joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5570c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x746183
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edx, esi
cmp dword [esi + 0x14], 0x10
jb 0x5570ed
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x557112
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x557100
push edi
push esi
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.004990e0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x557142
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x3ffffff
je 0x55727c
lea eax, [ebx + 4]
mov dword [ebp - 0x18], eax
push 0x40
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00512870
add esp, 4
mov dword [ebp - 0x14], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 0xc], eax
push esi
call fcn.00480e80
mov esi, dword [ebp - 0x14]
add esi, 0x20
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], esi
push 0x68
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00512870
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 3
push 0x10
call fcn.00491eb0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75a370]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75a370]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x55724f
mov ecx, ebx
call fcn.00558f50
mov eax, dword [ebp - 0x14]
mov ecx, ebx
push edi
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004990e0
mov ecx, dword [eax]
jmp 0x557252
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x14]
push ecx
push edi
mov ecx, ebx
call fcn.004cedd0
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ea2aa
int3
Function at 0x557290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x5572ae
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x5572d4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x5572c0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004990e0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x5572f4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x558870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x746465
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x55889d
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x5588c2
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x5588b0
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.004990e0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x5589d2
cmp dword [ebx + 8], 0x2762762
je 0x5589e8
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x68
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00512870
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.00480e80
push 0x48
lea eax, [edi + 0x18]
push 0
push eax
call fcn.007012e0
add esp, 0xc
mov dword [edi + 0x38], 0x1f4
mov dword [edi + 0x3c], 0x1388
mov dword [edi + 0x40], 2
mov dword [edi + 0x44], 0xfa
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0x7530
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 1
mov dword [edi + 0x58], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75a370]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75a370]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x5589c3
mov ecx, ebx
call fcn.00558f50
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.004990e0
mov ecx, dword [eax]
jmp 0x5589c6
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.004cedd0
mov ecx, dword [ebp - 0xc]
add eax, 0x20
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.006ea2aa
int3
Function at 0x558fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp edx, eax
je 0x55915c
cmp dword [edx + 0x1c], 0x10
lea ecx, [ebx + 4]
mov eax, dword [ecx]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], ecx
jb 0x559023
mov edi, dword [edi]
xor edx, edx
mov ebx, 0x811c9dc5
test eax, eax
je 0x559044
mov ecx, eax
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x559030
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, ebx
lea eax, [edx + eax*8]
mov edx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.00535f50
push 0x40
push edi
call fcn.00512900
mov ecx, dword [ebp - 4]
add esp, 0x10
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x5590af
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x559060
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x559152
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x5590c1
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x5590c4
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x559152
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x5590e0
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x559101
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x5590f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
nop dword [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.00535f50
push 0x40
push edi
call fcn.00512900
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp + 0xc]
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x559163
cmp esi, eax
jne 0x559120
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x5590d2
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x55a560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x55a57c
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x55a598
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x55a587
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push edx
push eax
mov ecx, ebx
call fcn.004990e0
mov esi, dword [eax + 4]
test esi, esi
je 0x55a60a
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x55a5d7
cmp eax, esi
jne 0x55a5cf
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x55a5df
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x55a5df
cmp eax, esi
jne 0x55a5df
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [esi + 4]
push esi
push edx
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.00533650
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x56ab10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 0x10]
shr ecx, 4
inc ecx
movzx ebx, cx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x56ab4e
push 0x409
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_load_message_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x1e
push eax
call fcn.0056aae0
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 4]
mov edi, eax
push ebx
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x21
push ecx
call fcn.0056aae0
mov edx, ebx
add esp, 0x18
and edx, 0xf
xor eax, eax
nop dword [eax]
movzx ecx, word [edi]
add edi, 2
test cx, cx
je 0x56abb2
cmp eax, edx
je 0x56abf4
lea edi, [edi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x56aba0
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_find_message_resource__u
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x36
push eax
call fcn.004a5a30
mov eax, dword [ebp + 8]
add esp, 0x18
xor ecx, ecx
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
push ecx
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00483f80
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x56ac20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [ebp + 0xc]
mov edi, eax
push 0xa
movzx ecx, bx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [ebp + 4]
mov esi, eax
push ebx
push str.failed_to_find_RCDATA_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x3e
push ecx
call fcn.0056aae0
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 0xc]
mov ebx, eax
test ebx, ebx
push str.failed_to_get_size_of_resource__u
sete cl
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x41
push ecx
call fcn.004a5a30
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 4]
mov edi, eax
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x43
push ecx
call fcn.0056aae0
mov esi, dword [ebp + 8]
add esp, 0x18
mov ecx, esi
push ebx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push edi
mov byte [esi], 0
call fcn.00483e90
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x56acf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
mov edi, eax
shr ecx, 4
inc ecx
push 0x409
movzx ebx, cx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x56ad30
push 0x409
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_load_message_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x1e
push eax
call fcn.0056aae0
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 4]
mov edi, eax
push ebx
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x21
push ecx
call fcn.0056aae0
mov edx, ebx
add esp, 0x18
and edx, 0xf
xor eax, eax
nop
movzx ecx, word [edi]
add edi, 2
test cx, cx
je 0x56ad92
cmp eax, edx
je 0x56add4
lea edi, [edi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x56ad80
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_find_message_resource__u
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x36
push eax
call fcn.004a5a30
mov eax, dword [ebp + 8]
add esp, 0x18
xor ecx, ecx
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
push ecx
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00483f80
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x56b0f0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x56b204
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push dword [ebp - 8]
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x56b14d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56b204
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x56b204
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 8]
call edi
test eax, eax
jne 0x56b183
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x56b206
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x500
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x56b1e7
xor edi, edi
cmp dword [esi], edi
jbe 0x56b1e7
lea ebx, [esi + 4]
nop word [eax + eax]
push dword [ebx]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x56b200
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x56b1d0
xor bl, bl
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x56b1f7
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x56b206
mov bl, 1
jmp 0x56b1e9
xor bl, bl
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x56b219
cmp ecx, 0xffffffff
je 0x56b219
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56c1d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x56c1eb
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x56c230
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56c230
cmp dword [ebp + 8], ebx
jne 0x56c230
mov bl, 1
jmp 0x56c25d
cmp dword [edi + 0x14], 8
jb 0x56c238
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_append_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xd7
push eax
call fcn.00569e20
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x56c268
test esi, esi
je 0x56c268
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x56c3c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.0056d2d0
add esp, 4
test al, al
jne 0x56c3d7
pop esi
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x56c3e1
mov eax, dword [esi]
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x56c3f0
mov ecx, dword [edi]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
cmp dword [esi + 0x14], 8
jb 0x56c407
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x56c40f
mov edi, dword [edi]
push esi
push edi
mov cl, bl
xor cl, 1
push str.Failed_to_copy__s_to__s
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xa0
push ecx
call fcn.00569e20
add esp, 0x1c
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x56c720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x56c73b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x56c757
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, 0xffffffff
jne 0x56c79c
cmp dword [esi + 0x14], 8
jb 0x56c764
mov esi, dword [esi]
call edi
cmp eax, 2
je 0x56c776
call edi
cmp eax, 3
je 0x56c776
mov al, 1
jmp 0x56c778
xor al, al
push esi
push str.failed_to_get_attributes_of_file__s
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x84
push eax
call fcn.00569e20
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
test ebx, 0x450
pop esi
sete al
pop ebx
pop ebp
ret

Function at 0x56c7b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x56c7cb
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x56c7e7
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, 0xffffffff
jne 0x56c82c
cmp dword [esi + 0x14], 8
jb 0x56c7f4
mov esi, dword [esi]
call edi
cmp eax, 2
je 0x56c806
call edi
cmp eax, 3
je 0x56c806
mov al, 1
jmp 0x56c808
xor al, al
push esi
push str.failed_to_get_attributes_of_folder__s
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x94
push eax
call fcn.00569e20
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
shr ebx, 4
pop edi
and bl, 1
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x56c840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x56c85b
mov eax, dword [edi]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x56c8a3
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56c8a3
cmp dword [ebp + 8], ebx
jne 0x56c8a3
mov bl, 1
jmp 0x56c8d0
cmp dword [edi + 0x14], 8
jb 0x56c8ab
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_overwrite_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xea
push eax
call fcn.00569e20
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x56c8db
test esi, esi
je 0x56c8db
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret