joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428e30
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x461020]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
push 0xf003f
push 0
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x428fe3
mov edx, 9
lea ecx, [esp + 0x14]
call fcn.004145d0
cmp dword [eax + 0x14], 0x10
jb 0x428e86
mov eax, dword [eax]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, dword [esp + 0x28]
mov esi, eax
cmp ecx, 0x10
jb 0x428ecb
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x428ec1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428ff7
push ecx
push edx
call fcn.0042b48a
add esp, 8
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xf
mov byte [esp + 0x14], 0
test esi, esi
jne 0x428eff
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042b459
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x428fd7
lea eax, [esp + 0x2c]
push eax
push 0x24
lea eax, [esp + 0x38]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x428fd7
cmp dword [esp + 0x34], 2
mov edi, dword [esp + 0x44]
jne 0x428fae
mov ecx, 0x2710
nop
mov eax, 0xcccccccd
mul dword [esp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x428f5b
mov edx, 0x3e8
jmp 0x428f64
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x2c]
push eax
push 0x24
lea eax, [esp + 0x38]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x428fae
cmp dword [esp + 0x44], edi
jbe 0x428f96
call ebx
mov edi, dword [esp + 0x44]
mov dword [esp + 0xc], eax
jmp 0x428fa2
call ebx
sub eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x48]
ja 0x428fae
cmp dword [esp + 0x34], 2
mov ecx, 0x2710
je 0x428f40
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [esp + 0x10]
call esi
cmp dword [esp + 0x34], 4
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042b459
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [esp + 0x54]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042b459
mov esp, ebp
pop ebp
ret
call fcn.0043042f
int3
Function at 0x42c44b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42c48a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c48a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c48a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42c48a
cmp dword [ecx + 0x74], 0xe
jbe 0x42c48a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43ca40
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45331c
push 0x453314
push str.FlsAlloc
push 0x1f
call fcn.0043c927
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43ca74
push dword [ebp + 8]
mov ecx, esi
call dword [0x44f23c]
call esi
jmp 0x43ca7a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43cabe
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45332c
push 0x453324
push str.FlsGetValue
push 0x21
call fcn.0043c927
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43caf5
push dword [ebp + 8]
mov ecx, esi
call dword [0x44f23c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x43cafd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x453334
push 0x45332c
push str.FlsSetValue
push 0x22
call fcn.0043c927
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43cb37
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x44f23c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x441882
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x461020]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4418cd
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00441a1d
test al, al
jne 0x4418c7
sub edx, 2
cmp edx, edi
jne 0x4418ad
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4418ef
lea eax, [edi + 2]
cmp edx, eax
je 0x4418ef
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004417ce
add esp, 0x10
jmp 0x4419e9
push esi
lea ecx, [ebp - 0x255]
call fcn.00441a1d
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x441932
push dword [ebp - 0x25c]
jmp 0x4418df
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x44196f
cmp word [ebp - 0x226], 0
je 0x441990
cmp word [ebp - 0x226], ax
jne 0x44196f
cmp word [ebp - 0x224], 0
je 0x441990
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004417ce
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4419dc
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x441949
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4419c4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4419e9
push 0x4415fe
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004483e0
add esp, 0x10
jmp 0x4419b9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b459
leave
ret

Function at 0x44480a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0043c300
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x444879
cmp esi, dword [ebp - 4]
je 0x444874
cmp dword [ebp + 0xc], 0
je 0x444874
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x444851
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0044435c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x44487b
xor eax, eax
inc eax
jmp 0x44487b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4448e0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x461020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0043c300
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0043c300
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x444957
cmp word [ecx], dx
je 0x444957
mov eax, dword [0x453bb4]
push edi
dec eax
push eax
push 0x453aa0
call fcn.0044487f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4449ca
cmp word [eax], dx
je 0x4449ca
mov eax, dword [edi]
test eax, eax
je 0x44497b
cmp word [eax], dx
je 0x44497b
lea eax, [ebp - 0x10]
push eax
call fcn.00444262
jmp 0x444984
lea eax, [ebp - 0x10]
push eax
call fcn.004442fd
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4449f4
mov eax, dword [0x453a9c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x453790
call fcn.0044487f
add esp, 0xc
test al, al
je 0x4449f4
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4449bf
cmp word [eax], di
je 0x4449bf
lea eax, [ebp - 0x10]
push eax
call fcn.00444262
pop ecx
jmp 0x4449f6
lea eax, [ebp - 0x10]
push eax
call fcn.004442fd
jmp 0x4449bc
mov eax, dword [edi]
test eax, eax
je 0x4449e1
cmp word [eax], dx
je 0x4449e1
lea eax, [ebp - 0x10]
push eax
call fcn.00444217
pop ecx
jmp 0x4449f4
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x444abf
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00444704
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x444abf
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x444abf
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x444abf
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x444a4c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0043cc3d
test ebx, ebx
je 0x444aba
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0043cc3d
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x444abf
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x444abf
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00448a80
add esp, 0x10
xor eax, eax
inc eax
jmp 0x444ac1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b459
leave
ret
Function at 0x449960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44998d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44998d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x37b3e00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
jmp 0x37b3e1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x37b3e21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x37b3e10
mov eax, 1
add ebx, ebx
jne 0x37b3e33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x37b3e44
jne 0x37b3e63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x37b3e63
dec eax
add ebx, ebx
jne 0x37b3e50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x37b3e28
add ebx, ebx
jne 0x37b3e5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x37b3eb5
xor ecx, ecx
sub eax, 3
jb 0x37b3e7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x37b3eea
sar eax, 1
mov ebp, eax
jmp 0x37b3e86
add ebx, ebx
jne 0x37b3e86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x37b3e54
inc ecx
add ebx, ebx
jne 0x37b3e94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x37b3e54
add ebx, ebx
jne 0x37b3ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x37b3e96
jne 0x37b3eb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x37b3e96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x37b3ed4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x37b3ec6
jmp 0x37b3e16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x37b3ed4
add edi, ecx
jmp 0x37b3e16
pop esi
mov edi, esi
mov ecx, 0x16e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x37b3ef2
cmp byte [edi], 0x48
jne 0x37b3ef2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x37b3ef7
mov ebp, dword [esi + 0x63034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x37b3f52
sub esp, 0xffffff80
jmp 0x3751924
Function at 0x40192b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x804]
mov ebx, 0x800
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [0x41a41c], 0
jne 0x4019d5
push str.DEPLOY_TRACE_NATIVE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
test eax, eax
je 0x4019d5
push esi
call fcn.004018f3
mov esi, eax
test esi, esi
je 0x4019d4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push edi
push 0x40e42c
push esi
push str._s_s_s__ld.trace
push ebx
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00402e4c
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea eax, [ebp - 0x804]
push 0x40e444
push eax
call fcn.004018ca
mov ecx, dword [0x41a41c]
xor edx, edx
inc edx
mov dword [0x41a420], eax
add esp, 0x2c
test eax, eax
cmovne ecx, edx
mov dword [0x41a41c], ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040bc01
leave
ret
Function at 0x401eac
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x1d5c
call fcn.0040bc20
mov eax, dword [0x41a174]
xor eax, esp
mov dword [esp + 0x1d58], eax
mov eax, dword [esp + 0x1d64]
push ebx
push esi
mov esi, dword [esp + 0x1d68]
mov ebx, 0x1000
push edi
push ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0xd68]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, 0x800
lea eax, [esp + 0x570]
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [esp + 0x564]
push edi
push eax
push 0x40e560
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401f3a
cmp eax, edi
jae 0x401f3a
lea eax, [esp + 0x564]
push eax
lea eax, [esp + 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401f4c
push ebx
lea eax, [esp + 0xd68]
push eax
push esi
call fcn.004062cb
add esp, 0xc
lea eax, [esp + 0xd64]
push 0x40e570
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4020e2
push ebp
mov ebx, 0x104
push ebx
push eax
lea eax, [esp + 0x46c]
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
lea eax, [esp + 0x26c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [esp + 0x464]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x464]
push eax
lea eax, [esp + 0x260]
push 0x40e584
push eax
call fcn.00402f35
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x24]
add esp, 0xc
push eax
lea eax, [esp + 0x260]
push eax
call edi
push ebx
mov ebp, eax
lea eax, [esp + 0x364]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
lea eax, [esp + 0x168]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [esp + 0x360]
push ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x360]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
pop ecx
pop ecx
test eax, eax
je 0x402020
mov byte [eax], 0
lea eax, [esp + 0x360]
push eax
lea eax, [esp + 0x15c]
push 0x40e5a8
push eax
call fcn.00402f35
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x15c]
push eax
call edi
mov ebx, eax
cmp ebp, 0xffffffff
jne 0x40207a
cmp ebx, ebp
je 0x4020e1
lea eax, [esp + 0x158]
mov edi, 0x41a438
push eax
push esi
push 0x40e5f4
push edi
call fcn.00402f35
add esp, 0x10
push ebx
jmp 0x4020c9
mov edi, 0x41a438
cmp ebx, 0xffffffff
je 0x4020b1
lea eax, [esp + 0x158]
push eax
lea eax, [esp + 0x260]
push eax
push esi
push 0x40e5b0
push edi
call fcn.00402f35
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0x14
push ebp
call esi
push ebx
call esi
jmp 0x4020cf
lea eax, [esp + 0x25c]
push eax
push esi
push 0x40e5d4
push edi
call fcn.00402f35
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], edi
call fcn.00402d2c
pop ebp
mov ecx, dword [esp + 0x1d64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040bc01
add esp, 0x1d5c
ret
Function at 0x4020fa
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x41a174]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
mov esi, dword [esp + 0x220]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x220]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00401dba
add esp, 0x18
test eax, eax
jne 0x402159
push edi
push str.Error_during_getting_jre_home..._jp2launcherpath__s_n
call fcn.00401a09
pop ecx
pop ecx
xor eax, eax
jmp 0x402215
push ebp
lea eax, [esp + 0x14]
mov edi, 0x41a748
push eax
push eax
push eax
push str._Xbootclasspath_a:__slibdeploy.jar____slibjavaws.jar____slibplugin.jar_
push 0x410
push edi
call fcn.00402e32
add esp, 0x18
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00402d2c
lea eax, [esp + 0x14]
mov ebp, 0x208
push eax
push str._Djava.class.path__sclasses_
push ebp
mov edi, 0x41ab58
push edi
call fcn.00402e32
add esp, 0x10
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00402d2c
push ebx
lea eax, [esp + 0x11c]
push eax
push 0x40e66c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x402204
cmp eax, ebx
jae 0x402204
lea eax, [esp + 0x118]
mov edi, 0x41ad60
push eax
push 0x40e6e0
push 0x40e6f8
push ebp
push edi
call fcn.00402e32
add esp, 0x14
mov dword [esp + 0x10], edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00402d2c
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00401eac
pop ecx
pop ecx
xor eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040bc01
add esp, 0x210
ret

Function at 0x402743
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbslen]
push 0x40e78c
call edi
lea esi, [eax + 0x105]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4027b0
push esi
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
jne 0x4027b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x4027a5
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40278a
mov esi, str.JavaLow
push ebx
push dword [esp + 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
inc eax
pop ecx
pop edi
pop esi
pop ebx
ret
cmp esi, 0x104
jbe 0x402787
push 0x40e798
call edi
inc eax
add eax, esi
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 0xc
xor ebx, ebx
push esi
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x402787
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x4027af
Function at 0x4057a3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x41af74], 0
je 0x4057c6
mov al, byte [0x41af75]
jmp 0x405819
push ebx
push 0x90
xor ebx, ebx
lea eax, [ebp - 0x94]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x405809
cmp dword [ebp - 0x94], 6
jb 0x405809
mov bl, 1
mov byte [0x41af75], bl
mov al, bl
mov byte [0x41af74], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bc01
leave
ret

Function at 0x405b2e
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x405b3d
mov eax, dword [esi]
cmp byte [eax], 0x2d
je 0x405b46
xor al, al
pop esi
ret
push str._Dsun.plugin2.jvm.args
push 0x16
push 0
mov ecx, esi
call fcn.0040433b
test eax, eax
jne 0x405b72
push str.Invalid_argument_1_n
call fcn.00401a09
pop ecx
call fcn.004019e9
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405b7c
mov eax, dword [esi]
push dword [esp + 0xc]
push eax
call fcn.004067b1
pop ecx
pop ecx
test al, al
jne 0x405b99
push str.Invalid_argument_2_n
call fcn.00401a09
pop ecx
jmp 0x405b42
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405ba3
mov eax, dword [esi]
push eax
call fcn.0040606c
pop ecx
test al, al
je 0x405bcf
cmp dword [esi + 0x14], 0x10
jb 0x405bb6
mov esi, dword [esi]
push esi
call fcn.0040600b
push eax
call fcn.00405825
pop ecx
pop ecx
test al, al
jne 0x405bcf
push str.Invalid_argument_3_n
jmp 0x405b5f
mov al, 1
pop esi
ret
Function at 0x405ebf
Capabilities:
Query environment variable

Disassembly:
push 0x24
mov eax, 0x40d7b5
call fcn.0040bcee
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
call fcn.00404e7d
mov esi, dword [ebp - 0x30]
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x405f3d
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405ef1
mov eax, dword [esi]
push eax
push str._Dsun.java2d.noddraw
call fcn.00406fbb
pop ecx
pop ecx
cmp eax, 1
je 0x405f44
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405f0d
mov eax, dword [esi]
push eax
push str._Dsun.java2d.d3d
call fcn.00406fbb
pop ecx
pop ecx
test eax, eax
je 0x405f44
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405f28
mov eax, dword [esi]
push eax
push str._Dsun.java2d.opengl
call fcn.00406fbb
pop ecx
pop ecx
cmp eax, 1
je 0x405f44
add esi, 0x18
cmp esi, dword [ebp - 0x2c]
jne 0x405ee7
jmp 0x405f4a
mov dword [0x419ce0], ebx
cmp dword [0x419ce0], ebx
je 0x405fe6
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
push str.J2D_D3D
call edi
mov esi, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x405f98
cmp eax, 0x10
jae 0x405f98
lea eax, [ebp - 0x20]
push 0x40f7c0
push eax
call esi
neg eax
pop ecx
sbb eax, eax
and dword [0x419ce0], eax
pop ecx
push 0x10
lea eax, [ebp - 0x20]
push eax
push str.J2D_D3D_PRELOAD
call edi
test eax, eax
je 0x405fcc
cmp eax, 0x10
jae 0x405fcc
lea eax, [ebp - 0x20]
push 0x40f7d8
push eax
call esi
neg eax
pop ecx
sbb eax, eax
and eax, dword [0x419ce0]
pop ecx
mov dword [0x419ce0], eax
jmp 0x405fd1
mov eax, dword [0x419ce0]
test eax, eax
je 0x405fe6
push dword [ebp - 0x24]
push str.preloadD3D
call fcn.00406fff
pop ecx
pop ecx
mov ebx, eax
lea ecx, [ebp - 0x30]
call fcn.0040422a
mov eax, ebx
call fcn.0040bca9
ret