4628c6
xor eax, eax
jmp 0x4628d7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004628dd
pop edi
pop esi
pop ebx
ret 4

Function at 0x468aa8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x468ad6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x468af4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00468a0e
jmp 0x468af4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x468af4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00468a0e
test edi, edi
mov eax, edi
jne 0x468ade
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409330
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [0x42b7d4]
cmp byte [eax], 0
jne 0x4093eb
mov ecx, dword [0x42bc2c]
mov edx, dword [0x42b764]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40934a
mov ecx, dword [0x42b764]
push 0x5c
push ecx
call fcn.0041ae00
add esp, 8
test eax, eax
je 0x40936c
inc eax
jmp 0x409371
mov eax, dword [0x42b764]
mov ecx, 0x4266e0
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40937a
mov edx, dword [0x42b764]
push edx
call fcn.00409280
mov eax, dword [0x42b7d4]
add esp, 4
cmp byte [eax], 0
jne 0x4093eb
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4093eb
mov ecx, dword [0x42bbf4]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4093eb
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4093e4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4093dd
push eax
call fcn.004091f0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret
Function at 0x410350
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x426b74
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4103f9
lea ecx, [esp + 0xc]
lea edx, [esp]
push ecx
mov ecx, dword [0x42b764]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4103bc
inc dword [esp]
jmp 0x4103cc
mov dword [esp], 1
mov dword [esp + 4], 4
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea ecx, [esp]
push eax
mov eax, dword [0x42b764]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
ret
Function at 0x410910
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x42bb38]
sub esp, 0x208
test eax, eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
jne 0x4109f3
push 0x42bb38
push 0x104
call fcn.00402160
add esp, 8
test eax, eax
jne 0x41095b
pop edi
pop esi
pop ebp
mov dword [0x42bc24], 0xc
or eax, 0xffffffff
pop ebx
add esp, 0x208
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, 1
mov eax, dword [0x42bb38]
push eax
push 0x104
call ebp
mov ecx, dword [0x42bb38]
push ecx
call fcn.004020b0
mov edx, dword [0x42bb38]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
add ecx, edx
push 0x426bbc
push ecx
call esi
mov edx, dword [0x42bb38]
push edx
call fcn.0041b148
add esp, 0x14
test eax, eax
jne 0x4109ba
inc ebx
cmp ebx, 0x3e7
jl 0x410966
jmp 0x4109cc
mov eax, dword [0x42bb38]
push eax
call fcn.0041b11c
add esp, 4
test eax, eax
je 0x4109f3
mov ecx, dword [0x42bb38]
mov dword [0x42bc24], 0x11
push ecx
call fcn.0040ab70
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
mov edx, dword [0x42bb38]
push edx
call fcn.004020b0
mov ebx, dword [esp + 0x220]
mov ecx, dword [0x42bb38]
lea edx, [esp + 0x14]
mov eax, dword [ebx + 6]
push eax
push ecx
push 0x426bb0
push edx
call esi
mov eax, dword [0x42bb38]
push eax
call fcn.004020f0
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.004010e0
mov ebp, dword [esp + 0x244]
mov edi, eax
add esp, 0x20
cmp edi, 0xffffffff
jne 0x410aee
mov eax, dword [0x42bb24]
mov edx, dword [ebx + 6]
push edx
lea edx, [esp + 0x118]
mov ecx, dword [eax + 0x70]
add ecx, eax
push ecx
push 0x426bb0
push edx
call esi
mov eax, dword [esp + 0x230]
mov ecx, dword [ebx + 0xa]
push ebp
push eax
lea edx, [esp + 0x12c]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.00410690
add esp, 0x24
test eax, eax
je 0x410ac7
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.004010e0
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x410aee
lea edx, [esp + 0x10]
mov dword [0x42bc24], 0x10
push edx
call fcn.0040ab70
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
lea eax, [esp + 0x114]
mov dword [0x42bc24], 0x10
push eax
call fcn.0040ab70
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
push ebp
call fcn.00401ea0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x410b10
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x42bb38]
test eax, eax
je 0x410bae
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
call ebx
test eax, eax
je 0x410ba0
push esi
push 1
push 0x118
call fcn.0041b002
mov esi, eax
add esp, 8
test esi, esi
je 0x410b89
push edi
push esi
push 0x426bcc
call fcn.0041bf41
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x410b7f
test byte [esi], 0x10
jne 0x410b68
lea eax, [esi + 0x14]
push eax
call fcn.0041b380
add esp, 4
push esi
push edi
call fcn.0041c00b
add esp, 8
test eax, eax
je 0x410b57
push edi
call fcn.0041c0d0
add esp, 4
push esi
call fcn.0041b0b3
add esp, 4
pop edi
push 0x426bc8
call ebx
mov ecx, dword [0x42bb38]
push ecx
call fcn.0041bf17
add esp, 4
pop esi
push 0x42bb38
call fcn.004021a0
add esp, 4
pop ebx
ret

Function at 0x410c30
Capabilities:
Copy file

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x104
xor ebp, ebp
call fcn.00402160
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov edx, ebx
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410c55
push 0x5c
push ebx
call fcn.0041ae00
add esp, 8
test eax, eax
je 0x410c71
inc eax
jmp 0x410c73
mov eax, ebx
mov edi, dword [esp + 0x20]
mov edx, eax
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x410c7d
mov esi, dword [esp + 0x18]
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x410cc2
mov dword [0x42bc24], 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x42bc14]
mov dword [0x42bc28], eax
mov ecx, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x410cb6
jmp 0x410ced
push 2
push esi
mov ebp, 1
call fcn.0041adad
add esp, 8
test eax, eax
je 0x410ced
cmp dword [0x42bc5c], 0xd
jne 0x410ced
push 0x180
push esi
call fcn.0041ac6c
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call fcn.004021a0
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4130e0
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x318
push esi
mov esi, dword [esp + 0x320]
test esi, esi
je 0x413100
push 0x180
push esi
call fcn.0041ac6c
add esp, 8
mov eax, dword [0x42bbac]
test eax, eax
je 0x41314b
test esi, esi
jne 0x41312c
mov eax, dword [esp + 0x324]
push 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x318
ret
mov ecx, dword [esp + 0x324]
push 5
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x318
ret
mov eax, dword [esp + 0x324]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x11c]
push 0x104
push edx
push eax
call edi
test esi, esi
je 0x41317e
lea ecx, [esp + 0x220]
push 0x104
push ecx
push esi
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x18]
push 0x426bf4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
je 0x4131e0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x224]
push edx
push eax
push 0x426bec
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x318
ret
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
push eax
push 0x426be8
push 0x426bec
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
lea edx, [esp + 0x18]
push 2
push edx
call fcn.004010e0
mov ebp, eax
add esp, 8
cmp ebp, 0xffffffff
je 0x4132f8
push ebx
push ebp
call fcn.00401260
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0x200]
push ecx
call fcn.00402120
add esp, 0xc
test eax, eax
je 0x4132ee
mov esi, dword [esp + 0x10]
push ebx
push esi
push ebp
call fcn.00401160
add esp, 0xc
test eax, eax
jne 0x4132e1
add ebx, 0xfffffffc
mov edx, esi
test ebx, ebx
jbe 0x4132e1
mov eax, 0xfffffffe
sub eax, esi
mov dword [esp + 0x18], eax
cmp byte [edx], 0x78
jne 0x4132b0
cmp byte [edx + 1], 0x79
jne 0x4132b0
cmp byte [edx + 2], 0x7a
jne 0x4132b0
cmp byte [edx + 3], 0x3d
jne 0x4132b0
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx + 4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x120]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4132bb
mov eax, dword [esp + 0x18]
inc edx
lea ecx, [eax + edx + 2]
cmp ecx, ebx
jb 0x413274
jmp 0x4132e1
push 0
push ebp
mov byte [edx], 0x4e
mov byte [edx + 1], 0x55
mov byte [edx + 2], 0x4c
call fcn.00401200
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push ebp
call fcn.004011a0
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call fcn.004021a0
add esp, 4
push ebp
call fcn.00401360
add esp, 4
pop ebx
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x318
ret
Function at 0x6d3f378d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x6d410030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x6d3f3830
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d40669e
pop ecx
pop ecx
test eax, eax
je 0x6d3f3819
test ebx, ebx
je 0x6d3f380d
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.6d40669e
pop ecx
pop ecx
test eax, eax
jle 0x6d3f3819
push ebx
call fcn.6d3f5895
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.6d3f5874
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x6d3f37da
xor edi, edi
cmp ebx, edi
jne 0x6d3f3834
xor eax, eax
jmp 0x6d3f38a0
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x6d3f3863
call fcn.6d3f5895
pop ecx
cmp dword [ebp - 0x70], edi
je 0x6d3f3830
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x6d3f3830
call fcn.6d3f5895
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d3f3853
cmp dword [ebp - 0x70], edi
je 0x6d3f3896
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.6d3f5874
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d3f8259
add ebp, 0x9c
leave
ret
Function at 0x6d3f555d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x6d410030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.6d3f53ca
push 8
mov esi, eax
call fcn.6d3f582d
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d3f55c8
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x6d3f55cf
and dword [ebx + 4], 0
jmp 0x6d3f55e4
xor eax, eax
jmp 0x6d3f56af
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x6d3f5695
push edi
call fcn.6d3f7a10
pop ecx
cmp eax, 4
jl 0x6d3f55bb
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x6d3f55bb
add eax, 0xfffffffd
push 0x6d40982c
push eax
mov dword [ebp - 0x74], eax
call fcn.6d3f8270
pop ecx
pop ecx
test eax, eax
je 0x6d3f562a
push 0x6d409828
push dword [ebp - 0x74]
call fcn.6d3f8270
pop ecx
pop ecx
test eax, eax
jne 0x6d3f55bb
push 0x3b
push edi
call fcn.6d3f93f0
pop ecx
pop ecx
test eax, eax
jne 0x6d3f55bb
push dword [ebp - 0x78]
call fcn.6d3f7a10
push edi
mov ebx, eax
call fcn.6d3f7a10
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.6d3f582d
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.6d40669e
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.6d40669e
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.6d3f5420
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x6d3f55bb
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.6d3f5895
push ebx
call fcn.6d3f5895
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d3f8259
add ebp, 0x214
leave
ret

Function at 0x6d3f8259
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d410030]
jne 0x6d3f8263
repz ret
jmp fcn.6d3fe721
Function at 0x6d40669e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x6d4066ad
pop dword [ebp - 0x18]
mov eax, 0x5ce056f7
add eax, 0x10600fb6
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x7c4e298f
sub dword [ebp - 0x28], 0x2dfbe444
mov dword [ebp - 0x24], 0xdf9bb01a
add dword [ebp - 0x24], 0x52979c2b
mov dword [ebp - 0x20], 0x541415b4
add dword [ebp - 0x20], 0xf8382e7a
mov dword [ebp - 0x1c], 0x5959f28b
sub dword [ebp - 0x1c], 0x5959f28b
lea eax, [ebp - 0x28]
push eax
mov eax, 0x9cf733ab
add eax, 0xd0494ca5
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x1ffa14eb
add dword [ebp - 0x28], 0x5478546b
mov dword [ebp - 0x24], 0x64273c76
sub dword [ebp - 0x24], 0x22badb01
mov dword [ebp - 0x20], 0xd084941
sub dword [ebp - 0x20], 0xa998dcd5
mov dword [ebp - 0x1c], 0xcfc33d3f
sub dword [ebp - 0x1c], 0xcfc33d3f
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x2352d9ed
sub eax, 0xb61259a1
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3cd1a
push 0
call eax
mov ecx, 0xd984bb5c
sub ecx, 0xd9846cf9
xor edx, edx
add edx, eax
mov edi, 0x73900682
add edi, 0xf9b1617e
add edi, dword [ebp - 0x18]
mov esi, 0x68b4b258
add esi, 0x3d9d
add dword [ebp - 0x14], esi
mov ebx, dword [edi]
sub dword [ebp - 8], edi
add ebx, esi
mov dword [ebp - 8], 0x863adef3
mov dword [edx], ebx
xor dword [ebp - 4], ecx
add edx, 4
add edi, 4
loop 0x6d4067d1
add eax, 0x30d1ac7b
add eax, 0xcf2f7fe4
mov ebx, eax
add eax, 0x9bcf282d
add eax, 0x6430d7d8
mov ecx, 0xe73a099e
add ecx, 0x8604f662
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x499f23
Capabilities:
Encode data using xor

Disassembly:
mov edx, edi
xor al, 0x73
stc
or bh, 0x7a
outsb dx, byte [esi]
dec esi
invalid
adc ah, byte [ebx - 0x422886ff]
sbb dh, bh
scasd eax, dword es:[edi]
push edx
dec eax
xchg ecx, eax
xor eax, 0x9e208300
jecxz 0x499f75
cwde
jmp 0x499ef3
not dword [esi]
in al, dx
cmpsb byte [esi], byte es:[edi]
stc
cmp al, 0x38
adc dword [ecx], ebx
pop ebx
jl 0x499fb2
sbb byte [ecx - 0x573f2166], 0xa5
and al, 0x35
loope 0x499fb5
enter 0x2341, 0x50
orps xmm7, xmm2
enter 0xffffffffffffa2a8, 0x48
dec ebp
imul esp, dword [edi + eax*4 - 0x31c9d220], 0x16eaca6c
jns 0x49a00c
mov dh, byte [0x2684df18]
xor dword [eax + 0x40], esp
lcall 0x7cfa, 0xe52ee432
or dh, al
dec esi
lodsd eax, dword [esi]
mov dl, byte [edi]
int3
in eax, 0xfa
jl 0x499fbf
invalid
int1
lahf
cmp ecx, dword [ebx + 0x6b]
insd dword es:[edi], dx
aas
push eax
xor eax, 0xba0a4c8e
mov dl, byte [esi]
inc ebp
push 0xf29ba3f
out 0x95, al
or al, 0xb7
pop edi
call 0x625e43e8
xor eax, 0xd549aa85
dec ebx
inc eax
xchg edx, eax
imul byte [0xb749a8f]
cmovp ebx, dword [ecx + 0x24814578]
jmp 0x49a01a
inc ebp
and dword [ebx + ebp*8], 0x25445d25
inc ebp
and al, 0xeb
and eax, 0x6525445d
inc ebp
sub ebx, esi
insb byte es:[edi], dx
loopne 0x499ff0
iretd
rcl byte [edi], 0x6b
shr byte [edx], 1
push 0xffffffffffffffb6
xrelease xchg byte [edx + 0x289126e8], ah
shr byte [ebx - 0x2d73f444], 0x5b
shr byte [ebx - 0x2d73f444], 0x5b
mov dword [0xb757bb4d], eax
jbe 0x499ff2
mov ebx, 0xc976b757
jnp 0x49a024
dec eax
jns 0x49a069
jae 0x49a059
int 0xcb
cdq
hlt
lodsb al, byte [esi]
int3
invalid
js 0x49a046
push cs
das
dec eax
sbb byte [0x49f292f5], ah
pop ebp
aam 0x66
push ebp
inc esp
enter 0x3cfc, 0x5b
cmp edx, 0xc54502f6
jl 0x49a01b
sub byte [ebp + 0x29], ah
movhps qword [esi + 0x55], xmm2
pop ss
push esi
push ebp
sbb cl, byte [edi + 0x65b04730]
movsd dword es:[edi], dword [esi]
sbb al, 0x17
xor byte [edi - 0x25], bl
jnp 0x49a089
retf