joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4383b2
Capabilities:
Encode data using xor

Disassembly:
push cs
outsb dx, byte [esi]
adc al, 0x36
jmp dword [ebx - 0x7a]
in al, dx
loopne 0x43841b
mov esi, 0xb84d107c
mov ebx, dword [edi - 0x61]
jne 0x4383ee
mov eax, 0x759f5f8b
das
xor dword [edi - 0x19], 0xffffffd7
fistp dword [ecx - 0x56]
push es
xchg dh, al
outsd dx, dword [esi]
fmul qword [ebp + ebp - 0x5f0eb05b]
in eax, 0xe8
lea esp, [ecx + 0x19d20d4f]
dec eax
test byte [eax + 0x37086cb8], al
out 0x86, eax
xchg byte [edi - 0xe], dl
dec esp
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
jae 0x4383b9
das
scasd eax, dword es:[edi]
lds edi, [eax + 0x724b141c]
cmpsb byte [esi], byte es:[edi]
sbb al, 0x14
dec ebx
jb 0x438399
cmpsb byte ss:[esi], byte es:[edi]
sub byte [edx - 0x46b5f783], cl
mov edi, 0xcc2da856
push ecx
sbb eax, 0xf666e4d0
and esp, 0xffffff9e
ja 0x438429
inc esi
das
mov esi, 0xe88df287
invalid
test edi, edi
push edx
in eax, 0x2b
in eax, dx
jp 0x438467
xchg dl, dl
xchg esi, eax
add cl, 0xa1
inc esi
hlt
sub byte [ecx], dh
sub dword [ebx + 0xe], 0x48e80ea4
adc edx, dword [ecx + 0x61495bea]
out dx, al
jmp 0xec30dca9

Function at 0x451892
Capabilities:
Encode data using xor

Disassembly:
jge 0x4518cb
xlatb
mov edi, 0x886736bc
xchg ebx, eax
mov ecx, 0x2b80b5e4
rcl byte [ecx - 0x4498f56a], cl
test al, 0x14
adc al, 0xbc
xchg edi, eax
fst dword [edx - 0x664c5637]
xor dword [esi - 0x6d], ebp
aad 0x74
jnp 0x4518ab
and dh, byte [ecx - 0xd5cd4f1]
les ebp, [eax - 0x349d44e9]
xchg edi, eax
scasb al, byte es:[edi]
mov dword [0xd2239a33], eax
scasd eax, dword es:[edi]
fnsave dword [esi + 0x70e5e7d8]
outsd dx, dword [esi]
sti
invalid
Function at 0x453158
Capabilities:
Get number of processors

Disassembly:
mov dword [0x91be6bf1], eax
movzx eax, byte [ecx - 0x29]
push ss
test eax, 0x9f17c987
cdq
mov ah, 0xe5
movsd dword es:[edi], dword [esi]
out 0x43, eax
sbb byte [ecx + 0x30], dh
xchg ebx, eax
sub al, 0x1d
js 0x453190
jno 0x453188
out dx, al
pushal
push ecx
salc
pop ds
and eax, dword [ecx - 0x12]
pushal
daa
pushfd
mov ch, dh
nop
sbb eax, 0x6cd00718
lcall 0x1c57, 0xf618fc2a
sbb byte [edi], al
shr byte [edx + ebx*4 + 0x2a], 1
cld
sbb dh, dh
push edi
sbb al, 3
invalid
not byte [edi + 0x1c]
add eax, edi
jno 0x4531ca
cli
lahf
fcomp qword [eax]
xchg edx, eax
sub byte [esi - 0x7b], ah
dec edx
add cl, bh
lea edi, [ebx + esi*8 - 0x5bc5f42d]
pop esi
pop ds
test byte [ecx - 0x1b], ah
xor eax, 0xf91b1fe6
sbb dh, byte [ecx + 0x6d]
push 0xa7a60a34
sahf
mov al, byte [0xc8a4ae4d]
inc esi
sbb eax, 0x32383429
aaa
test al, 0x42
inc edx
in al, dx
bound ebx, qword es:[ebx]
in al, 0xe7
call 0xa8b9a0be
call 0x1a712c58
dec eax
jp 0x453227
std
lea esi, [eax - 0x39]
cmp dword [ecx - 0x4876c333], 0xa
inc ebx
shl dword [edi], 0x2f
pop ebx
rcl byte [edx], 0xfd
jmp 0x45326b
dec esi
adc byte [esi], cl
mov bl, byte [0xd0436e78]
outsd dx, dword [esi]
mov al, 0x17
add esp, dword [edx]
cmp ax, 0x1f87
salc
mov esi, 0xb10ad2b0
insb byte es:[edi], dx
mov bl, 0x2a
mov esi, 0x5445980f
mov edi, 0x154281a7
in eax, 0x9f
mov eax, dword [0x95d0a3f8]
mov cl, bl
add edi, edx
jo 0x4532a4
clc
les ebx, [edx + 0x40]
mov dh, 0x64
sal byte [edx + 0x75], cl
les esp, [0x61b20fbd]
adc ebp, dword [esi]
or byte [eax + edx*8 + 0x7b6e5801], bh
bound edx, qword [ebp - 0x23]
push edi
jno 0x4532ae
cmp byte [edi - 0x31ac1250], cl
lea esi, [ecx + ebx*2 + 0x3e]
stosb byte es:[edi], al
test eax, 0x9ef26b4f
pop eax
fmul qword [edx + 0x22]
cdq
push ss
sbb esi, dword [esi + 0x70]
lds esi, [edi + 0x540fc456]
insd dword es:[edi], dx
int1
sub esp, dword fs:[edi]
ljmp 0x1be1
int3
clc
push ds
salc
hlt

Function at 0x4653c2
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
aad 0xb6
leave
dec ecx
std
push es
jne 0x4653e3
or cl, dh
popal
push ss
aam 0xf5
jle 0x4653bd
sbb eax, 0xf8496583
mov ah, 0x99
mov bl, 0x69
cmp ecx, edi
fisubr word [eax - 0x7a9472b9]
mov byte [0x1106c524], ch
pop es
adc dword [edi], eax
jo 0x4653a8
mov bh, 0x5b
in al, dx
rcl ch, cl
mov ah, 0xae
cmpsb byte [esi], byte es:[edi]
invalid
lcall 0x42f5, 0x83926e95
div dh
dec edx
pop ebx
inc esi
cmp byte [edx + 0x1e], dl
call [ebp - 0x43]
cwde
add esi, dword [ebx + 0xe]
jae 0x4653cd
invalid
jge 0x46536a
push esp
sub byte [ebx - 0x1f], dl
mov ah, 0x91
je 0x465391
mov dl, 0x81
mov dh, 0xf4
and edx, edx
pop eax
inc ebp
aam 0xb5
inc ebp
xor dword [esi + 0x58d223f4], 0x36b5d445
inc ebp
xor edi, dword [ecx - 0x47]
mov ch, 0xda
insd dword es:[edi], dx
inc edi
loope 0x465373
mov ebx, dword [esi - 0x74]
retf 0x2a90

Function at 0x4656f2
Capabilities:
Encode data using xor

Disassembly:
imul byte [ebp + 0x56]
and byte [edi + 0x33], dl
sbb esi, dword [ebp - 0x2b713185]
xor cl, byte [edx + 0xe]
js 0x4656aa
xchg ecx, eax
sbb eax, 0x9cc5e661
Function at 0x47c5e2
Capabilities:
Encode data using xor

Disassembly:
invalid
push eax
in al, dx
pop ebx
push 0x63
sub eax, 0x811ec247
mov word [0x337d3db9], ds
dec edi
xor dword es:[edx - 0x33], 0x66
outsb dx, byte [esi]
xor ecx, dword [ebx]
mov al, byte [0x9871a1db]
fiadd dword [ecx + 0x3a8a51d6]
imul byte [edx + 0x63]
int1
rcl dword [edx - 0x5d], cl
movsb byte es:[edi], byte [esi]
jmp 0x47c535
cmc
jp 0x47c5b8
arpl word [edx], dx
mov dh, byte [ecx + 0x1d]
wait
jecxz 0x47c568
xchg byte [ebp + esi*8 - 0x1e], dl
and al, 0x7d
insb byte es:[edi], dx
les ebp, [edx + edx*4 + 0xb]
insb byte es:[edi], dx
xchg edx, eax
or esp, dword [edi]
insb byte es:[edi], dx
xchg edx, eax
or esp, dword [edi]
lcall 0xd35b, 0x1f59c002
sub dword [ebp + 0x72], ecx
cwde
push edx
push es
xor bh, byte [edx - 0xee3850e]
add dword [esi + 0x52], 0x1a
bound edi, qword [ebp + 0x1ba05326]
sbb ebx, eax
invalid
xchg edi, eax
jb 0x47c5af
push esi
mov byte ds:[0x743a03de], al
jnp 0x47c670
test esi, 0x365eaa86
mov bh, 0x73
int3
and edi, dword [edi + 0x56]
fidivr word [esi - 0x5e]
xor dword [edx + 0x42], esi
mov dword [0x2a872b67], eax
xchg ebx, eax
sub eax, dword [bx - 0x6cd6]
frstor dword [esi + 0x735ac1f0]
movsd dword es:[edi], dword [esi]
std
cmc
inc esi
inc edx
add edx, dword [eax]
xchg ebx, eax
and byte [ebx], 0x82
add byte es:[ebp + 0x4f96d7a2], 0xa7
outsd dx, dword [esi]
mov dh, 0x7b
pop es
ja 0x47c666
mov edi, 0x50fbb6dd
inc ecx
or edx, dword [0x5fb42bf3]
add esp, edx
not dword [edi + 0x30cd28dd]
xchg ebx, eax
ret 0x9b4f

Function at 0x47c8f2
Capabilities:
Encode data using xor

Disassembly:
bound eax, qword [ebp + esi*8 - 0x558da7d]
and dword [ebx], esi
lds edi, [ebx - 0xd]
mov dword [edi], ebp
mov dword [edi], ebp
push ebx
adc edi, dword [bp + si - 0x43]
enter 0x3216, 0x55
sal dword [0xe8f851de], cl
xor eax, 0x90928a43
mov dl, 0x83
push eax
aas
std
ja 0x47c8b1
salc
mov edx, 0xf7d5eaff
invalid
pop ds
sub eax, 0xf930b46f
test byte [esi + 6], cl
xchg ebx, eax
scasd eax, dword es:[edi]
jne 0x47c925
pop es
arpl ax, ax
push ecx
push es
mov dword [ecx - 0x45], esp
push edi
pop es
pop edi
popal
mov ch, byte [eax]
adc ebp, eax
sub eax, 0xe220a25a
int3
cmpsb byte [esi], byte es:[edi]
arpl dx, bp
cdq
shl dword [ecx + 0x6262fae7], cl
jl 0x47c8bc
std
add bh, byte [esi]
mov bl, 0x61
jecxz 0x47c8da
inc esi
ret 0x52b6

Function at 0x47f742
Capabilities:
Encode data using xor

Disassembly:
rcr dword [eax + 0x7c], cl
enter 0x53b7, 0xfffffffffffffffa
push ebx
cli
fiadd dword [0xe07f5b02]
xor al, byte [edi - 0x668bc245]
cdq
push edx
cmp al, 0x67
xchg ebx, eax
mov eax, dword [0xb12aca76]
das
sar dword [esi - 0x20], 1
mov dl, 0x30
jecxz 0x47f6e9
adc eax, 0x82098ce5
mov al, 0xc3
dec edi
sbb al, 0xd2
lea edx, [ecx]
adc byte [ecx], dh
pop edx
mov ch, byte [ebp - 0x21]
push esi
fidiv dword [edi + 0x74]
jle 0x47f6fb
push ebp
jb 0x47f6ee
mov al, 0xae
mov edi, 0x7c32f44e
mov dh, 0xe9
iretd

Function at 0x494b52
Capabilities:
Encode data using xor

Disassembly:
test al, 0xbc
out dx, al
pop ds
xor dword [ebp - 0x1a978b07], 0xffffffd2
or dh, 0x6c
das
invalid
Function at 0x496812
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x1d503585
add ebx, dword [eax]
push 0x17
mov ebx, 0x6684576f
popal
or al, 0x3e
lodsd eax, dword [esi]
add ch, byte [edi - 0x7f]
pminub mm4, mm5
invalid

Function at 0x49deea
Capabilities:
Encode data using xor

Disassembly:
clc
aam 0xba
jle 0x49deda
mov dword [0x6028aebb], eax
cmp cl, cl

Function at 0x4ab2a2
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x3074b10f
add eax, 0x9a8d44d

Function at 0x4bb37d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb39f
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb390
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb4cd
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4bb4a7
test eax, eax
jne 0x4bb3d0
cmp dword [0x4c3264], 1
je 0x4bb4a7
cmp edx, 0xfc
je 0x4bb4cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb407
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbd60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc1f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb44a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc1f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c089c
push edi
call fcn.004be0c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbd60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbd70
lea eax, [ebp - 0xa0]
push 0x4c087c
push eax
call fcn.004bbd70
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbd70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be034
add esp, 0x2c
pop edi
jmp 0x4bb4cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc1f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00405f70
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
lea ecx, [eax - 0x500]
shr edx, 0xf
or dl, 1
shr ecx, 0xa
add dl, al
xor dl, cl
mov ecx, eax
shr ecx, 0xa
xor dl, cl
movsx ecx, al
xor dl, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x4038b3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405210
mov esp, ebp
pop ebp
ret
Function at 0x403e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00405f70
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov edx, eax
shr edx, 8
xor cl, 0xf8
movsx ecx, cl
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x403ee3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405210
mov esp, ebp
pop ebp
ret
Function at 0x4046f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa184c
call fcn.00405f70
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0xa1824], edx
nop word [eax + eax]
mov eax, edx
neg edx
shr eax, 6
mov dword [ebp - 0xa1828], eax
mov ecx, eax
mov eax, dword [ebp - 0xa1824]
and ecx, 3
mov bl, al
neg al
shl bl, cl
mov ecx, edx
shr ecx, 0xd
and cl, al
shr edx, 1
xor bl, cl
and bl, 0x7f
xor bl, dl
mov edx, dword [ebp - 0xa1824]
mov ecx, edx
mov eax, edx
shr ecx, 9
and cl, dl
shr eax, 0xc
xor cl, al
xor cl, byte [ebp - 0xa1828]
or bl, cl
mov byte [ebp + edx - 0xa1808], bl
inc edx
mov dword [ebp - 0xa1824], edx
cmp edx, 0xa17fc
jb 0x404780
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa1844], 0xa17fc
mov dword [ebp - 0xa1848], eax
lea eax, [ebp - 0xa1848]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1840], 0
mov dword [ebp - 0xa183c], 0
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1848]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1848]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405210
mov esp, ebp
pop ebp
ret
Function at 0x405af5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405b34
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405b34
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405b34
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405b34
cmp dword [ecx + 0x74], 0xe
jbe 0x405b34
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10003ca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebp
mov ebp, dword [esp + 0x234]
lea eax, [esp + 0x10]
push str.JAVA_REGDEPLOY_DEBUG
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x10003e8f
push ebx
push esi
push edi
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp dword [0x1005393c], 0
jne 0x10003e3f
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x10003e8c
test eax, eax
je 0x10003e8c
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.100032a0
push str.JavaDeployReg.log
lea ecx, [esp + 0x18]
call fcn.100032a0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov esi, dword [esp + 0x14]
or edi, 0xffffffff
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
je 0x10003d92
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x10003d92
mov eax, dword [esi]
test eax, eax
je 0x10003d70
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10003d87
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10003d9e
mov eax, dword [esi]
jmp 0x10003da0
xor eax, eax
push 0x1003f624
push eax
push 0x1005393c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x10003e02
test esi, esi
je 0x10003e8c
lock xadd dword [esi + 8], edi
dec edi
jne 0x10003e8c
mov eax, dword [esi]
test eax, eax
je 0x10003ddb
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10003df2
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
jmp 0x10003e8c
test esi, esi
je 0x10003e3f
lock xadd dword [esi + 8], edi
dec edi
jne 0x10003e3f
mov eax, dword [esi]
test eax, eax
je 0x10003e1d
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10003e34
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
test ebp, ebp
je 0x10003e8c
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
movzx eax, word [esp + 0x2e]
push ebp
push eax
movzx eax, word [esp + 0x34]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x38]
push eax
movzx eax, word [esp + 0x3a]
push eax
movzx eax, word [esp + 0x3a]
push eax
movzx eax, word [esp + 0x3c]
push eax
push str.__04u__02u__02u__02u:_02u:_02u._03u___s__n
push dword [0x1005393c]
call fcn.10005870
add esp, 0x28
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x22c]
pop ebp
xor ecx, esp
call fcn.1003b4ee
add esp, 0x22c
ret
Function at 0x10003eb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
lea eax, [esp + 4]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003f4e
cmp eax, 0x104
ja 0x10003f4e
push 0x208
lea eax, [esp + 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x220]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [esp + 0x20c]
push eax
call fcn.1003b014
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x414
ret

Function at 0x10003f70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
xor eax, eax
mov dword [esp + 0x14], 0x44
xorps xmm0, xmm0
mov word [esp + 0x56], ax
mov word [esp + 0x44], ax
lea eax, [esp]
push eax
push 0x2000000
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x4e], xmm0
movlpd qword [esp + 0x56], xmm0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x48], 1
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000403d
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x1000403d
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x8000008
push 0
push 0
push 0
push dword [esp + 0x80]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000403d
push dword [esp + 0x64]
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
add esp, 0x58
ret
xor eax, eax
add esp, 0x58
ret
Function at 0x10004620
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x1003ce70
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100530a0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x214]
xor eax, eax
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
js 0x10004765
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.100032a0
mov eax, dword [eax]
test eax, eax
je 0x1000469f
mov eax, dword [eax]
jmp 0x100046a1
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x10004705
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
mov dword [ebp - 0x1c], eax
jne 0x10004705
test esi, esi
je 0x10004705
mov eax, dword [esi]
test eax, eax
je 0x100046e3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100046fa
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1000473b
xor eax, eax
test edi, edi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003b4ee
lea esp, [ebp + 0x20c]
pop ebp
ret
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10005d80
add esp, 8
push 0
push edi
call fcn.1003b014
int3