joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x55fb7c
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x55fb98
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x55fb87
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push edx
push eax
mov ecx, ebx
call fcn.0049b9d0
mov esi, dword [eax + 4]
test esi, esi
je 0x55fc0a
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x55fbd7
cmp eax, esi
jne 0x55fbcf
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x55fbdf
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x55fbdf
cmp eax, esi
jne 0x55fbdf
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [esi + 4]
push esi
push edx
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.00538130
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x56f6d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 0x10]
shr ecx, 4
inc ecx
movzx ebx, cx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x56f70e
push 0x409
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_load_message_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x1e
push eax
call fcn.0056f6a0
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 4]
mov edi, eax
push ebx
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x21
push ecx
call fcn.0056f6a0
mov edx, ebx
add esp, 0x18
and edx, 0xf
xor eax, eax
nop dword [eax]
movzx ecx, word [edi]
add edi, 2
test cx, cx
je 0x56f772
cmp eax, edx
je 0x56f7b4
lea edi, [edi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x56f760
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_find_message_resource__u
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x36
push eax
call fcn.004a8010
mov eax, dword [ebp + 8]
add esp, 0x18
xor ecx, ecx
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
push ecx
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00486be0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x56f7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [ebp + 0xc]
mov edi, eax
push 0xa
movzx ecx, bx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [ebp + 4]
mov esi, eax
push ebx
push str.failed_to_find_RCDATA_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x3e
push ecx
call fcn.0056f6a0
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 0xc]
mov ebx, eax
test ebx, ebx
push str.failed_to_get_size_of_resource__u
sete cl
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x41
push ecx
call fcn.004a8010
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 4]
mov edi, eax
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x43
push ecx
call fcn.0056f6a0
mov esi, dword [ebp + 8]
add esp, 0x18
mov ecx, esi
push ebx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push edi
mov byte [esi], 0
call fcn.00486af0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x56f8b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
mov edi, eax
shr ecx, 4
inc ecx
push 0x409
movzx ebx, cx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x56f8f0
push 0x409
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_load_message_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x1e
push eax
call fcn.0056f6a0
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 4]
mov edi, eax
push ebx
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x21
push ecx
call fcn.0056f6a0
mov edx, ebx
add esp, 0x18
and edx, 0xf
xor eax, eax
nop
movzx ecx, word [edi]
add edi, 2
test cx, cx
je 0x56f952
cmp eax, edx
je 0x56f994
lea edi, [edi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x56f940
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_find_message_resource__u
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x36
push eax
call fcn.004a8010
mov eax, dword [ebp + 8]
add esp, 0x18
xor ecx, ecx
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
push ecx
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00486be0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x56fcb0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x56fdc4
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push dword [ebp - 8]
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x56fd0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56fdc4
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x56fdc4
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 8]
call edi
test eax, eax
jne 0x56fd43
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x56fdc6
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x500
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x56fda7
xor edi, edi
cmp dword [esi], edi
jbe 0x56fda7
lea ebx, [esi + 4]
nop word [eax + eax]
push dword [ebx]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x56fdc0
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x56fd90
xor bl, bl
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x56fdb7
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x56fdc6
mov bl, 1
jmp 0x56fda9
xor bl, bl
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x56fdd9
cmp ecx, 0xffffffff
je 0x56fdd9
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x570d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x570dab
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x570df0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570df0
cmp dword [ebp + 8], ebx
jne 0x570df0
mov bl, 1
jmp 0x570e1d
cmp dword [edi + 0x14], 8
jb 0x570df8
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_append_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xd7
push eax
call fcn.0056e9e0
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x570e28
test esi, esi
je 0x570e28
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x570f80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.00571e90
add esp, 4
test al, al
jne 0x570f97
pop esi
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x570fa1
mov eax, dword [esi]
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x570fb0
mov ecx, dword [edi]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
cmp dword [esi + 0x14], 8
jb 0x570fc7
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x570fcf
mov edi, dword [edi]
push esi
push edi
mov cl, bl
xor cl, 1
push str.Failed_to_copy__s_to__s
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xa0
push ecx
call fcn.0056e9e0
add esp, 0x1c
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x5712e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x5712fb
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x571317
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, 0xffffffff
jne 0x57135c
cmp dword [esi + 0x14], 8
jb 0x571324
mov esi, dword [esi]
call edi
cmp eax, 2
je 0x571336
call edi
cmp eax, 3
je 0x571336
mov al, 1
jmp 0x571338
xor al, al
push esi
push str.failed_to_get_attributes_of_file__s
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x84
push eax
call fcn.0056e9e0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
test ebx, 0x450
pop esi
sete al
pop ebx
pop ebp
ret

Function at 0x571370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x57138b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x5713a7
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, 0xffffffff
jne 0x5713ec
cmp dword [esi + 0x14], 8
jb 0x5713b4
mov esi, dword [esi]
call edi
cmp eax, 2
je 0x5713c6
call edi
cmp eax, 3
je 0x5713c6
mov al, 1
jmp 0x5713c8
xor al, al
push esi
push str.failed_to_get_attributes_of_folder__s
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x94
push eax
call fcn.0056e9e0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
shr ebx, 4
pop edi
and bl, 1
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x571400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x57141b
mov eax, dword [edi]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x571463
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x571463
cmp dword [ebp + 8], ebx
jne 0x571463
mov bl, 1
jmp 0x571490
cmp dword [edi + 0x14], 8
jb 0x57146b
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_overwrite_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xea
push eax
call fcn.0056e9e0
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x57149b
test esi, esi
je 0x57149b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x5714b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x74be6d
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x5714e3
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x5715c9
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x571558
cmp dword [edi + 0x14], 8
jb 0x571530
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_get_file_size_of__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xfd
push eax
call fcn.0056e9e0
mov esi, dword [ebp - 0x10]
add esp, 0x18
xor bl, bl
jmp 0x5715f9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x1c]
mov dword [eax], ebx
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp + 8], edx
sub edx, eax
cmp ebx, edx
jb 0x5715a1
jbe 0x5715a6
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
cmp ebx, eax
jbe 0x57158b
lea eax, [ebp + 0xb]
push eax
push ebx
call fcn.0049baa0
mov ecx, dword [ebp + 0xc]
jmp 0x5715a6
sub ebx, edx
push ebx
push 0
push dword [ebp + 8]
call fcn.007051b0
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
add eax, ebx
mov dword [ecx + 4], eax
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebx]
push dword [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5715c9
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebx]
jne 0x5715c9
mov bl, 1
jmp 0x5715f9
cmp dword [edi + 0x14], 8
jb 0x5715d1
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_read_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x106
push eax
call fcn.0056e9e0
mov esi, dword [ebp - 0x10]
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x571604
test esi, esi
je 0x571604
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x571e90
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x571ea9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x571ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x571ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x571ef5
cmp dword [esi + 0x14], 8
jb 0x571ed2
mov esi, dword [esi]
mov eax, dword [ebp + 4]
push esi
push str.Failed_to_remove__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xbc
push eax
call fcn.0056e9e0
add esp, 0x18
xor al, al
pop esi
pop ebp
ret
mov al, 1
pop esi
pop ebp
ret

Function at 0x571f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74bf06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
jmp dword [eax*4 + 0x5720b0]
Function at 0x573220
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x14], 8
mov eax, ecx
mov dword [ebp - 4], 0
jb 0x573235
mov eax, dword [ecx]
push esi
lea edx, [ebp - 4]
push edx
push dword [ecx + 0x18]
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x573266
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x57325a
mov eax, dword [eax]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x573274
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x573280
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x573299
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [esi + 0x18]
lea edi, [esi + 0x1c]
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5732b7
cmp eax, 2
jne 0x5732ef
test eax, eax
mov eax, dword [ebp - 4]
push ebx
sete bl
test eax, eax
je 0x5732cb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x5732d8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x5732e0
mov esi, dword [esi]
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcRegistryKey.cpp
push 0x63
push eax
call fcn.00478fd0
int3
Function at 0x573300
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74c02d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x79d0d8
push ebx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push esi
push edi
mov dword [ebp - 0x58], 0x573610
mov dword [ebp - 0x34], 0x79d0bc
mov dword [ebp - 0x30], 0x573600
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov esi, 1
test eax, eax
cmovne esi, eax
cmp dword [ecx + 0x14], 8
mov eax, ecx
mov byte [ebp - 4], 2
mov dword [ebp + 0x10], 0
jb 0x57336f
mov eax, dword [ecx]
lea edx, [ebp + 0x10]
push edx
push dword [ecx + 0x18]
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x5733d6
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x573396
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5733b5
mov edx, dword [ecx]
lea eax, [ebp - 0x34]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x57345c
mov edx, dword [ecx]
lea eax, [ebp - 0x5c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x57345c
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x573471
mov eax, dword [ecx]
mov edi, dword [ebp + 0xc]
push edi
call dword [eax + 8]
mov ecx, dword [ebp - 0x38]
mov ebx, eax
test ecx, ecx
je 0x573471
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x573406
mov eax, dword [eax]
push ecx
push ebx
push esi
push 0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x573425
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x573444
mov edx, dword [ecx]
lea eax, [ebp - 0x34]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x57345c
mov esi, dword [ecx]
lea eax, [ebp - 0x5c]
cmp ecx, eax
setne al
movzx edx, al
push edx
call dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.006ee13d
int3
Function at 0x573480
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74c05d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], vtable.std::_Func_impl_no_alloc_int____cdecl___int_const____int__int_const__.0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
push esi
push edi
mov dword [ebp - 0x5c], fcn.005725d0
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_unsigned_char_const_____cdecl___int_const____unsigned_char_const___int_const__.0
mov dword [ebp - 0x34], fcn.0053abf0
mov dword [ebp - 0x14], eax
cmp dword [ecx + 0x14], 8
mov eax, ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
jb 0x5734dd
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push dword [ecx + 0x18]
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x573553
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x573504
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x573523
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x5735e1
mov edx, dword [ecx]
lea eax, [ebp - 0x60]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x5735f5
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x3c]
mov esi, eax
test ecx, ecx
je 0x5735f5
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
call dword [eax + 8]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x57358a
mov eax, dword [eax]
push ecx
push esi
push 4
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5735aa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x5735c9
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x5735e1
mov esi, dword [ecx]
lea eax, [ebp - 0x60]
cmp ecx, eax
setne al
movzx edx, al
push edx
call dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.006ee13d
int3