joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bbe6
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x108c]
mov eax, 0x110c
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1088], eax
lea eax, [ebp - 0x80]
push eax
push 0x1000
lea eax, [ebp - 0x7c]
push eax
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x1001bc7c
shr dword [ebp - 0x80], 2
push esi
xor esi, esi
cmp dword [ebp - 0x80], esi
jbe 0x1001bc7b
push edi
push dword [ebp + esi*4 - 0x7c]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov edi, eax
push 0x104
lea eax, [ebp + 0xf84]
push eax
push edi
call sub.psapi.dll_GetProcessImageFileNameA
lea eax, [ebp + 0xf84]
push 0x10064aec
push eax
call fcn.1003e120
pop ecx
pop ecx
test eax, eax
je 0x1001bc6d
push 0
push edi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 0x80]
jb 0x1001bc28
pop edi
pop esi
mov ecx, dword [ebp + 0x1088]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x108c
leave
ret

Function at 0x1001bd54
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x790], eax
push ebx
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x7a0]
xor ebx, ebx
xor eax, eax
push 0x7fe
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.10039d40
mov eax, dword [esi]
add esp, 0xc
push 0x2001f
push edi
push eax
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x74], ebx
call fcn.10035fb0
cmp eax, ebx
jne 0x1001bde4
push 0x400
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1001bdf0
lea ecx, [ebp - 0x80]
call fcn.10016b3c
push edi
mov ecx, esi
call fcn.10016acd
test eax, eax
jmp 0x1001bde7
cmp eax, 2
jne 0x1001bdf0
mov dword [ebp - 0x74], 1
lea ecx, [ebp - 0x80]
call fcn.10016b3c
mov ecx, dword [ebp + 0x790]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039bc2
add ebp, 0x794
leave
ret
Function at 0x1001c7fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10039d10
push 0xffffffffffffffff
push 0x100576ac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push 0x10060258
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001c8b8
push 0x10060290
lea ecx, [ebp - 0x10]
call fcn.1001060c
and dword [ebp - 4], 0
push 0x100602c8
lea ecx, [ebp - 0x14]
call fcn.10001309
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001524
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001c890
call fcn.10001441
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1001c89b
mov eax, dword [esi]
jmp 0x1001c89d
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
test esi, esi
je 0x1001c9b3
mov ecx, esi
call fcn.10001441
jmp 0x1001c9b3
xor eax, eax
push 0xffe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
mov dword [ebp - 0x18], 0x800
call fcn.10039d40
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0x100602ac
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001c9a8
push str._WebJava_value:
lea ecx, [ebp - 0x14]
call fcn.1001060c
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.10001524
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001c937
call fcn.10001441
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1001c942
mov eax, dword [esi]
jmp 0x1001c944
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
lea eax, [ebp]
mov ecx, 0x10060334
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1001c979
test dx, dx
je 0x1001c975
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1001c979
add ecx, 4
add eax, 4
test dx, dx
jne 0x1001c953
xor eax, eax
jmp 0x1001c97e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001c99d
push str._System_WebJava_DISABLED
call fcn.10035fb0
pop ecx
test esi, esi
je 0x1001c998
mov ecx, esi
call fcn.10001441
xor eax, eax
inc eax
jmp 0x1001c9b5
test esi, esi
je 0x1001c9a8
mov ecx, esi
call fcn.10001441
push str._System_WebJava_ENABLED
call fcn.10035fb0
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x1004
leave
ret
Function at 0x1001c9d6
Capabilities:
Get file version info

Disassembly:
push 0x24
mov eax, 0x10057714
call fcn.10039bd1
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x1001cb35
call dword [sym.imp.kernel32.dll_GetLastError]
push str.GetFileVersion_for__
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.1001060c
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10001309
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001524
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x1001ca3c
call fcn.10001441
push str.__FAILED
lea ecx, [ebp - 0x14]
call fcn.1001060c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x1001ca68
call fcn.10001441
lea ecx, [ebp - 0x14]
cmp esi, 2
jne 0x1001ca80
push str.__file_does_not_exist_
call fcn.1001060c
mov byte [ebp - 4], 3
jmp 0x1001cafa
push 0x10060978
call fcn.1001060c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001caa6
call fcn.10001441
push 0x13
pop eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.1000535c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001cadc
call fcn.10001441
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x10060988
lea ecx, [ebp - 0x14]
call fcn.1001060c
mov byte [ebp - 4], 7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001cb12
call fcn.10001441
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x1001cb1d
mov eax, dword [esi]
jmp 0x1001cb1f
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
cmp esi, ebx
je 0x1001cb31
mov ecx, esi
call fcn.10001441
xor eax, eax
jmp 0x1001cb7d
push esi
call fcn.10035fb0
pop ecx
mov edi, eax
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x1001cb7a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x1006098c
push edi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
movzx edx, word [eax + 0xa]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
movzx edx, word [eax + 8]
mov dword [ecx + 4], edx
movzx eax, word [eax + 0xe]
mov dword [ecx + 8], eax
xor eax, eax
inc eax
call fcn.10039c70
ret
Function at 0x1001f3a1
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10039d10
push 0xffffffffffffffff
push 0x10057e7b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
xor eax, eax
push 0xffe
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10039d40
call fcn.10035fb0
push edx
push eax
push 0x100603ac
lea eax, [ebp]
push 0x800
push eax
call fcn.10035fb0
add esp, 0x20
mov edi, 0x2001f
push edi
push 0x100603b8
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x20]
call fcn.10035fb0
mov dword [ebp - 0x10], eax
cmp eax, 2
jne 0x1001f44c
push str._setSystemWebJavaEnabled:_OK_regkey_does_not_exists
call fcn.10035fb0
pop ecx
jmp 0x1001f46e
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._setSystemWebJavaEnabled:_open_JavaDeploy_subkey
call fcn.10001309
push dword [ebp - 0x10]
call fcn.10029002
pop ecx
pop ecx
cmp eax, ebx
je 0x1001f54a
push 0x100604bc
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x10], eax
cmp eax, 2
jne 0x1001f487
mov dword [ebp - 0x10], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._setSystemWebJavaEnabled:_delete_WebDeployJava
call fcn.10001309
push dword [ebp - 0x10]
call fcn.10029002
pop ecx
pop ecx
cmp eax, ebx
je 0x1001f54a
push edi
lea eax, [ebp]
push eax
push 0x10060538
push 0x10060574
push esi
call fcn.1001f0f9
add esp, 0x14
push 0x100605b8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.10001309
mov eax, dword [ebp - 0x14]
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], esp
mov dword [ecx], eax
cmp eax, ebx
je 0x1001f4ee
add eax, 8
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push dword [ebp - 0x10]
call fcn.10029002
push edi
push 0x100605ac
push 0x10060610
push 0x10060648
push esi
call fcn.1001f0f9
add esp, 0x1c
push str.___Create_HKLM_webjavaswitch_status_enabled
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.100014b2
mov esi, dword [ebp - 0x14]
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
mov dword [eax], esi
cmp esi, ebx
je 0x1001f537
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push edi
call fcn.10029002
pop ecx
pop ecx
cmp esi, ebx
je 0x1001f54a
mov ecx, esi
call fcn.10001441
lea ecx, [ebp - 0x20]
call fcn.10016b3c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x1004
leave
ret
Function at 0x1001f6f2
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x10057eeb
call fcn.10039bd1
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
call fcn.1002cfd0
test eax, eax
je 0x1001f73d
call fcn.10035fb0
test eax, eax
je 0x1001f72f
call fcn.10035fb0
test eax, eax
je 0x1001f72f
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
jmp 0x1001f749
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x1001f749
push 0x800
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push str.__get_system_dir__
lea ecx, [ebp + 8]
mov edi, eax
call fcn.1001060c
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f785
call fcn.10001441
push 0x10060c00
lea ecx, [ebp - 0x10]
call fcn.1001060c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x1001f7b2
call fcn.10001441
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], esi
test esi, esi
je 0x1001f7cb
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
test edi, edi
setne al
movzx eax, al
push eax
call fcn.1002914a
pop ecx
pop ecx
test esi, esi
je 0x1001f7e6
mov ecx, esi
call fcn.10001441
mov eax, edi
call fcn.10039c70
ret
Function at 0x100226a4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x1005856a
call fcn.10039bd1
lea eax, [ebp - 0x1c]
push eax
call fcn.10035fb0
pop ecx
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x100226d3
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push 0x10064c94
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10022704
call fcn.10001441
push 0x10064924
lea ecx, [ebp - 0x10]
call fcn.10001309
push 0x100649a4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x10022742
call fcn.10001441
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001524
push 0x10064a6c
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x1002277b
call fcn.10001441
push 0x10064d30
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001524
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x100227a4
call fcn.10001441
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10039d40
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x70], 0x44
stosd dword es:[edi], eax
cmp esi, ebx
je 0x100227cd
mov edx, dword [esi]
jmp 0x100227cf
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x100227da
mov ecx, dword [eax]
jmp 0x100227dc
xor ecx, ecx
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x100227e7
mov eax, dword [edi]
jmp 0x100227e9
xor eax, eax
lea esi, [ebp - 0x2c]
push esi
lea esi, [ebp - 0x70]
push esi
push edx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x1002283c
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1002282c
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.1001bbe6
push dword [ebp - 0x28]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x10022848
call fcn.10001441
cmp edi, ebx
je 0x10022853
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x1002285f
call fcn.10001441
call fcn.10039c70
ret
Function at 0x10022865
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x64
mov eax, 0x100585bd
call fcn.10039bd1
lea eax, [ebp - 0x1c]
push eax
call fcn.10035fb0
pop ecx
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x10022894
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
push 0x10064d14
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x100228c5
call fcn.10001441
push 0x10064afc
lea ecx, [ebp - 0x10]
call fcn.10001309
push 0x10064cac
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x10022903
call fcn.10001441
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001524
push 0x10064d2c
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.10001524
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp ecx, ebx
je 0x1002293c
call fcn.10001441
push str.__wait__fix__shortcut__silent
lea ecx, [ebp - 0x18]
call fcn.10001309
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001524
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x10022965
call fcn.10001441
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10039d40
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x70], 0x44
stosd dword es:[edi], eax
cmp esi, ebx
je 0x1002298e
mov edx, dword [esi]
jmp 0x10022990
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x1002299b
mov ecx, dword [eax]
jmp 0x1002299d
xor ecx, ecx
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x100229a8
mov eax, dword [edi]
jmp 0x100229aa
xor eax, eax
lea esi, [ebp - 0x2c]
push esi
lea esi, [ebp - 0x70]
push esi
push edx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x100229fd
push 0x2bf20
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100229ed
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_TerminateProcess]
call fcn.1001bbe6
push dword [ebp - 0x28]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x10022a09
call fcn.10001441
cmp edi, ebx
je 0x10022a14
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x10022a20
call fcn.10001441
call fcn.10039c70
ret
Function at 0x10022a26
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x100585e0
call fcn.10039bd1
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push 0x2001f
push str.SOFTWAREOracleJavaFX
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
inc ebx
call fcn.10035fb0
test eax, eax
je 0x10022a70
lea ecx, [ebp - 0x1c]
mov esi, ebx
call fcn.10016b3c
mov eax, esi
call fcn.10039c70
ret
push str.Disabled
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
cmp edi, esi
je 0x10022aa3
cmp edi, 2
je 0x10022aa3
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.cleanupJavaFXDisabledEntry_error
call fcn.10001309
push edi
call fcn.10029002
pop ecx
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.10016b3c
jmp 0x10022a5e
Function at 0x1002461e
Capabilities:
Delete registry value

Disassembly:
push 0x28
mov eax, 0x1005890c
call fcn.10039bd1
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov ebx, 0x20019
push ebx
push 0x10067aac
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10035fb0
test eax, eax
jne 0x10024722
push ebx
push 0x10067b60
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.10035fb0
test eax, eax
jne 0x10024712
lea eax, [ebp - 0x1c]
push 0x10067b74
push eax
call fcn.1001bd54
pop ecx
pop ecx
test eax, eax
je 0x100246f3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
push 0x20006
push 0x10067b90
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10035fb0
test eax, eax
je 0x100246c3
push str.DeleteEmptyDeploymentKeysInHLKM:_failed_to_open_JRE_key
call fcn.10035fb0
jmp 0x100246ea
push str.BrowserJavaVersion
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.DeleteEmptyDeploymentKeysInHLKM:_Remove_BrowserJavaVersion_value
mov esi, eax
call fcn.10001309
push esi
call fcn.10029002
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.10016b3c
lea eax, [ebp - 0x1c]
push str.Java_Web_Start
push eax
call fcn.1001bd54
lea eax, [ebp - 0x1c]
push str.Java_Web_Start_Caps
push eax
call fcn.1001bd54
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x10067d4c
push eax
call fcn.1001bd54
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.10016b3c
lea ecx, [ebp - 0x28]
call fcn.10016b3c
call fcn.10039c70
ret
Function at 0x10024e7b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x798]
sub esp, 0x818
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x794], eax
mov eax, dword [ebp + 0x7a0]
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10068b78
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10024f91
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x78], esi
push esi
jmp 0x10024f73
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x70], esi
jbe 0x10024f61
cmp word [ebp + eax*2 - 0x6c], 0x2e
jne 0x10024ef7
inc ecx
cmp ecx, 1
jg 0x10024f02
inc eax
cmp eax, dword [ebp - 0x70]
jb 0x10024ee9
cmp ecx, 1
jle 0x10024f61
push 0x10068af4
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
js 0x10024f61
lea eax, [ebp - 0x6c]
push eax
call fcn.1002d6af
pop ecx
test eax, eax
je 0x10024f61
mov eax, dword [ebp - 0x70]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10035fb0
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0x70]
push 0x10068bd0
inc ecx
push ecx
push eax
mov dword [ebp - 0x80], eax
call fcn.10035fb0
mov ecx, dword [ebp - 0x7c]
add esp, 0x14
lea eax, [ebp - 0x80]
push eax
call fcn.10028f9f
inc dword [ebp - 0x78]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x74]
mov dword [ebp - 0x70], 0x400
call edi
test eax, eax
je 0x10024ee0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x794]
xor ecx, ebp
pop esi
call fcn.10039bc2
add ebp, 0x798
leave
ret