joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ddb6
Capabilities:
Delete registry value

Disassembly:
push 0x28
mov eax, 0x100ccf2d
call fcn.1005e1c7
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov edi, 0x20019
mov byte [ebp - 4], 1
push edi
push 0x100ebd94
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x28]
call fcn.100c0f6c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1001decb
push edi
push 0x100ebe48
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.100c0f6c
test eax, eax
jne 0x1001deb0
lea eax, [ebp - 0x1c]
push 0x100ebe5c
push eax
call fcn.1001df93
pop ecx
pop ecx
test eax, eax
je 0x1001de91
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
push 0x20006
push 0x100ebe78
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.100c0f6c
mov edi, dword [ebp - 0x34]
test eax, eax
je 0x1001de67
push str.DeleteEmptyDeploymentKeysInHLKM:_failed_to_open_JRE_key
call fcn.100c0f6c
jmp 0x1001de89
push 0x100ebf40
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ecx
mov ecx, esp
mov esi, eax
push str.DeleteEmptyDeploymentKeysInHLKM:_Remove_BrowserJavaVersion_value
call fcn.10001719
push esi
call fcn.1001cae2
pop ecx
pop ecx
test edi, edi
je 0x1001de91
push edi
call ebx
lea eax, [ebp - 0x1c]
push str.Java_Web_Start
push eax
call fcn.1001df93
lea eax, [ebp - 0x1c]
push str.Java_Web_Start_Caps
push eax
call fcn.1001df93
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x100ec034
push eax
call fcn.1001df93
cmp dword [ebp - 0x1c], 0
pop ecx
pop ecx
je 0x1001decb
push dword [ebp - 0x1c]
call ebx
cmp dword [ebp - 0x28], 0
je 0x1001ded6
push dword [ebp - 0x28]
call ebx
call fcn.1005e195
ret

Function at 0x1001dedc
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x804
mov eax, dword [0x10130aa4]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
push esi
mov ebp, 0x800
lea eax, [esp + 8]
push ebp
push 0
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [esp + 8]
xor esi, esi
push 0x400
push eax
push esi
jmp 0x1001df5f
push 0xa
lea eax, [esp + 0xc]
push str.JavaPlugin
push eax
call fcn.100c0f6c
add esp, 0xc
test eax, eax
jne 0x1001df43
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x814]
call fcn.10017e54
test eax, eax
je 0x1001df44
inc esi
push ebp
lea eax, [esp + 0xc]
push 0
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [esp + 8]
push 0x400
push eax
push esi
push dword [esp + 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1001df16
lea ecx, [esp + 0x810]
call fcn.10017647
mov ecx, dword [esp + 0x808]
pop esi
pop ebp
xor ecx, esp
call fcn.1005e187
add esp, 0x804
ret
Function at 0x1001df93
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x814
mov eax, dword [0x10130aa4]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
mov ebx, dword [esp + 0x820]
lea eax, [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x820]
push esi
push edi
xor esi, esi
mov dword [esp + 0x10], ebx
push 0x800
push esi
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.100621d0
add esp, 0xc
lea ecx, [esp + 0x14]
push 0x2001f
push ebx
push dword [ebp]
call fcn.100c0f6c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x1001e031
push 0x400
lea eax, [esp + 0x24]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1001e03a
test edi, edi
je 0x1001e01d
push edi
call ebx
mov edi, esi
push dword [esp + 0x10]
mov ecx, ebp
call fcn.100176df
test eax, eax
jne 0x1001e03a
xor esi, esi
inc esi
jmp 0x1001e03a
xor ecx, ecx
inc ecx
cmp eax, 2
cmove esi, ecx
test edi, edi
je 0x1001e041
push edi
call ebx
mov ecx, dword [esp + 0x820]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005e187
add esp, 0x814
ret
Function at 0x1001e165
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100ccf87
call fcn.1005e1c7
lea eax, [ebp - 0x1c]
push eax
call fcn.100c0f6c
pop ecx
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1001e18d
lock inc dword [esi + 8]
push 0x100e8fec
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x1001e1be
call fcn.10001b13
push 0x100e8dd4
lea ecx, [ebp - 0x10]
call fcn.10001719
push 0x100e8f84
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x1001e1fc
call fcn.10001b13
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
push 0x100e9004
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x1001e235
call fcn.10001b13
push str.__wait__fix__shortcut__silent
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1001e25e
call fcn.10001b13
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.100621d0
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x2c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x1001e284
mov ecx, dword [esi]
jmp 0x1001e286
xor ecx, ecx
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x1001e291
mov edx, dword [edi]
jmp 0x1001e293
xor edx, edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001e29e
mov eax, dword [eax]
jmp 0x1001e2a0
xor eax, eax
lea ebx, [ebp - 0x2c]
push ebx
lea ebx, [ebp - 0x70]
push ebx
push ecx
xor ecx, ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x1001e2f5
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001e2e5
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.10029b75
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
test edi, edi
je 0x1001e300
mov ecx, edi
call fcn.10001b13
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001e30e
mov ecx, eax
call fcn.10001b13
test esi, esi
je 0x1001e319
mov ecx, esi
call fcn.10001b13
call fcn.1005e195
ret
Function at 0x1001ed78
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1005e2a0
push 0xffffffffffffffff
push 0x100cd0a6
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x100c]
lea eax, [ebp]
xor ebx, ebx
mov dword [ebp - 0x30], edi
push 0x1000
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
call fcn.100621d0
add esp, 0xc
mov ecx, edi
push 0x100e43ca
call fcn.1000dcc0
xor eax, eax
mov dword [ebp - 0x2c], ebx
inc eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
push str.GetLatestJavawsVersion__:
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0x800
call fcn.100c0f6c
pop ecx
cmp dword [ebp + 0x1010], ebx
je 0x1001ee1f
mov esi, 0x20219
mov eax, str.___checking_32_bit
jmp 0x1001ee29
mov esi, 0x20119
mov eax, str.___checking_64_bit
push eax
call fcn.100c0f6c
pop ecx
push esi
push 0x100e60b0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
call fcn.100c0f6c
mov ebx, dword [ebp - 0x2c]
test eax, eax
je 0x1001ee85
push str.___failed_to_open_SOFTWAREJavaSoftJava_Web_Start
call fcn.100c0f6c
pop ecx
test ebx, ebx
je 0x1001ee60
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x1004
leave
ret
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1001ee55
push str.___Processing_key:
lea ecx, [ebp - 0x18]
call fcn.1000dcc0
lea eax, [ebp]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10001719
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x18]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x1001eee7
call fcn.10001b13
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x1001eef2
mov eax, dword [esi]
jmp 0x1001eef4
xor eax, eax
push eax
call fcn.100c0f6c
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.100292d1
add esp, 0xc
test eax, eax
jne 0x1001ef44
lea eax, [ebp + 0x1010]
push eax
lea eax, [ebp]
push eax
call fcn.10028ea9
pop ecx
pop ecx
test eax, eax
jne 0x1001ef44
push 0x100e6178
call fcn.100c0f6c
lea eax, [ebp]
push eax
call fcn.100c0f6c
pop ecx
xor eax, eax
pop ecx
mov word [ebp], ax
jmp 0x1001ef6b
mov eax, dword [edi]
test eax, eax
je 0x1001ef4e
mov eax, dword [eax]
jmp 0x1001ef50
xor eax, eax
push eax
lea eax, [ebp]
push eax
call fcn.100c0f6c
pop ecx
pop ecx
test eax, eax
jle 0x1001ef6b
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.100017b4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], 0x800
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test esi, esi
je 0x1001ee88
mov ecx, esi
call fcn.10001b13
and dword [ebp - 0x18], 0
jmp 0x1001ee85
Function at 0x1001f106
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x100cd172
call fcn.1005e1c7
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
call fcn.1003428b
test eax, eax
je 0x1001f151
call fcn.100c0f6c
test eax, eax
je 0x1001f143
call fcn.100c0f6c
test eax, eax
je 0x1001f143
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
jmp 0x1001f15d
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x1001f15d
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push str.__get_system_dir__
lea ecx, [ebp + 8]
mov edi, eax
call fcn.1000dcc0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push esi
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f199
call fcn.10001b13
push 0x100e4ed8
lea ecx, [ebp - 0x10]
call fcn.1000dcc0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 8]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f1c6
call fcn.10001b13
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x1001f1d6
lock inc dword [esi + 8]
test edi, edi
setne al
movzx eax, al
push eax
call fcn.1001cdef
pop ecx
pop ecx
test esi, esi
je 0x1001f1f1
mov ecx, esi
call fcn.10001b13
mov eax, edi
call fcn.1005e195
ret
Function at 0x1001f526
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1005e2a0
push 0xffffffffffffffff
push 0x100cd23e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
push 0x20019
push edi
push 0x100e4530
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001f5df
push 0x100e4568
lea ecx, [ebp - 0x10]
call fcn.1000dcc0
push 0x100e45a0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.10001719
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001f5bb
call fcn.10001b13
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1001f5c4
mov edi, dword [esi]
push edi
call fcn.100c0f6c
pop ecx
test esi, esi
je 0x1001f6e6
mov ecx, esi
call fcn.10001b13
jmp 0x1001f6e6
push 0x1000
lea eax, [ebp]
mov dword [ebp - 0x18], 0x800
push edi
push eax
call fcn.100621d0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x100e4584
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001f6db
push str._WebJava_value:
lea ecx, [ebp - 0x14]
call fcn.1000dcc0
lea eax, [ebp]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001f657
call fcn.10001b13
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1001f662
mov eax, dword [esi]
jmp 0x1001f664
mov eax, edi
push eax
call fcn.100c0f6c
pop ecx
lea ecx, [ebp]
mov eax, 0x100e460c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001f697
test dx, dx
je 0x1001f69c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001f697
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001f673
jmp 0x1001f69c
sbb edi, edi
or edi, 1
test edi, edi
jne 0x1001f6bb
push str._System_WebJava_DISABLED
call fcn.100c0f6c
pop ecx
test esi, esi
je 0x1001f6b6
mov ecx, esi
call fcn.10001b13
xor eax, eax
inc eax
jmp 0x1001f6e8
test esi, esi
je 0x1001f6db
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001f6db
mov ecx, esi
call fcn.10001b86
push 0xc
push esi
call fcn.100c0f6c
pop ecx
pop ecx
push str._System_WebJava_ENABLED
call fcn.100c0f6c
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x1004
leave
ret
Function at 0x10022c78
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa4
or dword [esp + 4], 0xffffffff
push ebx
mov ebx, dword [esp + 0xac]
test ebx, ebx
jne 0x10022c97
or eax, 0xffffffff
jmp 0x10022e02
call fcn.100337a3
push 0x10
mov dword [esp + 8], eax
lea ecx, [esp + 0x10]
pop edx
mov byte [ecx], 0
inc ecx
sub edx, 1
jne 0x10022ca7
push ebp
push esi
push edi
xor esi, esi
call fcn.100342ee
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x10022d70
push 0x100e5978
call fcn.100c0f6c
mov dword [esp], str.AdvAPI32.dll
call fcn.100c0f6c
mov esi, eax
pop ecx
test esi, esi
jne 0x10022cec
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_load_advapi32.dll
jmp 0x10022d05
push str.CreateProcessWithTokenW
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x10022d14
push str.RunAsDesktopUser___CreateProcessWithTokenW_could_not_GetProcAddress
call fcn.100c0f6c
mov ebx, dword [esp + 0x14]
pop ecx
jmp 0x10022df1
push str.RunAsDesktopUser___calling__CreateProcessWithTokenW
call fcn.100c0f6c
pop ecx
push 0x44
pop ebp
mov ecx, ebp
lea eax, [esp + 0x70]
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x10022d2a
lea eax, [esp + 0x18]
mov dword [esp + 0x70], ebp
push eax
lea eax, [esp + 0x74]
push eax
push edx
push edx
push edx
push dword [esp + 0xd0]
push ebx
mov ebx, dword [esp + 0x2c]
push edx
push ebx
call dword [esp + 0x4c]
test eax, eax
jne 0x10022d69
push str.RunAsDesktopUser:_CreateProcessWithTokenW_failed.
call fcn.100c0f6c
pop ecx
jmp 0x10022df1
cmp dword [esp + 0x18], 0
jmp 0x10022dce
push 0x100e5be0
call fcn.100c0f6c
push 0x44
pop ebp
push ebp
lea eax, [esp + 0x34]
push 0
push eax
call fcn.100621d0
add esp, 0x10
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x34], str.winsta0default
push eax
lea eax, [esp + 0x30]
push eax
xor eax, eax
push eax
push eax
push 0x30
push eax
push eax
push eax
push dword [esp + 0xdc]
push ebx
mov ebx, dword [esp + 0x38]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10022dca
push str.RunAsDesktopUser:_CreateProcessAsUser_failed.
jmp 0x10022d5e
cmp dword [esp + 0x18], esi
je 0x10022df1
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [esp + 0x18]
call edi
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call edi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x100263f2
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100cdcb5
call fcn.1005e1c7
lea eax, [ebp - 0x1c]
push eax
call fcn.100c0f6c
pop ecx
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1002641a
lock inc dword [esi + 8]
push 0x100e8f6c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001719
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.1000186b
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x1002644b
call fcn.10001b13
push 0x100e8bfc
lea ecx, [ebp - 0x10]
call fcn.10001719
push 0x100e8c7c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10026489
call fcn.10001b13
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
push 0x100e8d44
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x100264c2
call fcn.10001b13
push 0x100e9008
lea ecx, [ebp - 0x18]
call fcn.10001719
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100264eb
call fcn.10001b13
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.100621d0
mov dword [ebp - 0x70], edi
xor eax, eax
lea edi, [ebp - 0x2c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10026511
mov ecx, dword [esi]
jmp 0x10026513
xor ecx, ecx
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x1002651e
mov edx, dword [edi]
jmp 0x10026520
xor edx, edx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002652b
mov eax, dword [eax]
jmp 0x1002652d
xor eax, eax
lea ebx, [ebp - 0x2c]
push ebx
lea ebx, [ebp - 0x70]
push ebx
push ecx
xor ecx, ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x10026582
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10026572
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.10029b75
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
call ebx
push dword [ebp - 0x2c]
call ebx
test edi, edi
je 0x1002658d
mov ecx, edi
call fcn.10001b13
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002659b
mov ecx, eax
call fcn.10001b13
test esi, esi
je 0x100265a6
mov ecx, esi
call fcn.10001b13
call fcn.1005e195
ret
Function at 0x10026fa1
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x100cdddf
call fcn.1005e1c7
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 0x2001f
push str.SOFTWAREOracleJavaFX
xor edi, edi
mov dword [ebp - 4], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
inc edi
call fcn.100c0f6c
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x10027017
push str.Disabled
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test ebx, ebx
je 0x1002700a
cmp ebx, 2
je 0x1002700a
push ecx
mov ecx, esp
push str.cleanupJavaFXDisabledEntry_error
call fcn.10001719
push ebx
call fcn.1001cae2
pop ecx
pop ecx
xor edi, edi
test esi, esi
je 0x10027022
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test esi, esi
je 0x10027022
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.1005e195
ret
Function at 0x10027fa5
Capabilities:
Get file version info

Disassembly:
push 0x24
mov eax, 0x100ce158
call fcn.1005e1c7
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x10028100
call dword [sym.imp.kernel32.dll_GetLastError]
push str.GetFileVersion_for__
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.1000dcc0
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10001719
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x1002800b
call fcn.10001b13
push str.__FAILED
lea ecx, [ebp - 0x14]
call fcn.1000dcc0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x10028037
call fcn.10001b13
lea ecx, [ebp - 0x14]
cmp esi, 2
jne 0x1002804f
push str.__file_does_not_exist_
call fcn.1000dcc0
mov byte [ebp - 4], 3
jmp 0x100280c9
push 0x100e4c50
call fcn.1000dcc0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10028075
call fcn.10001b13
push 0x13
pop eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x14]
call fcn.1001d194
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100280ab
call fcn.10001b13
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x30]
mov byte [ebp - 4], bl
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x100e4c60
lea ecx, [ebp - 0x14]
call fcn.1000dcc0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000186b
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100280e1
call fcn.10001b13
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x100280ea
mov ebx, dword [esi]
push ebx
call fcn.100c0f6c
pop ecx
test esi, esi
je 0x100280fc
mov ecx, esi
call fcn.10001b13
xor eax, eax
jmp 0x10028149
push esi
call fcn.100c0f6c
pop ecx
mov edi, eax
push edi
push esi
push 0
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x10028146
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x100e4c64
push edi
call sub.version.dll_VerQueryValueW
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
movzx eax, word [edx + 0xa]
mov dword [ecx], eax
movzx eax, word [edx + 8]
mov dword [ecx + 4], eax
movzx eax, word [edx + 0xe]
mov dword [ecx + 8], eax
xor eax, eax
inc eax
call fcn.1005e195
ret
Function at 0x10029b75
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x108c]
mov eax, 0x110c
call fcn.1005e2a0
mov eax, dword [0x10130aa4]
xor eax, ebp
mov dword [ebp + 0x1088], eax
lea eax, [ebp - 0x80]
push eax
push 0x1000
lea eax, [ebp - 0x7c]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10029c0f
mov eax, dword [ebp - 0x80]
shr eax, 2
push esi
xor esi, esi
mov dword [ebp - 0x80], eax
test eax, eax
je 0x10029c0e
push edi
push dword [ebp + esi*4 - 0x7c]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp + 0xf84]
push 0x104
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameA
lea eax, [ebp + 0xf84]
push 0x100e8dc4
push eax
call fcn.10065fd0
pop ecx
pop ecx
test eax, eax
je 0x10029c00
push 0
push edi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x80]
jb 0x10029bbb
pop edi
pop esi
mov ecx, dword [ebp + 0x1088]
xor ecx, ebp
call fcn.1005e187
add ebp, 0x108c
leave
ret