joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401c66
pop dword [ebp - 0x20]
mov eax, 0x7b6b89cd
sub eax, 0x7b2b6d67
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9073a055
sub dword [ebp - 0x30], 0x42215b0a
mov dword [ebp - 0x2c], 0x3fb48c14
add dword [ebp - 0x2c], 0xf27ec031
mov dword [ebp - 0x28], 0xab684aa2
add dword [ebp - 0x28], 0xa0e3f98c
mov dword [ebp - 0x24], 0xdeea03a0
add dword [ebp - 0x24], 0x2115fc60
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xd8d959ae
add dword [ebp - 0x30], 0x9b990fa8
mov dword [ebp - 0x2c], 0x5065fe5e
sub dword [ebp - 0x2c], 0xef99ce9
mov dword [ebp - 0x28], 0xb44a8056
add dword [ebp - 0x28], 0xaf24ec16
mov dword [ebp - 0x24], 0x32943527
add dword [ebp - 0x24], 0xcd6bcad9
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xd7903363
add eax, 0x28affcc9
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x366fe
push 0
call eax
mov ecx, 0x47d3
xor edi, edi
add edi, eax
mov ebx, 0xb337c140
sub ebx, 0xb2f75140
add ebx, dword [ebp - 0x20]
mov edx, 0xd9bcaa8f
xor dword [ebp - 4], 0xcfb2afdd
mov esi, dword [ebx]
sub dword [ebp - 0x14], ecx
xor esi, edx
sub dword [ebp - 0x18], esi
mov dword [edi], esi
add dword [ebp - 0x14], 0x660c7e5a
add edi, 0xe6d5adb9
sub edi, 0xe6d5adb5
add ebx, 0xb1db2a66
sub ebx, 0xb1db2a62
loop 0x401d79
add eax, 0x1121f
mov ebx, eax
add eax, 0x8ab8ce1e
sub eax, 0x8ab8ce19
mov ecx, 0x8c10d2db
sub ecx, 0x8bd0d2db
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x45c920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x39000]
push edi
or ebp, 0xffffffff
jmp 0x45c942
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c938
mov eax, 1
add ebx, ebx
jne 0x45c95b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c950
jne 0x45c96c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c950
xor ecx, ecx
sub eax, 3
jb 0x45c980
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c9f2
mov ebp, eax
add ebx, ebx
jne 0x45c98b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45c998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45c9bc
inc ecx
add ebx, ebx
jne 0x45c9a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c99d
jne 0x45c9b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c99d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c9dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c9cd
jmp 0x45c93e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c9dc
add edi, ecx
jmp 0x45c93e
pop esi
mov edi, esi
mov ecx, 0x1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c9fa
cmp byte [edi], 0
jne 0x45c9fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c9ff
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45ca6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c298]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45ca2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c2a0]
or eax, eax
je 0x45ca68
mov dword [ebx], eax
add ebx, 4
jmp 0x45ca49
call dword [esi + 0x5c29c]
mov ebp, dword [esi + 0x5c2a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45caa2
sub esp, 0xffffff80
jmp 0x401910
Function at 0x401b58
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
pushal
cmp byte [0x4040b0], 0
jne 0x401b6d
call fcn.0040169b
mov edi, edx
mov dword [ebp - 4], ecx
push edx
push 0
push 0x404b91
push ecx
push edx
push dword [0x404930]
call sub.kernel32.dll_ReadFile
pop edx
cmp dword [0x404b91], 0
je 0x401c09
dec dword [0x404b91]
cld
mov ecx, dword [ebp - 4]
mov al, 0xa
repne scasb al, byte es:[edi]
jne 0x401bb2
dec dword [0x404b91]
sub edi, 2
cmp edi, edx
jae 0x401c06
mov edi, edx
jmp 0x401c06
mov edi, edx
add edi, dword [ebp - 4]
dec edi
mov byte [edi], 0
lea eax, [ebp - 8]
push eax
push dword [0x404930]
call sub.kernel32.dll_GetConsoleMode
push 0
push dword [0x404930]
call sub.kernel32.dll_SetConsoleMode
push 0
push 0x404832
push 1
lea eax, [ebp - 0xc]
push eax
push dword [0x404930]
call sub.kernel32.dll_ReadFile
mov al, byte [ebp - 0xc]
cmp al, 0xa
jne 0x401bd7
push dword [ebp - 8]
push dword [0x404930]
call sub.kernel32.dll_SetConsoleMode
jmp 0x401c09
mov byte [edi], 0
popal
mov eax, dword [0x404b91]
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40f712
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b70e
and dword [ebp - 4], 0
cmp dword [0x419b9c], 0
mov ebx, eax
jne 0x40f7c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f874
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f874
push eax
call fcn.0040b69c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419b9c], eax
call esi
push eax
call fcn.0040b69c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419ba0], eax
call esi
push eax
call fcn.0040b69c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419ba4], eax
call esi
push eax
call fcn.0040b69c
pop ecx
mov dword [0x419bac], eax
test eax, eax
je 0x40f7c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b69c
pop ecx
mov dword [0x419ba8], eax
mov eax, dword [0x419ba8]
cmp eax, ebx
je 0x40f81b
cmp dword [0x419bac], ebx
je 0x40f81b
push eax
call fcn.0040b717
push dword [0x419bac]
mov esi, eax
call fcn.0040b717
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f81b
test edi, edi
je 0x40f81b
call esi
test eax, eax
je 0x40f812
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f812
test byte [ebp - 0xc], 1
jne 0x40f81b
or dword [ebp + 0x10], 0x200000
jmp 0x40f854
mov eax, dword [0x419ba0]
cmp eax, ebx
je 0x40f854
push eax
call fcn.0040b717
pop ecx
test eax, eax
je 0x40f854
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f854
mov eax, dword [0x419ba4]
cmp eax, ebx
je 0x40f854
push eax
call fcn.0040b717
pop ecx
test eax, eax
je 0x40f854
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419b9c]
call fcn.0040b717
pop ecx
test eax, eax
je 0x40f874
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f876
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406672
Capabilities:
Encode data using xor

Disassembly:
call fcn.00406579
sub ecx, ecx
sub ecx, 0xffffff89
call 0x406672
rcr byte [esi - 0x7f], 0x76
push cs
les ecx, [edx + eax*4 + 0x5d]
xor dword [esi + 0xe], 0x5d824cc4
sub esi, 0xfffffffc
loop 0x406675
das
outsd dx, dword [esi]
invalid

Function at 0x406a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [edx + 0x31]
enter 0x330c, 0xffffffffffffffc9
xchg ebp, eax
xor esi, esi
aas
dec eax
push cs
lea ecx, [ebx + eax*4]
lea ecx, [edi*4 - 0x7476eb73]
dec ebp
or byte [ecx + 0x118903e2], dl
Function at 0x6d5bb202
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d5c3fd0]
jne 0x6d5bb20c
repz ret
jmp fcn.6d5bb8f0

Function at 0x6d5bbf21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x6d5bbf30
pop dword [ebp - 0x28]
mov eax, 0x6d5bbf30
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9afde3f4
sub dword [ebp - 0x38], 0x4cab9ea9
mov dword [ebp - 0x34], 0xf664951a
sub dword [ebp - 0x34], 0xc43148d5
mov dword [ebp - 0x30], 0xfa259416
sub dword [ebp - 0x30], 0xadd94fe8
mov dword [ebp - 0x2c], 0xb4eb91f1
sub dword [ebp - 0x2c], 0xb4eb91f1
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb229081e
sub dword [ebp - 0x38], 0x3db69ec8
mov dword [ebp - 0x34], 0x58f90932
sub dword [ebp - 0x34], 0x178ca7bd
mov dword [ebp - 0x30], 0x6a7136eb
sub dword [ebp - 0x30], 0x701ca7f
mov dword [ebp - 0x2c], 0x7ea94cb1
sub dword [ebp - 0x2c], 0x7ea94cb1
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xbc25165a
add eax, 0xb136b9da
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a448
push 0
call eax
mov ecx, 0x5300
xor edx, edx
add edx, eax
mov edi, 0x443c9fe5
add edi, 0x291fde1b
add edi, dword [ebp - 0x28]
mov esi, 0xc6018506
add esi, 0xdaa1b60a
sub dword [ebp - 4], 0x62952e26
mov ebx, dword [edi]
xor dword [ebp - 4], 0x632ea641
sub ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x24], 0x57560ba1
add edx, 4
add edi, 4
loop 0x6d5bc044
add eax, 0x13ed3
xor ebx, ebx
add ebx, eax
add eax, 0x8fd81502
add eax, 0x7027eb03
mov ecx, 0xa86acfa4
sub ecx, 0x3b0fcfa4
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x12111691
sub eax, 0x11d0fa2b
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xbc0d9c63
add dword [ebp - 0x48], 0x9244a8e8
mov dword [ebp - 0x44], 0x530d9ace
sub dword [ebp - 0x44], 0x20da4e89
mov dword [ebp - 0x40], 0x9acd1771
sub dword [ebp - 0x40], 0x4e80d343
mov dword [ebp - 0x3c], 0x6d80243
add dword [ebp - 0x3c], 0xf927fdbd
lea eax, [ebp - 0x48]
push eax
mov eax, 0xf0575f5e
sub eax, 0xf0172f0a
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xab57e214
add dword [ebp - 0x48], 0xc91a8742
mov dword [ebp - 0x44], 0x55743411
add dword [ebp - 0x44], 0xebf82d64
mov dword [ebp - 0x40], 0x8555eb0d
add dword [ebp - 0x40], 0xde19815f
mov dword [ebp - 0x3c], 0x754b9874
sub dword [ebp - 0x3c], 0x754b9874
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x37302
push 0
call eax
mov ecx, 0xa084f55f
sub ecx, 0xa084aa8b
mov edi, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x38]
mov esi, 0x8132fc6c
add esi, 0x84fb4c59
add dword [ebp - 0x30], 0x34248a44
mov edx, dword [ebx]
xor dword [ebp - 0x30], 0x100540e6
sub edx, esi
add dword [ebp - 0x14], 0x61844862
mov dword [edi], edx
xor dword [ebp - 4], 0x960352a0
add edi, 4
add ebx, 0xccba7bee
add ebx, 0x33458416
loop 0x401d7d
add eax, 0x11e23
xor ebx, ebx
add ebx, eax
add eax, 0x891b850a
add eax, 0x76e47afb
mov ecx, 0x345c9b5
add ecx, 0xfcfa364b
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x100252cf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x10049fb4
call fcn.10046eeb
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x800
mov dword [ebp - 0x18], eax
lea ebx, [edi + 0x14]
push ebx
push dword [edi + 0xc]
mov dword [ebp - 4], eax
call fcn.100475da
mov esi, eax
pop ecx
pop ecx
test esi, esi
jns 0x1002531e
push dword [edi + 0xc]
push esi
push 0x7d6
push 0x84e
call fcn.1003d19b
add esp, 0x10
jmp 0x10025489
cmp dword [edi + 4], 0
je 0x10025489
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.1003f5ed
and dword [edi + 4], 0
push 0x1002
mov byte [ebp - 4], 2
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push eax
push 0
push 0x800
lea ecx, [ebp - 0x3c]
call fcn.100475da
mov esi, eax
test esi, esi
jns 0x10025389
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.1003f607
cmp dword [ebp - 0x10], 0
je 0x10025489
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
jmp 0x10025489
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
lea ecx, [ebp - 0x3c]
test esi, esi
js 0x10025364
push 0x100057b0
push dword [ebp - 0x14]
push 0x100057d0
call fcn.100475da
mov esi, eax
test esi, esi
js 0x10025361
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp - 0x38]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100254bb
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push eax
push 0
push 0x100057e0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002543a
cmp dword [ebp - 0x1c], eax
jbe 0x1002543a
mov ebx, dword [sym.imp.MSVCR100.dll__wcsicmp]
push 0x1000580c
push dword [ebp - 0x38]
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10025430
push 0x10005800
push dword [ebp - 0x38]
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10025430
push 0x10005818
push dword [ebp - 0x38]
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x10025437
mov dword [edi + 4], 1
lea ebx, [edi + 0x14]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.1003f607
cmp dword [ebp - 0x10], 0
mov byte [ebp - 4], 0
je 0x1002545d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
cmp dword [edi + 4], 0
je 0x10025489
lea eax, [ebp - 0x18]
push eax
push 0x10009ddc
push 7
push 0
push ebx
call fcn.100475da
mov esi, eax
test esi, esi
js 0x10025489
push dword [ebp - 0x18]
lea ecx, [edi + 8]
call fcn.100475da
mov esi, eax
cmp dword [ebp - 0x14], 0
je 0x10025498
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x100254b3
xor ecx, ecx
lea eax, [ebp - 0x18]
xchg dword [eax], ecx
test ecx, ecx
je 0x100254b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
call fcn.10046fc3
ret
mov dword [edi + 4], 1
jmp 0x1002543a
Function at 0x1002ebed
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x1004aef9
call fcn.10046f54
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], eax
call fcn.1003f5ed
xor eax, eax
mov esi, 0x800
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, eax
mov dword [ebp - 0x24], eax
push 0x1002
mov byte [ebp - 4], 1
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x50]
call fcn.100475da
mov esi, eax
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.100475da
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test esi, esi
js 0x1002ed6e
push 0x100057b0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x50]
push 0x100057d0
call fcn.100475da
mov esi, eax
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x24]
push eax
push 0x20019
push edi
push dword [ebp - 0x4c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002ed43
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
push eax
push edi
push 0x100057e0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ed43
cmp dword [ebp - 0x2c], eax
jbe 0x1002ed43
mov edx, dword [ebp - 0x4c]
mov ecx, 0x1000580c
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x1002ed03
test si, si
je 0x1002ecff
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x1002ed03
add eax, 4
add ecx, 4
test si, si
jne 0x1002ecdd
xor eax, eax
jmp 0x1002ed08
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002ed40
mov eax, 0x10005818
mov cx, word [edx]
cmp cx, word [eax]
jne 0x1002ed37
test cx, cx
je 0x1002ed33
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x1002ed37
add edx, 4
add eax, 4
test cx, cx
jne 0x1002ed11
xor eax, eax
jmp 0x1002ed3c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002ed43
xor edi, edi
inc edi
mov esi, edi
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
js 0x1002ed6e
push dword [ebp - 0x30]
lea eax, [ebp - 0x20]
push 0x1000837c
push 7
push 0
push eax
call fcn.100475da
mov esi, eax
cmp dword [ebp - 0x28], 0
je 0x1002ed7d
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jns 0x1002ed95
push ebx
push esi
push 0x7d6
push 0x89f
call fcn.1003d19b
add esp, 0x10
cmp dword [ebp - 0x24], 0
je 0x1002eda8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1003f607
mov eax, esi
call fcn.10046fd7
ret 8

Function at 0x1004413c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 2
jne 0x10044161
cmp dword [esi + 0x20], 0
je 0x10044161
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [esi + 0x20]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
and dword [esi + 0x20], 0
pop ecx
xor eax, eax
pop esi
ret
Function at 0x10046306
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10009e0c]
jne 0x10047305
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10057d38], eax
mov dword [0x10057d34], ecx
mov dword [0x10057d30], edx
mov dword [0x10057d2c], ebx
mov dword [0x10057d28], esi
mov dword [0x10057d24], edi
mov word [0x10057d50], ss
mov word [0x10057d44], cs
mov word [0x10057d20], ds
mov word [0x10057d1c], es
mov word [0x10057d18], fs
mov word [0x10057d14], gs
pushfd
pop dword [0x10057d48]
mov eax, dword [ebp]
mov dword [0x10057d3c], eax
mov eax, dword [ebp + 4]
mov dword [0x10057d40], eax
lea eax, [ebp + 8]
mov dword [0x10057d4c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10057c88], 0x10001
mov eax, dword [0x10057d40]
mov dword [0x10057c3c], eax
mov dword [0x10057c30], 0xc0000409
mov dword [0x10057c34], 1
mov eax, dword [0x10009e0c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10057ab0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10057c80], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000a00c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10057c80], 0
jne 0x100473f1
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10004550
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100045fd
cmp eax, 0x104
ja 0x100045fd
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call sub.MSVCR100.dll_memset
push esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [esp + 0x20c]
push ecx
call fcn.10030ab0
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.1003779c
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1003779c
add esp, 0x414
ret
Function at 0x100049c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100394e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
xor eax, eax
mov word [edi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp]
push ecx
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x10004a38
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030ab0
lea edx, [ebp]
push edx
lea ecx, [ebp - 0x18]
call fcn.10002e00
cmp dword [eax], 0
je 0x10004a4f
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x10004a51
xor eax, eax
push 0x104
push eax
mov eax, dword [ebp + 0x218]
push eax
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.10002330
mov dword [ebp - 4], 0xffffffff
jmp 0x10004aa6
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003779c
lea esp, [ebp + 0x20c]
pop ebp
ret

Function at 0x10004ef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x218], eax
push str.JAVA_REGDEPLOY_DEBUG
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x10004fba
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
cmp dword [0x1004fba4], 0
jne 0x10004fd6
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x10004fba
test eax, eax
je 0x10004fba
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 4]
call fcn.10002e00
push str.JavaDeployReg.log
lea ecx, [esp + 8]
call fcn.10002e00
lea edx, [esp + 4]
push edx
lea ecx, [esp + 4]
call fcn.10004760
lea ecx, [esp + 4]
call fcn.10002330
mov eax, dword [esp]
test eax, eax
je 0x10004f98
mov eax, dword [eax]
jmp 0x10004f9a
xor eax, eax
push 0x1003b100
push eax
push 0x1004fba4
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
lea ecx, [esp]
test eax, eax
je 0x10004fd1
call fcn.10002330
xor eax, eax
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003779c
add esp, 0x21c
ret
call fcn.10002330
mov ecx, dword [esp + 0x218]
xor ecx, esp
mov eax, 1
call fcn.1003779c
add esp, 0x21c
ret