joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ecc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x441008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.004173b0
add esp, 0xc
mov dword [ebp - 0x20c], pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x412f30
push ecx
lea ecx, [ebp - 0x204]
call fcn.00404e05
pop ecx
test al, al
je 0x412f30
mov al, 1
jmp 0x412f75
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], ebx
push eax
push 0x64
push ebx
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov esi, dword [ebp - 0x208]
test eax, eax
jne 0x412f6b
cmp dword [esi + 8], ebx
je 0x412f6b
push str.google
push dword [esi + 8]
call fcn.0042416c
pop ecx
pop ecx
test eax, eax
jne 0x412f6b
mov bl, 1
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov al, bl
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041682f
leave
ret

Function at 0x414057
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov byte [ebp - 1], cl
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00413c3b
test eax, eax
js 0x414179
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
je 0x414179
call fcn.0041259f
cmp byte [ebp - 1], 0
mov eax, str.HKLMSoftwareGoogleUpdate_
jne 0x41409f
mov eax, str.HKCUSoftwareGoogleUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.00403f59
push 0x43dac8
lea ecx, [ebp - 0xc]
call fcn.00403f59
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.00403856
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.004015e6
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004015ce
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.004015ce
mov esi, dword [ebp - 8]
mov ecx, esi
call fcn.00407b7e
test al, al
jne 0x414100
mov cl, byte [ebp - 1]
mov dl, 1
call fcn.0041418b
mov edi, eax
jmp 0x41416b
push 1
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x43a948
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 0x200
call fcn.004076ce
mov edi, eax
test edi, edi
js 0x41415c
mov eax, dword [ebp - 0x1c]
xor edi, edi
sub ebx, eax
sar ebx, 2
test ebx, ebx
je 0x414150
push 0
push 0
push 0
push 0
push dword [eax + edi*4]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x414175
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x414130
mov cl, byte [ebp - 1]
xor dl, dl
call fcn.0041418b
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x43a948
call fcn.00407571
lea ecx, [esi - 0x10]
call fcn.004015ce
jmp 0x41417c
xor edi, edi
jmp 0x41415c
xor edi, edi
inc edi
lea ecx, [ebp - 0x1c]
call fcn.00404ba7
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41531d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x441a1c
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
push 0x441a1c
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov dword [ebp + 8], eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 8], 0
jne 0x41535f
test ebx, ebx
je 0x4153bd
lea ebx, [edi + 0x1c]
mov ecx, edi
push ebx
push str.Counts
call fcn.004152f4
test al, al
je 0x4153bd
push dword [esi + 4]
lea ecx, [ebp - 4]
call fcn.00405320
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
xor edi, edi
mov edx, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.004155e6
mov eax, dword [ebp + 8]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
adc dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
pop ecx
push 8
push eax
push 3
push edi
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esi - 0x10]
call fcn.004015ce
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1009e50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x1009e72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1009e79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1009e68
mov eax, 1
add ebx, ebx
jne 0x1009e8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1009e80
jne 0x1009e9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1009e80
xor ecx, ecx
sub eax, 3
jb 0x1009eb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1009f22
mov ebp, eax
add ebx, ebx
jne 0x1009ebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1009ec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1009eec
inc ecx
add ebx, ebx
jne 0x1009ed8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1009ecd
jne 0x1009ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1009ecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1009f0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1009efd
jmp 0x1009e6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1009f0c
add edi, ecx
jmp 0x1009e6e
pop esi
mov edi, esi
mov ecx, 0x14d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1009f2a
cmp byte [edi], 1
jne 0x1009f2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1009f2f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x1009fa7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x99b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9a3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1009f5c
mov ecx, edi
jns 0x1009f8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9a40]
or eax, eax
je 0x1009fa1
mov dword [ebx], eax
add ebx, 4
jmp 0x1009f79
call dword [esi + 0x9a50]
mov ebp, dword [esi + 0x9a44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1009fdb
sub esp, 0xffffff80
jmp 0x1003b8e
Function at 0x6d4d2864
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x6d4d2873
pop dword [ebp - 0x34]
mov eax, 0x7df3aa0e
add eax, 0xef597e65
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xb7807167
sub dword [ebp - 0x44], 0x692e2c1c
mov dword [ebp - 0x40], 0xbf3d1dd
add dword [ebp - 0x40], 0x263f7a68
mov dword [ebp - 0x3c], 0x8840e85c
add dword [ebp - 0x3c], 0xc40b5bd2
mov dword [ebp - 0x38], 0x51c1be66
sub dword [ebp - 0x38], 0x51c1be66
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2cb0671f
add dword [ebp - 0x44], 0x47c20237
mov dword [ebp - 0x40], 0x8cca4605
add dword [ebp - 0x40], 0xb4a21b70
mov dword [ebp - 0x3c], 0xbebe196c
add dword [ebp - 0x3c], 0xa4b15300
mov dword [ebp - 0x38], 0x9d6028eb
add dword [ebp - 0x38], 0x629fd715
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x574941a2
add eax, 0x16059eb2
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c9a3
push 0
call eax
mov ecx, 0x4070
xor edx, edx
add edx, eax
mov edi, 0x4545e815
sub edi, 0xd7f64c15
add edi, dword [ebp - 0x34]
mov esi, 0xcfdcad5e
add esi, 0x8b61c2a1
mov ebx, dword [edi]
add dword [ebp - 0x20], eax
sub ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x14], eax
add edx, 4
add edi, 4
loop 0x6d4d298c
add eax, 0x36e50aaa
add eax, 0xc91be9e9
xor ebx, ebx
add ebx, eax
add eax, 0xc873f530
sub eax, 0xc873f52b
mov ecx, 0x6d4d0000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x6d4ed4ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d4f5200]
jne 0x6d4ed4f6
repz ret
jmp fcn.6d4ed963

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
mov eax, 1
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
mov ecx, edi
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x8241ba0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x8246b14]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x8241bd9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret
mov ecx, dword [str._C__b]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x8224338
lea eax, [ebp - 0x318]
push 0x20a
push eax
call fcn.08224770
add esp, 0x14
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret

Function at 0x8241e64
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x8246b14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x822434c
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8241f39
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8241f28
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x8241f12
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x8241f28
push eax
push edi
push dword [ebp - 0x110]
call fcn.08241dfc
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x8241f3b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.08241664
leave
ret 4
Function at 0x100023fd
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
je 0x1000240f
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
jmp 0x10002415
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call fcn.1000eea0
mov esi, eax
pop ecx
cmp esi, edi
je 0x1000243f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x29c]
push esi
mov edi, eax
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x1000244d
push str.memory_allocation_error
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowOutOfMemoryError_8
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x10006ed9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xe0
mov eax, dword [0x1001cf10]
xor eax, ebp
mov dword [ebp + 0x74], eax
push edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
xor edi, edi
and dword [ebp - 0x5c], edi
push edi
push str.SystemCurrentControlSetControlTimeZoneInformation
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006f4f
and dword [ebp - 0x60], edi
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push str.ActiveTimeBias
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x10006f41
mov edi, dword [ebp - 0x68]
push dword [ebp - 0x5c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
pop ebx
je 0x10006f61
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.kernel32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x10006f61
mov edi, dword [ebp - 0x58]
lea eax, [ebp + 0x54]
push eax
mov eax, edi
call fcn.100067f8
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.msvcr100.dll__strdup]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop edi
call fcn.100122d0
add ebp, 0x78
leave
ret

Function at 0x10007644
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
push edi
xor ebx, ebx
push ebx
push 1
push ebx
mov edi, str.J2SE
push edi
lea eax, [ebp - 8]
push eax
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x1000767f
push 8
push 1
push ebx
push edi
lea eax, [ebp - 8]
push eax
call esi
test eax, eax
jne 0x1000767f
xor al, al
jmp 0x100076d4
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x2ac]
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x2e0]
mov edi, eax
cmp edi, ebx
je 0x100076c7
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptGenRandom]
test eax, eax
je 0x100076b9
mov byte [ebp - 1], 1
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x10]
push esi
call dword [eax + 0x300]
push ebx
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10007e22
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [0x1001cf68]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.1000a207
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10007e43
xor al, al
jmp 0x10007e74
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push eax
push esi
call fcn.1000eea0
push esi
mov ebx, eax
call dword [sym.imp.msvcr100.dll_free]
add esp, 0xc
cmp ebx, 0xffffffff
je 0x10007e83
mov eax, dword [esp + 0x18]
dec eax
je 0x10007e71
dec eax
je 0x10007e78
dec eax
dec eax
jne 0x10007e83
mov al, 1
pop ebx
pop esi
ret 0x10
mov al, 1
test bl, 0x10
jne 0x10007e73
test al, bl
je 0x10007e73
xor al, al
jmp 0x10007e73
Function at 0x10007e87
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 4
push edi
mov byte [ebp - 1], 0
je 0x10007f2d
cmp dword [ebp + 0x14], 1
je 0x10007f2d
push dword [0x1001cf68]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.1000a207
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10007ec2
xor al, al
jmp 0x10007f30
push esi
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
push edi
call esi
cmp eax, 0xffffffff
je 0x10007f1f
push ebx
test eax, 0x400
je 0x10007ef7
push edi
push dword [ebp + 8]
call fcn.1000773c
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10007f1e
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
push ebx
mov edi, ebx
call esi
cmp eax, 0xffffffff
je 0x10007f1e
test al, 0x10
jne 0x10007f1e
cmp byte [ebp + 0x18], 0
je 0x10007f0b
and eax, 0xfffffffe
jmp 0x10007f0e
or eax, 1
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x10007f1e
mov byte [ebp - 1], 1
pop ebx
push edi
call dword [sym.imp.msvcr100.dll_free]
mov al, byte [ebp - 1]
pop ecx
pop esi
jmp 0x10007f30
mov al, byte [ebp + 0x18]
pop edi
leave
ret 0x18

Function at 0x10008088
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000eea0
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x100080a7
xor al, al
jmp 0x10008123
push esi
call fcn.1000eea0
pop ecx
test eax, eax
je 0x100080bc
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x100080a3
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008112
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x100080b2
cmp edi, 0xb7
je 0x100080b2
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100080b2
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
jmp 0x100080b2
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
ret 0xc

Function at 0x10008128
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push dword [0x1001cf68]
xor bl, bl
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a207
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000814c
xor al, al
jmp 0x1000818c
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10008182
push esi
test al, 0x10
je 0x10008171
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x10008177
call dword [sym.imp.kernel32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x10008182
mov bl, 1
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
ret 0xc