joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x449628
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x449617
jg 0x449580
test edx, edx
je 0x449617
nop dword [eax]
call fcn.00449db0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4495d4
jg 0x449597
test esi, esi
je 0x4495d4
cmp ebx, eax
jg 0x4495a7
jl 0x4495a1
cmp edi, esi
jae 0x4495a7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00480650
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4495fb
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x449611
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x449580
jl 0x449611
test edi, edi
jne 0x449580
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44964a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x44964c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4496ca
jg 0x44965f
test esi, esi
je 0x4496ca
test eax, eax
jl 0x4496a4
jg 0x449669
test ebx, ebx
je 0x4496a4
cmp edi, eax
jg 0x449679
jl 0x449673
cmp esi, ebx
jae 0x449679
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00480650
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x4496a7
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4496ca
jg 0x4496b1
test esi, esi
je 0x4496ca
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4496ca
push eax
push esi
push 1
push edx
call fcn.004853d6
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x51a074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x449f70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x449fac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x449fac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x44a095
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x449fd4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x44a007
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00485464
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x44a095
cmp eax, 1
jle 0x44a068
cmp eax, 3
jne 0x44a095
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00485464
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44a085
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004853d6
add esp, 0x10
cmp edi, eax
jne 0x44a095
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x449f97
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004697b3
mov esp, ebp
pop ebp
ret 4
Function at 0x44a0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x51a074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x44a18c
cmp byte [esi + 0x3d], 0
je 0x44a18c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x44a17a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x44a142
sub eax, 1
je 0x44a146
sub eax, 2
jne 0x44a17a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44a163
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004853d6
add esp, 0x10
cmp edi, eax
jne 0x44a17a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004697b3
mov esp, ebp
pop ebp
ret
Function at 0x44ea00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0938
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x51a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ebx, dword [eax]
mov eax, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], ebx
mov esi, dword [ebx + 4]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0xd], 0
jne 0x44ea7b
mov edi, dword [ebp + 0xc]
nop dword [eax]
push edi
lea eax, [esi + 0x10]
push eax
call fcn.00463ea0
test al, al
je 0x44ea63
mov esi, dword [esi + 8]
jmp 0x44ea67
mov ebx, esi
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
je 0x44ea50
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp + 0xc]
cmp ebx, eax
je 0x44eab7
push dword [ebx + 0x14]
mov ecx, dword [esi]
push dword [ebx + 0x10]
mov edx, dword [esi + 4]
call fcn.00465a90
shr eax, 0x1f
add esp, 8
test al, al
jne 0x44eab7
mov byte [edi + 4], al
mov eax, edi
mov dword [edi], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x74
mov dword [ebp - 0x24], 0
call fcn.004697d2
mov ecx, dword [esi]
mov ebx, eax
add esp, 4
mov dword [ebx + 0x10], ecx
mov ecx, dword [esi + 4]
lea edi, [ebx + 0x10]
lea esi, [edi + 8]
mov dword [ebp - 0x24], ebx
mov dword [edi + 4], ecx
push 0x5c
push 0
push esi
call fcn.00481150
add esp, 0xc
mov dword [ebp - 0x20], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x20
call fcn.004697d2
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
push ebx
mov dword [ebx], eax
mov dword [ebx + 4], eax
push edi
push dword [ebp - 0x10]
mov dword [ebx + 8], eax
lea eax, [ebp - 0x10]
push eax
mov word [ebx + 0xc], 0
call fcn.0044e830
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x450560
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x51a074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
cmp byte [ecx + eax], 0
jne 0x450660
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x450665
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x18]
jne 0x4505f9
push esi
mov dword [ebx], eax
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45063c
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x450680
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov dword [ebx], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 4], ecx
call edi
push esi
call edi
mov byte [ebx + 8], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret 4
call fcn.00484557
sub esp, 0x18
mov ecx, esp
push str.Could_not_open_file_
call fcn.00465f50
mov edx, 0x50d644
mov ecx, edi
call fcn.00425790
sub esp, 0x18
mov ecx, esp
push str.Could_not_open_file_
call fcn.00465f50
mov ecx, dword [ebp - 0x20]
mov edx, 0x50d644
call fcn.00425790
int3

Function at 0x453050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x453081
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x453070
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4572b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a11e8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x51a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], edi
call fcn.004573f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x30]
push eax
push 0
push 0
push 0
push str.KitsRoot10
push esi
mov dword [ebp - 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4573cb
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
shr eax, 1
push 0x3f
dec eax
push eax
call fcn.0045e4e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
push str.KitsRoot10
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0045dd30
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x45738f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x457385
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4573e4
push edx
push ecx
call fcn.004697c4
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4573ae
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004697b3
mov esp, ebp
pop ebp
ret
push str.Could_not_find_the_Windows_SDK_path_in_the_registry
lea ecx, [ebp - 0x48]
call fcn.00465f50
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00465de0
call fcn.0048409c
int3
Function at 0x4575c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a125e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x51a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x68], eax
mov dword [edi + 0x58], ecx
mov dword [edi + 0x60], 0
mov byte [edi + 0x64], 0
mov eax, dword [ecx + 8]
shr eax, 3
and al, 1
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov esi, dword [ecx + 0x18]
mov ecx, dword [edi + 0x44]
mov edx, ecx
mov eax, dword [edi + 0x40]
sub edx, eax
sar edx, 3
mov dword [ebp - 0x10], ecx
cmp esi, edx
jae 0x4576c8
lea ecx, [eax + esi*8]
jmp 0x457700
jbe 0x457703
mov eax, dword [edi + 0x48]
sub eax, dword [edi + 0x40]
sar eax, 3
cmp esi, eax
jbe 0x4576e3
push ecx
push esi
lea ecx, [edi + 0x40]
call fcn.00457490
jmp 0x457703
sub esi, edx
je 0x457700
lea eax, [esi*8]
push eax
push 0
push ecx
call fcn.00481150
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx + esi*8]
mov dword [edi + 0x44], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x46c499
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x48fd5c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048fbd2
Function at 0x404bc8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b0]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x6c], bl
mov dword [esi], ebx
call fcn.0040ceab
mov dword [esi], eax
cmp eax, ebx
jne 0x404bf9
push str.ERROR:_ShutdownEvent_handle_is_NULL
call fcn.004154d3
pop ecx
mov dword [ebp - 0x60], 0xfffffffe
push ebx
push dword [ebp - 0x64]
call fcn.0040c683
pop ecx
pop ecx
test eax, eax
jne 0x404c1b
push str.jusched_ERROR:_Could_not_open_Policy_key_for_reading
call fcn.004154d3
mov dword [ebp - 0x60], 0xfffffffd
jmp 0x404c3e
mov eax, dword [ebp - 0x64]
push dword [eax]
call fcn.00404b27
pop ecx
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x404c3f
push str.jusched_main:_ERROR_creating_registry_watch_event_notifier
call fcn.004154d3
mov dword [ebp - 0x60], 0xfffffffe
pop ecx
push str.SunJavaUpdateSchedulerMutex
push 1
push ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
cmp eax, ebx
jne 0x404caf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7ff
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.004360a0
add esp, 0xc
cmp dword [ebp - 0x60], 0xb7
lea eax, [ebp - 0x5c]
jne 0x404c8f
push str.Error:_Scheduler_Mutex_already_exists_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0x404ca1
push dword [ebp - 0x60]
push str.Error:_Error_creating_scheduler_mutex:__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call fcn.004154d3
or dword [ebp - 0x60], 0xffffffff
pop ecx
cmp dword [ebp - 0x60], ebx
je 0x404cce
push dword [edi]
push esi
call fcn.00404b76
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
pop ecx
pop ecx
lea esi, [ebp - 0x80]
mov dword [ebp - 0x7c], eax
call fcn.00412716
mov ecx, dword [ebp + 0x7a4]
mov eax, dword [ebp - 0x60]
pop esi
xor ecx, ebp
pop ebx
call fcn.00434c4e
add ebp, 0x7a8
leave
ret
Function at 0x42e4e6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4510a5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x47162c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.0042acb1
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [esp + 0x10], cl
mov dword [esp + 0x1c], edi
mov byte [eax + 4], bl
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], cl
mov dword [esp + 0x50], ebx
cmp byte [esp + 0x18], bl
je 0x42e551
push dword [esp + 0x14]
mov byte [esp + 0x1c], bl
call fcn.004339bb
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov esi, 0x100001
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
call fcn.004140ac
push edi
mov edi, dword [esp + 0x38]
dec esi
push esi
push 1
push edi
call fcn.0043c046
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x42e5a5
push 0xc8
lea esi, [esp + 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
push eax
call fcn.0043c341
push dword [esp + 0x1c]
call fcn.0043bdd4
pop ecx
test eax, eax
je 0x42e5ca
push 0x133
lea esi, [esp + 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
jmp 0x42e59f
push dword [esp + 0x1c]
call fcn.0043bdac
pop ecx
test eax, eax
jne 0x42e5ef
push 0x13b
lea esi, [esp + 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
jmp 0x42e59f
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, edi
call fcn.0042e4b2
lea eax, [edi + esi]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp edi, eax
je 0x42e61d
sub eax, edi
push eax
push edi
mov ecx, esi
call fcn.00405e63
cmp edi, ebx
je 0x42e628
push edi
call fcn.00434c43
pop ecx
cmp byte [esp + 0x10], bl
je 0x42e638
push dword [esp + 0x1c]
call fcn.004339bb
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e890
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x450872
call fcn.0043c771
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x42e8e6
push 0xc8
lea esi, [ebp - 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
push eax
call fcn.0043c341
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00412f5a
push 0x462d7c
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.004249bf
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0042d5db
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.0041302c
push 1
lea esi, [ebp]
call fcn.0041302c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.00434c4e
add ebp, 0x244
leave
ret
Function at 0x42fc0d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, eax
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jl 0x42fc8d
jg 0x42fc39
cmp esi, ecx
jbe 0x42fc8d
cmp dword [ebp + 0x14], ecx
jg 0x42fc39
jl 0x42fc35
cmp esi, 0x7fffffff
jae 0x42fc39
mov eax, esi
jmp 0x42fc3e
mov eax, 0x7fffffff
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], ecx
je 0x42fc7e
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42fc68
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x42fc88
jmp 0x42fc7e
mov eax, dword [ebp - 4]
test eax, eax
jle 0x42fc79
add ebx, eax
cdq
sub esi, eax
sbb dword [ebp + 0x14], edx
jmp 0x42fc19
cmp eax, 0xffffffff
jne 0x42fc88
call fcn.0043af75
cmp dword [eax], 4
je 0x42fc19
or eax, 0xffffffff
jmp 0x42fc8f
xor eax, eax
pop esi
pop ebx
leave
ret