joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016b2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ad50
mov ecx, 0x7fff
sub esp, eax
xor eax, eax
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x8017]
mov esi, dword [ebp + 0xc]
rep stosb byte es:[edi], al
lea edi, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], edi
mov dword [esp], str.Launch4j
call sub.kernel32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], str.__l4j_debug
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401722
mov dword [esp + 4], str.debug
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401770
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040163b
test eax, eax
mov dword [0x410a20], eax
je 0x4017b4
mov dword [esp + 4], str.__l4j_debug_all
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, 1
test eax, eax
jne 0x40176a
mov dword [esp + 4], str.debug_all
mov dword [esp], edi
call sub.msvcrt.dll_strstr
xor edx, edx
test eax, eax
setne dl
mov dword [0x410018], edx
mov eax, dword [0x410a20]
test eax, eax
je 0x401791
mov dword [esp + 8], str.3.50
mov dword [esp + 4], str._n_nVersion:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x410a20]
test eax, eax
je 0x4017b8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.CmdLine:_t_s__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4017b8
xor eax, eax
jmp 0x4017bd
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4018ae
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, dword [0x410a20]
test eax, eax
je 0x4018dd
mov dword [esp + 8], 0x41915c
mov dword [esp + 4], str.Error_msg:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
test ebx, ebx
je 0x40196f
lea eax, [ebp - 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call sub.kernel32.dll_FormatMessageA
mov eax, dword [0x410a20]
sub esp, 0x1c
test eax, eax
je 0x40193f
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], str.Error:_t_t_s_n
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], 0x40d0f3
mov dword [esp], 0x41915c
call sub.msvcrt.dll_strcat
mov ebx, dword [ebp - 0xc]
mov dword [esp], 0x41915c
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.kernel32.dll_LocalFree
push ecx
mov dword [esp], 0x41915c
call fcn.0040184b
cmp byte [0x41955c], 0
je 0x4019dc
mov eax, dword [0x410a20]
test eax, eax
je 0x4019a5
mov dword [esp + 8], 0x41955c
mov dword [esp + 4], str.Open_URL:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41955c
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.shell32.dll_ShellExecuteA
sub esp, 0x18
call fcn.00401699
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4019e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
cmp dword [0x410018], 0
mov ebx, dword [ebp + 0xc]
je 0x401a1a
mov eax, dword [0x410a20]
test eax, eax
je 0x401a1a
mov dword [esp + 8], esi
mov dword [esp + 4], str.Resource__d:_t
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x4190d8]
movzx esi, si
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], esi
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sub.kernel32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x401aa3
mov dword [esp + 4], eax
mov eax, dword [0x4190d8]
mov dword [esp], eax
call sub.kernel32.dll_LoadResource
test eax, eax
push ecx
push ecx
je 0x401ab3
mov dword [esp], eax
call sub.kernel32.dll_LockResource
test eax, eax
push edx
je 0x401ab3
xor edx, edx
mov cl, byte [eax + edx]
mov byte [ebx + edx], cl
inc edx
test cl, cl
jne 0x401a6b
cmp dword [0x410018], 0
mov esi, 1
je 0x401ad7
mov eax, dword [0x410a20]
test eax, eax
je 0x401ad7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x40d117
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x401ad7
mov dword [esp], 0
call sub.kernel32.dll_SetLastError
push esi
mov byte [ebx], 0
xor esi, esi
cmp dword [0x410018], 0
je 0x401ad7
mov eax, dword [0x410a20]
test eax, eax
je 0x401ad7
mov dword [esp + 4], eax
mov dword [esp], str._NULL__n
call sub.msvcrt.dll_fputs
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x401b56
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], str.HKEY_CLASSES_ROOT
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401bd3
mov dword [esp + 4], str.HKEY_CURRENT_USER
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401bda
mov dword [esp + 4], str.HKEY_LOCAL_MACHINE
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401be1
mov dword [esp + 4], str.HKEY_USERS
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x401be8
mov dword [esp + 4], str.HKEY_CURRENT_CONFIG
xor esi, esi
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
jne 0x401cc4
mov esi, 0x80000005
jmp 0x401bed
mov esi, 0x80000000
jmp 0x401bed
mov esi, 0x80000001
jmp 0x401bed
mov esi, 0x80000002
jmp 0x401bed
mov esi, 0x80000003
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sub.msvcrt.dll_strchr
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
lea edi, [eax + 1]
call sub.msvcrt.dll_strrchr
lea edx, [ebp - 0x20]
mov byte [eax], 0
mov ebx, eax
cmp dword [0x410010], 0
jne 0x401c4c
mov dword [esp], esi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], edi
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401cc1
jmp 0x401c79
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x2c], edx
call sub.advapi32.dll_RegOpenKeyExA
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
jne 0x401c21
lea eax, [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
lea eax, [ebx + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete al
movzx eax, al
mov esi, eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push edi
mov byte [ebx], 0x5c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4022b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x41
push edi
push esi
push ebx
sub esp, 0x24c
mov edx, dword [ebp + 0xc]
lea edi, [ebp - 0x220]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x220]
and edx, 0x100
or edx, 0x20019
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4023b0
lea edi, [ebp - 0x11c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
xor ebx, ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x224]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x22c]
lea edi, [ebp - 0x11c]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], str.JavaHome
mov dword [esp], eax
mov dword [ebp - 0x228], 0x104
call sub.advapi32.dll_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x40238b
mov dl, byte [edi + eax]
mov byte [esi + eax], dl
inc eax
test dl, dl
jne 0x402376
mov dword [esp], esi
call fcn.00401fcf
mov ebx, eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
push eax
je 0x4023b0
mov dword [esp + 4], esi
mov dword [esp], 0x418ed0
call sub.msvcrt.dll_strcpy
jmp 0x4023bc
mov dword [0x418c4c], 1
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402797
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x48], 0x40
call sub.kernel32.dll_GlobalMemoryStatusEx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp], ebx
mov dword [esp + 0x14], str._Xms
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 0x19
call fcn.00402646
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [esp], ebx
mov dword [esp + 0x14], str._Xmx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0x1b
call fcn.00402646
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x402815
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov eax, dword [ebp + 8]
mov dword [esp], 0xc
mov ebx, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.004019e6
test eax, eax
je 0x40284e
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x40d2fd
mov dword [esp], eax
call sub.msvcrt.dll_strcat
xor eax, eax
mov ecx, 0x41
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x11c]
mov dword [esp], ebx
not ecx
sub ecx, 4
mov dword [esp + 8], ecx
call sub.msvcrt.dll_strncpy
mov dword [esp + 4], str.l4j.ini
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov dword [ebp - 0x12c], eax
inc eax
je 0x40296e
mov eax, dword [0x410a20]
test eax, eax
je 0x4028c9
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Loading:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edi, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
xor ebx, ebx
mov esi, 1
repne scasb al, byte es:[edi]
mov eax, 0x7c00
mov edi, dword [ebp + 8]
not ecx
dec ecx
sub eax, ecx
add edi, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov edx, edi
cmp ebx, eax
jge 0x402940
mov cl, byte [edi + ebx]
cmp cl, 0x23
je 0x40293b
cmp cl, 0xa
je 0x402917
cmp cl, 0xd
jne 0x40292d
cmp edx, dword [ebp + 8]
mov esi, 1
jbe 0x40293d
cmp byte [edx - 1], 0x20
je 0x40293d
mov byte [edx], 0x20
inc edx
jmp 0x40293d
test esi, esi
je 0x40293d
mov byte [edx], cl
mov esi, 1
inc edx
jmp 0x40293d
xor esi, esi
inc ebx
jmp 0x402901
test eax, eax
mov byte [edx], 0
jle 0x402960
cmp byte [edx - 1], 0x20
je 0x402960
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x40d2fd
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll__close
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402979
Capabilities:
Check mutex on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0x20
push edi
lea edi, [ebp - 0x88]
sub esp, 0xa4
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x88]
mov dword [esp + 4], edi
mov dword [esp], 0x17
call fcn.004019e6
mov edx, 1
cmp byte [ebp - 0x88], 0
je 0x402a46
mov eax, dword [0x410a20]
test eax, eax
je 0x4029d7
mov dword [esp + 8], edi
mov dword [esp + 4], str.Create_mutex:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x94]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x94], 0xc
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x90], 0
call sub.kernel32.dll_CreateMutexA
sub esp, 0xc
call sub.kernel32.dll_GetLastError
mov edx, 1
cmp eax, 0xb7
jne 0x402a46
mov eax, dword [0x410a20]
test eax, eax
je 0x402a44
mov dword [esp + 8], str.Instance_already_exists.
mov dword [esp + 4], str.Error:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
xor edx, edx
mov eax, edx
mov edi, dword [ebp - 4]
leave
ret

Function at 0x402c31
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ad50
xor esi, esi
mov ecx, 0x7fff
sub esp, eax
mov eax, esi
lea edi, [ebp - 0x8017]
rep stosb byte es:[edi], al
lea ebx, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], ebx
mov dword [esp], str.Path
call sub.kernel32.dll_GetEnvironmentVariableA
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
mov edx, eax
mov eax, esi
repne scasb al, byte es:[edi]
mov esi, 0x7ffe
sub esp, 0xc
sub esi, edx
xor eax, eax
not ecx
dec ecx
cmp esi, ecx
jb 0x402cc2
mov dword [esp + 4], 0x40d22b
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov eax, dword [ebp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], ebx
mov dword [esp], str.Path
call sub.kernel32.dll_SetEnvironmentVariableA
push esi
push esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402d48
Capabilities:
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ad50
mov ecx, 0x2000
sub esp, eax
xor eax, eax
lea edi, [ebp - 0x8018]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10017]
lea ebx, [ebp - 0x10017]
mov cx, 0x7fff
rep stosb byte es:[edi], al
mov dword [esp + 4], ebx
mov dword [esp], 0x13
call fcn.004019e6
mov dword [esp], ebx
lea ebx, [ebp - 0x8018]
mov dword [esp + 4], 0x40d382
call sub.msvcrt.dll_strtok
mov esi, eax
test esi, esi
je 0x402e23
mov dword [esp + 4], 0x3d
mov dword [esp], esi
call sub.msvcrt.dll_strchr
mov edx, dword [ebp + 0xc]
mov byte [eax], 0
inc eax
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov byte [ebp - 0x8018], 0
mov dword [esp + 8], edx
call fcn.004023f3
mov eax, dword [0x410a20]
test eax, eax
je 0x402dfd
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.Set_var:_t_s___s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.kernel32.dll_SetEnvironmentVariableA
push edi
push edi
mov dword [esp + 4], 0x40d382
mov dword [esp], 0
call sub.msvcrt.dll_strtok
mov esi, eax
jmp 0x402da3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403389
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x808c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040ad50
mov edx, 0x418c2c
mov ecx, 4
mov edi, edx
sub esp, eax
xor eax, eax
mov esi, dword [ebp + 0xc]
rep stosd dword es:[edi], eax
lea ebx, [ebp - 0x805c]
mov edi, ebx
mov cl, 0x11
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x8018]
mov dword [ebp - 0x805c], 0x44
mov cx, 0x2000
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x8018]
mov dword [esp + 4], 0x40d405
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x410b28
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x40d3fb
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x410c2c
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov eax, dword [0x418c3c]
mov dword [esp + 0x24], 0x418c2c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.kernel32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x4034ae
cmp dword [ebp + 8], 0
je 0x4034a1
mov eax, dword [0x418c2c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.kernel32.dll_WaitForSingleObject
push eax
push eax
mov eax, dword [0x418c2c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.kernel32.dll_GetExitCodeProcess
push eax
push eax
call fcn.00403365
jmp 0x4034a7
mov dword [esi], 0
mov eax, 1
jmp 0x4034b6
mov dword [esi], 0xffffffff
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4034dc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, 0x100
mov ebp, esp
xor eax, eax
push edi
push esi
mov esi, 0x400
push ebx
lea edi, [ebp - 0x418]
sub esp, 0x43c
lea ebx, [ebp - 0x41c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x418]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.kernel32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x40353e
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x40353e
add edi, eax
sub esi, eax
jne 0x403508
cmp dword [0x410018], 0
lea ebx, [ebp - 0x418]
je 0x40356a
mov eax, dword [0x410a20]
test eax, eax
je 0x40356a
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Java_version_output:__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov dword [esp + 4], 0x22
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x40359e
mov eax, dword [0x410a20]
test eax, eax
je 0x403630
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_get_version_string:_cannot_find_quote_n
jmp 0x4035e6
lea esi, [eax + 1]
mov dword [esp + 4], 0x22
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x4035cb
mov eax, dword [0x410a20]
test eax, eax
je 0x403630
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_get_version_string:_missing_end_quote_n
jmp 0x4035e6
sub eax, esi
cmp eax, dword [ebp + 0x10]
jb 0x4035ed
mov eax, dword [0x410a20]
test eax, eax
je 0x403630
mov dword [esp + 4], eax
mov dword [esp], str.Cannot_get_version_string:_data_too_large_n
call sub.msvcrt.dll_fputs
jmp 0x403630
mov edi, dword [ebp + 0xc]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0xc]
mov byte [edx + eax], 0
mov dword [esp + 4], str.64_Bit
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, 1
test eax, eax
jne 0x40362b
mov dword [esp + 4], str.64_bit
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
xor edx, edx
test eax, eax
setne dl
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403638
Capabilities:
Create process on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 4
push edi
push esi
lea edx, [ebp - 0x6c]
push ebx
mov edi, edx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
lea esi, [ebp - 0x5c]
mov edi, esi
cmp dword [0x410018], 0
mov cl, 0x11
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 0x100
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
je 0x4036a1
mov eax, dword [0x410a20]
test eax, eax
je 0x4036a1
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Create_process:__s_n
mov dword [esp], eax
mov dword [ebp - 0x7c], edx
call sub.msvcrt.dll_fprintf
mov edx, dword [ebp - 0x7c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.kernel32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
mov esi, eax
jne 0x403711
mov eax, dword [0x410a20]
test eax, eax
je 0x403729
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Cannot_create_process__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403729
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push edx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
push eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403800
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x35c
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x410a20]
and ebx, 0x100
test edx, edx
je 0x403849
mov esi, dword [ebp + 8]
mov eax, 0x40d4f4
test ebx, ebx
mov ecx, 0x40d4f7
cmove eax, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s_bit_search:_t_s..._n
mov dword [esp], edx
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x334]
mov dword [esp + 0x10], eax
mov eax, ebx
or eax, 0x20019
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x403a08
lea edi, [ebp - 0x324]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x220]
mov dword [ebp - 0x330], 0x104
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov cl, 0x41
rep stosd dword es:[edi], eax
lea edx, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x334]
lea esi, [ebp - 0x32c]
mov dword [ebp - 0x33c], edx
lea edi, [ebp - 0x220]
lea edx, [ebp - 0x330]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExA
sub esp, 0x20
test eax, eax
jne 0x4039f9
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x324]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401f5e
mov eax, dword [0x410a20]
test eax, eax
je 0x403949
mov dword [esp + 8], esi
mov dword [esp + 4], str.Check:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea eax, [ebp - 0x220]
lea edi, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00401d30
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.0040373f
test eax, eax
je 0x4039c1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call fcn.004022b6
test eax, eax
je 0x4039c1
mov dword [esp + 4], edi
mov dword [esp], 0x418e50
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 0xc]
mov dword [0x418c40], eax
mov eax, dword [0x410a20]
test eax, eax
je 0x4039f9
mov dword [esp + 8], edi
mov dword [esp + 4], str.Match:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4039f9
mov eax, dword [0x410a20]
test eax, eax
je 0x4039e4
lea edx, [ebp - 0x11c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Ignore:_t_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x330], 0x104
mov eax, dword [ebp - 0x33c]
jmp 0x4038af
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret