joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc30a24
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, al
sub ecx, eax
mov eax, dword [esi + ecx - 0x4a8cf004]
adc cl, 0xb1
add dx, dx
add dx, dx
lea esi, [esi + ecx - 0x4a8cf0b6]
adc word [esp + edx - 0x2d77021d], dx
xor eax, ebx
lea eax, [eax + edx + 0x5e9be0ea]
push edx
not eax
inc eax
call fcn.00a2dae4
xor cl, bl
cdq
xor cl, dl
neg dl
idiv eax
ror cl, 1
bswap eax
sub cl, 0xa5
rol cl, 1
btc eax, 0xb6
call fcn.00b2ce56
dec esi
stc
xchg esi, eax
adc dl, bh
fsub qword [edx + ebp]
dec esp
push ds
xlatb
fsub qword [edx]
xor byte [esi - 0x29], al
fsub qword [esi + ecx]
adc byte [edi + 0x602418c6], dl
je 0xc30a78
ret

Function at 0xc30dff
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0xe397db14
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
push 0x3709c796
lea esp, [esp + 0xc]
je 0xb0d649
xor cl, dl
sal dx, 0xe1
adc cl, dl
neg eax
rol cl, 1
lea edx, [eax + eax - 0x376edbec]
xor bl, cl
mov dword [esp + eax - 0xb965c], edi
dec eax
push esi
push ebx
mov ebx, ecx
sal edx, 0xe
idiv ax
mov edx, ebx
imul eax, eax
push eax
sal edx, 2
btc ax, 0x9f
mov eax, ebp
push 0x511c44ad
jae 0xaf07e8

Function at 0xc359e5
Capabilities:
Encode data using base64

Disassembly:
call fcn.00a22d28
call fcn.00bb6c9b
mov edx, dword [ebp]
mov ecx, 0x9910088f
movsx eax, cx
xor al, 0x20
mov cl, byte [ebp + eax*2 - 0x115a]
lea ebp, [ebp + eax - 0x8ad]
jl 0xaff51a
shr ax, 0xea
shr edx, cl
push eax
mov dword [ebp + eax - 2], edx
movsx edx, ax
cdq
lea edi, [eax + edi - 6]
mul word [esp + eax - 2]
imul edx, edx
not byte [esp + eax*2 - 8]
mov ecx, dword [edi + eax*2 - 8]
adc dword [esp + eax - 4], eax
div eax
inc eax
xor ecx, ebx
rol ecx, 1
neg dword [esp + eax - 2]
cwde
neg ax
lea ecx, [ecx + eax - 0x7788cbb1]
push eax
cwde
bswap ecx
sbb ecx, eax
xor byte [esp + edx*8 + 7], al
and edx, eax
jp 0xbfb976
mov eax, 0x771f1b87
movsx ecx, al
lea ebp, [ebp + eax - 0x771f1b8b]
sub ax, ax
mov eax, dword [eax + ebp - 0x771f0000]
shl cl, 0x41
xor eax, ebx
sub eax, 0xa7afef95
neg eax
bswap eax
lea edx, [ecx + ecx*8 - 0x1a77454b]
add edx, edx
lea edx, [ecx*8 - 0x32537256]
ror eax, 3
inc ecx
xor dx, 0x7c04
xor ebx, eax
lea edx, [ecx + ecx*2 - 0x2773d94e]
sub dx, cx
call fcn.00964e45
pop edx
neg cl
movsx edx, ax
or edx, 0x1086f7b0
sub word [esp + 3], ax
rol cl, 1
jmp 0xafa22d

Function at 0xc4172a
Capabilities:
Execute syscall

Disassembly:
mov cx, word [ecx + edx - 1]
movsx edx, ax
and al, 0xa
rol ax, 0xa1

Function at 0xc43da3
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x9318c097
xor ebx, ecx
sub edx, edx
adc edi, ecx
add edx, edi
jmp edx
mov ecx, dword [esi]
add esi, 4
mov edx, 0xf78c03b0
sal ax, 0x84
xor ecx, ebx
inc ecx
pop eax
movsx eax, dl
ror dx, 0x8d
rol ecx, 1
cdq
or dl, dl
xor edx, eax
bswap ecx
btc edx, 0x9d
lea ecx, [ecx + edx*4 + 0x5593f0f4]
sub dl, 0xa5
jbe 0x70b5af

Function at 0xc4f8d8
Capabilities:
Parse pe header

Disassembly:
bts edx, edx
jb 0x9dbb75
Function at 0xc55c1b
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 0x10], edi
add eax, 0x736
jmp 0xab63ee
shl esi, cl
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
test bl, 0x15
mov byte [ebp - 1], bl
clc
test ax, 0xf30b
sub esi, edi
stc
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
stc
mov dword [ecx], ebx
bts ecx, ebp
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
mov ecx, dword [eax + 4]
neg al
add ecx, esi
setbe al
mov eax, 0x300
cmc
cmp ebx, ebx
shl eax, cl
stc
test bl, 0x9e
mov dword [ebp - 0x3c], esi
test cx, 0x15b0
mov dword [ebp - 0x14], ebx
cmp sp, sp
jmp 0x985b15
mov dword [ebp - 0x28], edi
jmp 0xbccd28
push esi
test ecx, esp
push edi
cmp esi, esp
mov edi, 1
mov esi, edi
jmp 0xb5cd10
shl esi, cl
shl cx, 0xd
mov ecx, dword [eax + 4]
cmp eax, esi
xor ebx, ebx
stc
jmp 0xb81914
mov dword [ebp - 0x20], edx
sub esi, edi
mov dword [ebp - 0x44], esi
xchg si, si
mov esi, edi
jmp 0xa28fc1
mov dword [ebp - 0x24], edi
jmp 0xa1809c
or dl, al
mov eax, 0xd410fd0a
ror eax, 0x3c
bt ax, cx
not dl
bts eax, eax
mov word [esi + ecx - 0x185e9a1f], dx
mov dword [esp + ecx - 0x185e9a1f], eax
sar cx, 0x62
call fcn.00a0ff5d
push ebp
mov ebp, esp
cmp ecx, edi
sub dx, ax
lea esp, [esp - 0x48]
btc cx, 0xae
sal ch, 0x94
btc cx, cx
mov ecx, dword [eax + 8]
stc
sbb dh, 0xb0
mov edx, dword [eax + 0xc]
push ebx
jmp 0xaef3c9

Function at 0xc60a82
Capabilities:
Execute syscall

Disassembly:
call fcn.00bd5cfb
syscall
call fcn.00bd3e17
push 0x802d3b90
lea esp, [esp + 0x20]
jmp 0xc2aa3e

Function at 0xc6166a
Capabilities:
Encode data using base64

Disassembly:
pop eax
adc ebp, 1
shr edx, cl
mov dword [ebp], edx
mov edx, 0x553cb990
movzx ecx, dl
lea edi, [edi + edx - 0x553cb994]
dec ecx
mov edx, dword [edx + edi - 0x553cb990]
jno 0xa92ade
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x40bc83
Capabilities:
Check mutex on windows

Disassembly:
push 0xa0
mov eax, 0x44f2eb
call fcn.0042a475
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x40bd43
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x40bd3b
push 1
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x40bd3b
push 1
lea ecx, [ebp - 0xac]
call fcn.00403308
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 1
push str.finish_waiting_for_mutex:
push eax
call fcn.00402636
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0xac]
call fcn.00403d97
lea eax, [ebp - 0xac]
push eax
push str.msi::waitForInstallationCompletion
push 0x1c8
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_MsiUtils.cpp
push 1
call fcn.0041205e
mov ecx, eax
call fcn.0040712f
lea ecx, [ebp - 0xac]
call fcn.00404073
cmp edi, 0x102
je 0x40bd45
mov bl, 1
push esi
mov dword [ebp - 4], 3
call fcn.00418377
pop ecx
mov al, bl
call fcn.0042a443
ret
Function at 0x40c713
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x44f437
call fcn.0042a4a8
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00404453
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], ebx
jb 0x40c75c
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x40c822
lea ecx, [ebp - 0x35]
push ecx
push eax
mov ecx, edi
call fcn.004075be
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x40c789
mov ecx, dword [esi]
push dword [edi]
push eax
push dword [ebp - 0x3c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40c818
push 0x487
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.004036cc
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push sub.VERSION.dll_GetFileVersionInfoA
push 0x455064
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.004033cf
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.00403810
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.00402621
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00402805
mov ecx, eax
call fcn.00402621
push eax
lea ecx, [ebp - 0x50]
call fcn.0041863a
mov byte [ebp - 4], 9
jmp 0x40c89c
mov eax, esi
call fcn.0042a457
ret 4
push 0x47e
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.004036cc
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push sub.VERSION.dll_GetFileVersionInfoSizeA
push 0x455064
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.004033cf
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.00403810
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.00402621
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00402805
mov ecx, eax
call fcn.00402621
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041863a
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004073ff
add esp, 0xc
lea eax, [ebp - 0x34]
push 0x469fa8
push eax
call fcn.0042d22c
int3
Function at 0x40c9ea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47129c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x40ca41
cmp byte [esi + 0x3d], bl
je 0x40ca41
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40ca7a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x40ca52
sub eax, 1
je 0x40ca55
dec eax
sub eax, 1
jne 0x40ca7a
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a435
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40ca72
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004328a7
add esp, 0x10
cmp edi, eax
jne 0x40ca7a
cmp byte [esi + 0x3d], bl
sete al
jmp 0x40ca43
xor al, al
jmp 0x40ca43

Function at 0x40cf16
Capabilities:
Delete directory

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb8
push ebx
push esi
mov esi, dword [ebp + 0x78]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x40cf30
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne cl
xor ebx, ebx
mov byte [ebp + 0x7b], cl
test eax, eax
je 0x40d00a
push ebx
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x40d007
push esi
lea ecx, [ebp + 0x50]
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
call fcn.00404453
push 1
lea ecx, [ebp - 0x48]
call fcn.00403308
lea eax, [ebp - 0x48]
push str.Deleted__
push eax
call fcn.00402636
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004025f0
mov eax, dword [ebp + 0x64]
add esp, 0x10
cmp eax, 0x10
jb 0x40cfcf
mov ecx, dword [ebp + 0x50]
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x68], ecx
cmp eax, 0x1000
jb 0x40cfc6
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00404387
mov eax, dword [ebp + 0x6c]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x68]
push eax
push ecx
call fcn.0042a1d1
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push str.__directory
push eax
call fcn.00402636
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
push str.FileUtils::deleteDirectory
push 0x2ab
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_FileUtils.cpp
push ebx
call fcn.0041205e
mov ecx, eax
call fcn.0040712f
lea ecx, [ebp - 0x48]
call fcn.00404073
mov cl, byte [ebp + 0x7b]
test cl, cl
jne 0x40d021
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d646
add esp, 4
test al, al
je 0x40d023
mov bl, 1
pop esi
mov al, bl
pop ebx
add ebp, 0x70
leave
ret
Function at 0x40d2a1
Capabilities:
Delete file

Disassembly:
push 0x98
mov eax, 0x44f4d9
call fcn.0042a475
mov esi, dword [ebp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x40d2bd
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40d36a
xor edi, edi
push edi
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x40d366
sub esp, 0x18
mov ecx, esp
mov dword [ebp + 0xc], esp
push esi
mov dword [ecx], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.00404453
push 1
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], edi
call fcn.00403308
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 1
push str.Deleted__
push eax
call fcn.00402636
pop ecx
pop ecx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 2
call fcn.00402805
mov esi, eax
push str.__file
push esi
call fcn.00402636
pop ecx
pop ecx
push esi
push str.FileUtils::_anonymous_namespace::deleteFileImpl
push 0x278
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_FileUtils.cpp
push edi
call fcn.0041205e
mov ecx, eax
call fcn.0040712f
lea ecx, [ebp - 0xa4]
call fcn.00404073
mov al, 1
jmp 0x40d379
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d646
add esp, 4
call fcn.0042a443
ret

Function at 0x40d60a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0x10
jb 0x40d616
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d629
test al, 0x10
je 0x40d629
mov al, 1
ret
xor al, al
ret

Function at 0x40d62c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0x10
jb 0x40d638
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret
Function at 0x40dcab
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
test ebp, ebp
jg 0x40dcc5
jl 0x40dcbc
test ebx, ebx
jne 0x40dcc5
xor eax, eax
xor edx, edx
jmp 0x40dd8a
cmp dword [esi + 0x38], 0
je 0x40dcdb
push ebp
push ebx
push dword [esp + 0x1c]
call fcn.0040670e
jmp 0x40dd8a
mov eax, dword [esi + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x40dd21
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x40dd21
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [esp + 0x18]
cmovb esi, dword [eax]
push esi
push ecx
push edi
call fcn.004054a7
mov ecx, dword [esp + 0x1c]
add edi, esi
mov dword [esp + 0x24], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0x40dd29
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x4c], 0
je 0x40dd80
mov ecx, esi
call fcn.0040cb99
mov ecx, dword [esp + 0x18]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0x40dd6b
push dword [esi + 0x4c]
push eax
push 1
push ecx
call fcn.0043223b
mov ecx, dword [esp + 0x28]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x18], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x40dd80
jmp 0x40dd3c
test edx, edx
je 0x40dd80
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.0043223b
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb ebp, 0
mov edx, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x40eb9e
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x148]
sub esp, 0x148
push 0xffffffffffffffff
push 0x44f802
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x47129c]
xor eax, ebp
mov dword [ebp + 0x144], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x150]
lea eax, [ebp + 0x40]
mov edi, dword [ebp + 0x154]
mov ebx, dword [ebp + 0x158]
push 0x104
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.0042d050
add esp, 0xc
lea eax, [ebp + 0x40]
xor edx, edx
mov ecx, 0x8000
push eax
xor eax, eax
cmp ebx, 1
push edx
cmove eax, ecx
push edx
or eax, edi
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x40ec74
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x28]
call fcn.004033eb
lea eax, [ebp + 0x28]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.0040d7e7
pop ecx
pop ecx
lea ecx, [ebp + 0x28]
call fcn.0040524f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x144]
xor ecx, ebp
call fcn.0042a435
add ebp, 0x148
leave
ret
lea ecx, [ebp - 0xc8]
call fcn.00403810
push dword [ebp - 0x10]
and dword [ebp - 4], 0
mov ecx, eax
push 0x454b7c
push ebx
push str.__mode
push edi
push 0x411213
push str.SHGetFolderPath_0x
call fcn.00402621
mov ecx, eax
call fcn.0040e895
mov ecx, eax
call fcn.00409f08
mov ecx, eax
call fcn.00402621
mov ecx, eax
call fcn.00409f08
mov ecx, eax
call fcn.00402621
push eax
lea ecx, [ebp - 0x30]
call fcn.00418f70
mov esi, eax
push 0x1f5
push str.SysInfo::SHGetFolderPathAdapter
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_SysInfo.cpp
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004036cc
push eax
lea eax, [ebp]
push esi
push eax
call fcn.0040e4d4
add esp, 0xc
lea eax, [ebp]
push 0x46b6d0
push eax
call fcn.0042d22c
int3
Function at 0x410ec6
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x44fac1
call fcn.0042a4a8
mov eax, dword [ebp + 8]
mov edi, 0x104
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
call fcn.0042a1a1
mov ebx, eax
mov dword [ebp - 0x40], ebx
lea esi, [ebx + 0x104]
push esi
push ebx
mov dword [ebp - 0x38], esi
call fcn.0040768a
add esp, 0xc
mov dword [ebp - 0x3c], esi
and dword [ebp - 4], 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, ebx
cmp eax, 0x104
jbe 0x410f38
lea ecx, [ebp - 0x2d]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004075be
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
sub eax, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp - 0x38]
mov edi, ebx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004033eb
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
push ebx
mov byte [ebp - 4], 1
call fcn.0040d7e7
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0040524f
test edi, edi
je 0x410f8e
sub esi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], esi
cmp esi, 0x1000
jb 0x410f85
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00404387
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x2c]
pop ecx
pop ecx
push esi
push edi
call fcn.0042a1d1
pop ecx
pop ecx
mov eax, ebx
call fcn.0042a457
ret

Function at 0x41160e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0042d050
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x41414d
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
and dword [esp + 4], 0
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0xc
push 0
push eax
xor ebp, ebp
lea edi, [esi + 0xc8]
inc ebp
push edi
lea ebx, [esi + 0xc4]
mov dword [esp + 0x24], ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x413ce9
mov eax, dword [edi]
or dword [esi + 0x9c], 0x100
push 0
push ebp
push dword [ebx]
mov dword [esi + 0xb0], eax
mov dword [esi + 0xac], eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ebx, ebx
inc ebx
push ebx
mov dword [esi + 0x50], ebx
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x413ce5
push str.Create_pipe_SUCCESS
push str.Executor::createPipe
push 0xe8
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_Executor.cpp
push ebx
call fcn.0041205e
mov ecx, eax
call fcn.00405fbe
mov al, bl
jmp 0x413d1d
push ebp
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x413d1b
push str.Create_pipe_FAILURE
push str.Executor::createPipe
push 0xeb
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_Executor.cpp
push ebp
call fcn.0041205e
mov ecx, eax
call fcn.00405fbe
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
push edi
mov edi, ecx
push 0x44
push 0
lea esi, [edi + 0x70]
push esi
call fcn.0042d050
push 0x10
lea eax, [edi + 0x60]
mov dword [esi], 0x44
push 0
push eax
call fcn.0042d050
add esp, 0x18
cmp dword [edi + 0xb4], 1
jne 0x414194
or dword [edi + 0x9c], 1
xor eax, eax
mov word [edi + 0xa0], ax
mov dword [edi + 0x54], 0x8000000
cmp byte [edi + 0xc1], 0
je 0x4141a6
mov ecx, edi
pop edi
pop esi
jmp 0x413c4f
pop edi
pop esi
ret
Function at 0x4142cd
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x450326
call fcn.0042a4a8
mov esi, ecx
xor ebx, ebx
lea edi, [esi + 0x30]
inc ebx
push ebx
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x414331
push edi
lea eax, [ebp - 0x28]
push str.Executor.exec__:
push eax
call fcn.0040286b
add esp, 0xc
and dword [ebp - 4], 0
push eax
push str.Executor::startExecution
push 0x93
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_Executor.cpp
push ebx
call fcn.0041205e
mov ecx, eax
call fcn.00412348
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040524f
mov ecx, esi
call fcn.0041414d
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x414342
mov ecx, dword [edi]
mov eax, dword [edi + 0x10]
add eax, ecx
cmp dword [edi + 0x14], 0x10
jb 0x41434f
mov edi, dword [edi]
lea ecx, [ebp - 0x29]
push ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040bd67
lea eax, [ebp - 0x29]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x29], 0
call fcn.0040c3c3
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x41437a
mov ecx, dword [esi]
lea eax, [esi + 0x60]
push eax
lea eax, [esi + 0x70]
push eax
push dword [esi + 0x5c]
push dword [esi + 0x58]
push dword [esi + 0x54]
push dword [esi + 0x50]
push dword [esi + 0x4c]
push dword [esi + 0x48]
push dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.00407314
mov al, bl
call fcn.0042a457
ret