joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58e060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce2be
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x633ef8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x633f84]
cmp eax, 0xffffffff
jne 0x58e096
xor ebx, ebx
jmp 0x58e09f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
mov dword [ebp - 4], 0
setne cl
test cl, cl
je 0x58e0eb
lea edi, [ebx + 0x14]
cmp dword [edi + 4], 0
mov esi, dword [ebx + 0xc]
sete al
test al, al
je 0x58e12a
test esi, esi
jne 0x58e130
push 0x58d3f0
push 0x6407fc
call fcn.0058d0e0
mov eax, dword [0x633f84]
add esp, 8
cmp eax, 0xffffffff
je 0x58e0eb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x58e118
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x58e118
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x58e175
nop
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x58e15b
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x58e130
lea edi, [ebx + 0x14]
cmp dword [ebx + 0x18], 0
je 0x58e0b5
nop
mov esi, dword [edi]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x58e198
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x58e198
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0044cd52
cmp dword [ebx + 0x18], 0
jne 0x58e180
jmp 0x58e0b5

Function at 0x58e1b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x58e3b0
push 0
push 0
call fcn.0059cffe
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x58e1d9
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x58e1f7
cmp eax, 0xffffffff
je 0x58e1f7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x5b483f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b44ff
Function at 0x10002ce4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10002cf3
pop dword [ebp - 0x24]
mov eax, 0xf2f20ee4
sub eax, 0xe2f1e1f1
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x85683827
sub dword [ebp - 0x34], 0x3715f2dc
mov dword [ebp - 0x30], 0xedeceb1c
sub dword [ebp - 0x30], 0xbbb99ed7
mov dword [ebp - 0x2c], 0x2b042a7d
sub dword [ebp - 0x2c], 0xdeb7e64f
mov dword [ebp - 0x28], 0xccc840f9
add dword [ebp - 0x28], 0x3337bf07
lea eax, [ebp - 0x34]
push eax
mov eax, 0xecf386e9
sub eax, 0xdcf37541
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x7e4c1661
sub dword [ebp - 0x34], 0x9d9ad0b
mov dword [ebp - 0x30], 0x36af40d3
add dword [ebp - 0x30], 0xabd20a2
mov dword [ebp - 0x2c], 0x92ce7f13
add dword [ebp - 0x2c], 0xd0a0ed59
mov dword [ebp - 0x28], 0x7b03e96b
sub dword [ebp - 0x28], 0x7b03e96b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x19794b7
sub eax, 0xf197832b
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x36e57
push 0
call eax
mov ecx, 0x106a73a4
sub ecx, 0x106a3306
mov esi, eax
mov edx, 0xdf7463dc
add edx, 0x308caa24
add edx, dword [ebp - 0x24]
mov edi, 0x13dc370e
add dword [ebp - 0x10], 0xd8788ae4
mov ebx, dword [edx]
mov dword [ebp - 4], 0x8e2a42b6
add ebx, edi
xor dword [ebp - 0x20], 0xd7414ac3
mov dword [esi], ebx
sub dword [ebp - 0x20], ebx
add esi, 4
add edx, 0x7d06f326
add edx, 0x82f90cde
loop 0x10002e0f
add eax, 0x87c84faf
sub eax, 0x87c75a64
xor ebx, ebx
add ebx, eax
add eax, 0x7a4a488b
add eax, 0x85b5b77a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1000a303
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001464]
jne 0x1000a734
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1000e810], eax
mov dword [0x1000e80c], ecx
mov dword [0x1000e808], edx
mov dword [0x1000e804], ebx
mov dword [0x1000e800], esi
mov dword [0x1000e7fc], edi
mov word [0x1000e828], ss
mov word [0x1000e81c], cs
mov word [0x1000e7f8], ds
mov word [0x1000e7f4], es
mov word [0x1000e7f0], fs
mov word [0x1000e7ec], gs
pushfd
pop dword [0x1000e820]
mov eax, dword [ebp]
mov dword [0x1000e814], eax
mov eax, dword [ebp + 4]
mov dword [0x1000e818], eax
lea eax, [ebp + 8]
mov dword [0x1000e824], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1000e760], 0x10001
mov eax, dword [0x1000e818]
mov dword [0x1000e714], eax
mov dword [0x1000e708], 0xc0000409
mov dword [0x1000e70c], 1
mov eax, dword [0x10001464]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000dc94]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1000e758], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000146c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1000e758], 0
jne 0x1000a820
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x6d7a1090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x6d7a10a0
push 3
pop eax
jmp 0x6d7a124d
cmp byte [eax + 3], 0
jbe 0x6d7a10aa
push 8
jmp 0x6d7a109a
movzx ecx, word [eax]
mov edx, 0xa4
cmp cx, dx
jb 0x6d7a1098
mov word [0x6d7f1a00], cx
mov cx, word [eax + 2]
mov word [0x6d7f1a02], cx
mov ecx, dword [eax + 0x3c]
mov dword [0x6d7f1a3c], ecx
mov ecx, dword [eax + 4]
mov dword [0x6d7f1a04], ecx
mov ecx, dword [eax + 0x40]
mov dword [0x6d7f1a40], ecx
mov ecx, dword [eax + 8]
mov dword [0x6d7f1a08], ecx
mov ecx, dword [eax + 0xc]
mov dword [0x6d7f1a0c], ecx
mov ecx, dword [eax + 0x10]
mov dword [0x6d7f1a10], ecx
mov ecx, dword [eax + 0x14]
mov dword [0x6d7f1a14], ecx
mov ecx, dword [eax + 0x18]
mov dword [0x6d7f1a18], ecx
mov ecx, dword [eax + 0x1c]
mov dword [0x6d7f1a1c], ecx
mov ecx, dword [eax + 0x20]
mov dword [0x6d7f1a20], ecx
mov ecx, dword [eax + 0x24]
mov dword [0x6d7f1a24], ecx
mov ecx, dword [eax + 0x28]
mov dword [0x6d7f1a28], ecx
mov ecx, dword [eax + 0x2c]
mov dword [0x6d7f1a2c], ecx
mov ecx, dword [eax + 0x30]
mov dword [0x6d7f1a30], ecx
mov ecx, dword [eax + 0x34]
mov dword [0x6d7f1a34], ecx
mov ecx, dword [eax + 0x38]
mov dword [0x6d7f1a38], ecx
mov ecx, dword [eax + 0x44]
mov dword [0x6d7f1a44], ecx
mov ecx, dword [eax + 0x48]
mov dword [0x6d7f1a48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [0x6d7f1a4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [0x6d7f1a50], ecx
mov ecx, dword [eax + 0x54]
mov dword [0x6d7f1a54], ecx
mov ecx, dword [eax + 0x58]
mov dword [0x6d7f1a58], ecx
mov ecx, dword [eax + 0x5c]
mov dword [0x6d7f1a5c], ecx
mov ecx, dword [eax + 0x60]
mov dword [0x6d7f1a60], ecx
mov ecx, dword [eax + 0x64]
mov dword [0x6d7f1a64], ecx
mov ecx, dword [eax + 0x68]
mov dword [0x6d7f1a68], ecx
mov ecx, dword [eax + 0x6c]
mov dword [0x6d7f1a6c], ecx
mov ecx, dword [eax + 0x70]
mov dword [0x6d7f1a70], ecx
mov ecx, dword [eax + 0x74]
mov dword [0x6d7f1a74], ecx
mov ecx, dword [eax + 0x78]
mov dword [0x6d7f1a78], ecx
mov ecx, dword [eax + 0x7c]
mov dword [0x6d7f1a7c], ecx
mov ecx, dword [eax + 0x80]
mov dword [0x6d7f1a80], ecx
mov ecx, dword [eax + 0x84]
mov dword [0x6d7f1a84], ecx
mov ecx, dword [eax + 0x88]
mov dword [0x6d7f1a88], ecx
mov ecx, dword [eax + 0x8c]
mov dword [0x6d7f1a8c], ecx
mov ecx, dword [eax + 0x90]
mov dword [0x6d7f1a90], ecx
mov ecx, dword [eax + 0x94]
mov dword [0x6d7f1a94], ecx
mov ecx, dword [eax + 0x98]
mov dword [0x6d7f1a98], ecx
mov ecx, dword [eax + 0x9c]
mov dword [0x6d7f1a9c], ecx
mov eax, dword [eax + 0xa0]
mov dword [0x6d7f1aa0], eax
xor eax, eax
ret 4
Function at 0x6d7a1876
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call fcn.6d7a166d
xor eax, eax
push str.browserJVM
mov dword [esi], vtable.ScriptablePluginObject.0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.6d7a13ab
mov dword [esi + 0x24], eax
mov dword [esp], str.runningJVM
call fcn.6d7a13ab
mov dword [esi + 0x28], eax
mov dword [esp], str.jvms
call fcn.6d7a13ab
mov dword [esi + 0x2c], eax
mov dword [esp], str.installLatestJRE
call fcn.6d7a13ab
mov dword [esi + 0x30], eax
mov dword [esp], str.installJRE
call fcn.6d7a13ab
mov dword [esi + 0x34], eax
mov dword [esp], str.launch
call fcn.6d7a13ab
mov dword [esi + 0x38], eax
mov dword [esp], str.compareVersion
call fcn.6d7a13ab
mov dword [esi + 0x60], eax
mov dword [esp], 0x6d7e2b10
call fcn.6d7a13ab
mov dword [esi + 0x64], eax
mov dword [esp], str.getStaticMimeType
call fcn.6d7a13ab
mov dword [esi + 0x68], eax
mov dword [esp], str.getDynamicMimeType
call fcn.6d7a13ab
mov dword [esi + 0x6c], eax
mov dword [esp], str.setInstallerType
call fcn.6d7a13ab
mov dword [esi + 0x3c], eax
mov dword [esp], str.setAdditionalPackages
call fcn.6d7a13ab
mov dword [esi + 0x40], eax
mov dword [esp], str.isAutoUpdateEnabled
call fcn.6d7a13ab
mov dword [esi + 0x44], eax
mov dword [esp], str.setAutoUpdateEnabled
call fcn.6d7a13ab
mov dword [esi + 0x48], eax
mov dword [esp], str.isPlugin2
call fcn.6d7a13ab
mov dword [esi + 0x4c], eax
mov dword [esp], str.getInstalledFXVersion
call fcn.6d7a13ab
mov dword [esi + 0x50], eax
mov dword [esp], str.installJavaFX
call fcn.6d7a13ab
mov dword [esi + 0x54], eax
mov dword [esp], str.getJavaFXEnabled
call fcn.6d7a13ab
mov dword [esi + 0x58], eax
mov dword [esp], str.enableJavaFX
call fcn.6d7a13ab
mov dword [esi + 0x5c], eax
pop ecx
mov eax, esi
pop esi
ret 4
Function at 0x6d7a2c42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x790], eax
mov eax, dword [ebp + 0x79c]
push ebx
push esi
mov esi, dword [ebp + 0x7a0]
push eax
push 0x6d7e30f8
lea eax, [ebp - 0x70]
push 0x6d7e3124
xor ebx, ebx
push eax
mov byte [ebp - 0x71], 1
mov byte [ebp - 0x70], bl
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a2ccc
lea eax, [ebp - 0x7c]
push eax
push esi
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x6d7e312c
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x6d7a2ccf
mov byte [ebp - 0x71], bl
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x790]
mov al, byte [ebp - 0x71]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7b886c
add ebp, 0x794
leave
ret
Function at 0x6d7a35b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xfa0]
mov eax, 0x1020
call fcn.6d7b89f0
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0xf9c], eax
mov eax, dword [ebp + 0xfa8]
push esi
mov esi, dword [ebp + 0xfac]
push edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor edi, edi
push edi
push 0x6d7e32a4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a3792
push ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x79c]
push eax
mov dword [ebp - 0x70], edi
mov ebx, 0x800
push edi
jmp 0x6d7a3774
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x6c], edi
jbe 0x6d7a375f
cmp byte [ebp + eax + 0x79c], 0x2e
jne 0x6d7a3644
inc ecx
cmp ecx, 1
jg 0x6d7a3653
inc eax
cmp eax, dword [ebp - 0x6c]
jb 0x6d7a3634
cmp ecx, 1
jle 0x6d7a375f
push 0x6d7e32d0
lea eax, [ebp + 0x79c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d7a375f
lea eax, [ebp + 0x79c]
push eax
call fcn.6d7a7031
pop ecx
test al, al
je 0x6d7a375f
lea eax, [ebp + 0x79c]
push eax
push 0x6d7e32d8
lea eax, [ebp - 0x64]
push 0x6d7e3304
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a375f
mov eax, dword [esi]
imul eax, eax, 0xc
add eax, dword [ebp - 0x68]
push eax
call fcn.6d7a2ac3
mov ecx, dword [ebp - 0x68]
lea eax, [ebp + 0x79c]
push eax
mov eax, dword [esi]
imul eax, eax, 0xc
push ebx
push dword [eax + ecx]
call fcn.6d7bc5e3
mov ecx, dword [ebp - 0x68]
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [esi]
imul eax, eax, 0xc
push dword [eax + ecx + 4]
lea eax, [ebp - 0x80]
push eax
push edi
push 0x6d7e330c
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d7a3745
lea eax, [ebp + 0x79c]
push eax
call fcn.6d7bc5e3
mov ecx, dword [esi]
mov edx, dword [ebp - 0x68]
imul ecx, ecx, 0xc
mov byte [ecx + edx + 8], al
lea eax, [ebp + 0x79c]
push eax
call fcn.6d7bc5e3
mov edx, dword [ebp - 0x68]
pop ecx
pop ecx
mov ecx, dword [esi]
imul ecx, ecx, 0xc
mov byte [ecx + edx + 9], al
jmp 0x6d7a3754
mov eax, dword [esi]
imul eax, eax, 0xc
add eax, dword [ebp - 0x68]
push eax
call fcn.6d7a2a84
pop ecx
push dword [ebp - 0x78]
inc dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x70]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x79c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x74]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6d7a3624
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp + 0xf9c]
pop edi
xor ecx, ebp
pop esi
call fcn.6d7b886c
add ebp, 0xfa0
leave
ret
Function at 0x6d7a43ca
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d7a4418
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d7a4429
push 0xd
pop eax
jmp 0x6d7a4453
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d7a442c
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d7a4b91
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d7bc5e3
mov ebx, eax
cmp ebx, esi
je 0x6d7a4c04
lea ecx, [ebp - 0x74]
call fcn.6d7a4310
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d7b886c
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d7a4c1c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d7a4b91
cmp eax, esi
jne 0x6d7a4c4e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d7a4c0c
lea ecx, [ebp - 0x74]
call fcn.6d7a4310
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d7a42e2
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d7a4310
mov eax, esi
jmp 0x6d7a4bea
Function at 0x6d7a7031
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1794]
mov eax, 0x1814
call fcn.6d7b89f0
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x1790], eax
mov eax, dword [ebp + 0x179c]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push eax
push 0x6d7e3914
lea eax, [ebp - 0x70]
push 0x6d7e3940
push eax
mov byte [ebp - 0x71], 0
call esi
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor edi, edi
push edi
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a718c
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x790]
push eax
push edi
push edi
push 0x6d7e3948
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x6d7a718b
push str.binjava.exe
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d7e3964
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
test eax, eax
je 0x6d7a718b
push str.binclientjvm.dll
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d7e3980
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
mov ebx, eax
push str.bin_serverjvm.dll
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d7e399c
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
mov dword [ebp - 0x7c], eax
push str.binkerneljvm.dll
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp + 0xf90]
push 0x6d7e39b8
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0xf90]
push eax
call edi
test ebx, ebx
jne 0x6d7a7187
cmp dword [ebp - 0x7c], ebx
jne 0x6d7a7187
test eax, eax
je 0x6d7a718b
mov byte [ebp - 0x71], 1
pop ebx
mov ecx, dword [ebp + 0x1790]
mov al, byte [ebp - 0x71]
pop edi
xor ecx, ebp
pop esi
call fcn.6d7b886c
add ebp, 0x1794
leave
ret

Function at 0x6d7a71a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x188], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push 0x6d7e39c0
push SysReAllocString
mov dword [ebp - 0x80], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a7213
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x6d7e39e8
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x6d7a7213
xor al, al
jmp 0x6d7a7215
mov al, 1
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.6d7b886c
add ebp, 0x18c
leave
ret
Function at 0x6d7a76ae
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x790], eax
mov eax, dword [ebp + 0x79c]
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor esi, esi
push esi
push 0x6d7e38e0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a77a2
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x7c], esi
push esi
jmp 0x6d7a778d
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x74], esi
jbe 0x6d7a777b
cmp byte [ebp + eax - 0x70], 0x2e
jne 0x6d7a7729
inc ecx
cmp ecx, 1
jg 0x6d7a7734
inc eax
cmp eax, dword [ebp - 0x74]
jb 0x6d7a771c
cmp ecx, 1
jle 0x6d7a777b
push str.1.3.1
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d7a777b
lea eax, [ebp - 0x70]
push eax
call fcn.6d7a7031
pop ecx
test al, al
je 0x6d7a777b
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jle 0x6d7a777b
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x7a0]
push dword [ebp - 0x80]
call fcn.6d7bc5e3
add esp, 0xc
inc dword [ebp - 0x7c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x800
call edi
test eax, eax
je 0x6d7a7713
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x790]
xor ecx, ebp
pop esi
call fcn.6d7b886c
add ebp, 0x794
leave
ret
Function at 0x6d7a7d86
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1fc4]
mov eax, 0x2044
call fcn.6d7b89f0
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x1fc0], eax
cmp dword [0x6d7f6388], 0
je 0x6d7a7f0f
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x78]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x6d7e3b74
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x800
call esi
test eax, eax
jne 0x6d7a7f0c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xfc0]
push eax
push 0
push 0
push str.CurrentVersion
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0xfc0]
push eax
push str.SOFTWAREJavaSoftJava_Runtime_Environment
lea eax, [ebp - 0x40]
push 0x6d7e3bdc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp - 0x74], 0
jne 0x6d7a7f03
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
lea eax, [ebp - 0x40]
push eax
push edi
call esi
test eax, eax
jne 0x6d7a7f03
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x7c0]
push eax
xor edi, edi
push edi
push edi
push 0x6d7e3be4
push dword [ebp - 0x80]
mov esi, 0x800
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d7a7f03
lea eax, [ebp + 0x7c0]
push eax
lea eax, [ebp + 0x17c0]
push str._slib_bundles
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x17c0]
push eax
call fcn.6d7bc5e3
add esp, 0x14
test eax, eax
jne 0x6d7a7efa
push str._requested.list
lea eax, [ebp + 0x17c0]
push esi
push eax
mov dword [ebp - 0x74], edi
call fcn.6d7bc5e3
push 0x6d7e3c10
lea eax, [ebp + 0x17c0]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.6d7bc5e3
add esp, 0x18
test eax, eax
jne 0x6d7a7efa
mov ecx, dword [0x6d7f6388]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x6d7a7eda
push dword [ebp - 0x74]
sub eax, esi
push eax
push 1
push ecx
call fcn.6d7bac85
push dword [ebp - 0x74]
call fcn.6d7baaba
add esp, 0x14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1fc0]
xor ecx, ebp
call fcn.6d7b886c
add ebp, 0x1fc4
leave
ret