joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c1be
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x4770ea
call fcn.00448ddd
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00404b39
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x3c], ebx
jb 0x42c205
mov eax, dword [esi]
mov ebx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call ebx
test eax, eax
je 0x42c2ca
push edi
push eax
mov ecx, edi
call fcn.00418eeb
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x42c232
mov ecx, dword [esi]
push dword [edi]
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push eax
push dword [ebp - 0x3c]
push ecx
call edi
test eax, eax
jne 0x42c2c0
push 0x46d
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.00402dde
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x490f18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00403e50
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.00402b9d
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.0040544d
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00405461
mov ecx, eax
call fcn.0040544d
push eax
lea ecx, [ebp - 0x50]
call fcn.00435e5f
mov byte [ebp - 4], 9
jmp 0x42c340
mov eax, esi
call fcn.00448d87
ret 4
push 0x464
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.00402dde
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x490f18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00403e50
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.00402b9d
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.0040544d
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00405461
mov ecx, eax
call fcn.0040544d
push eax
lea ecx, [ebp - 0x5c]
call fcn.00435e5f
mov byte [ebp - 4], 5
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.0041e178
lea eax, [ebp - 0x38]
mov dword [esp], 0x4a7154
push eax
call fcn.0044c197
int3

Function at 0x42df77
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0044b900
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x42e4cf
Capabilities:
Get common file path

Disassembly:
push 0x2c
mov eax, 0x477578
call fcn.00448ddd
mov esi, ecx
mov dword [ebp - 0x38], esi
push ecx
push 0x104
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], esi
call fcn.00410bb9
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
cmp edx, eax
jbe 0x42e532
lea eax, [ebp - 0x34]
push eax
push edx
mov ecx, eax
call fcn.00425854
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403e12
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0042aa4f
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0x34]
call fcn.0040c03a
mov eax, esi
call fcn.00448d87
ret

Function at 0x42e5a8
Capabilities:
Get common file path

Disassembly:
push 0x208
mov eax, 0x4775be
call fcn.00448ddd
mov esi, ecx
mov dword [ebp - 0x160], esi
push 0x104
xor ebx, ebx
mov dword [ebp - 0x160], esi
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.0044b900
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push 0x8023
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, eax
test edi, edi
jne 0x42e630
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
call fcn.00403e12
lea edx, [ebp - 0x134]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.0042aa4f
lea ecx, [ebp - 0x134]
call fcn.004049c7
mov eax, esi
call fcn.00448d87
ret
lea ecx, [ebp - 0x214]
call fcn.00402b9d
push edi
push ecx
push 0x48b2dc
sub esp, 0xc
mov dword [ebp - 4], ebx
push str.__mode
push ecx
push 0x23
push 0x412372
push str.SHGetFolderPath_0x
mov ecx, eax
call fcn.0040544d
mov ecx, eax
call fcn.00412389
mov ecx, eax
call fcn.00413a79
pop ecx
mov ecx, eax
call fcn.0040544d
pop ecx
mov ecx, eax
call fcn.0042eaac
pop ecx
mov ecx, eax
call fcn.0040544d
pop ecx
push eax
lea ecx, [ebp - 0x17c]
call fcn.00433be6
mov edx, eax
push 0x1bf
push str.SysInfo::SHGetFolderPathAdapter
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_windows_common_SysInfo.cpp
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 1
call fcn.00402dde
push eax
lea ecx, [ebp - 0x15c]
call fcn.0042eabe
lea eax, [ebp - 0x15c]
mov dword [esp], 0x4a7454
push eax
call fcn.0044c197
int3
Function at 0x42ef4f
Capabilities:
Create process on windows

Disassembly:
push 0x24
mov eax, 0x477739
call fcn.00448ddd
mov esi, ecx
cmp dword [0x4ae0bc], 1
jg 0x42efa4
lea eax, [esi + 0x30]
mov edx, str.Executor.exec__:
push eax
lea ecx, [ebp - 0x28]
call fcn.00409fb1
pop ecx
and dword [ebp - 4], 0
mov ecx, 0x4ae0bc
push eax
push str.Executor::startExecution
push 0x93
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_windows_common_Executor.cpp
push 1
call fcn.00427250
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049c7
push 0x44
pop ebx
push ebx
lea edi, [esi + 0x70]
push 0
push edi
call fcn.0044b900
add esp, 0xc
mov dword [edi], ebx
lea ebx, [esi + 0x60]
push 0x10
push 0
push ebx
call fcn.0044b900
add esp, 0xc
cmp dword [esi + 0xb4], 1
jne 0x42efe8
or dword [esi + 0x9c], 1
xor eax, eax
mov word [esi + 0xa0], ax
mov dword [esi + 0x54], 0x8000000
cmp byte [esi + 0xc1], 0
je 0x42eff8
mov ecx, esi
call fcn.0042f436
lea ecx, [esi + 0x30]
cmp dword [ecx + 0x14], 0x10
mov edx, ecx
jb 0x42f005
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x42f012
mov ecx, dword [ecx]
push dword [ebp - 0x2d]
xor edx, edx
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
call fcn.00410c35
lea eax, [ebp - 0x29]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x29], 0
call fcn.00411d31
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x42f04b
mov eax, dword [esi]
push ebx
push edi
push dword [esi + 0x5c]
push dword [esi + 0x58]
push dword [esi + 0x54]
push dword [esi + 0x50]
push dword [esi + 0x4c]
push dword [esi + 0x48]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.0040c03a
mov al, bl
call fcn.00448d87
ret
Function at 0x4341d7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x7c
mov eax, 0x478549
call fcn.00448ddd
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push esi
call fcn.00433c44
xor ebx, ebx
cmp dword [ebp - 0x34], ebx
je 0x43426f
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x84]
push ebx
or eax, 0x20019
push eax
lea eax, [ebp - 0x44]
push eax
push dword [edi]
call fcn.00433c76
mov esi, dword [ebp - 0x84]
add esp, 0x10
cmp dword [ebp - 0x7c], ebx
je 0x434226
mov al, byte [ebp - 0x80]
jmp 0x43425b
push ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x69], bl
push eax
mov al, byte [ebp - 0x80]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x44]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x68]
push edi
call fcn.00433e12
mov ecx, eax
call fcn.004341d7
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.00433f49
mov al, byte [ebp - 0x69]
mov dword [ebp - 4], 1
test al, al
je 0x434296
push esi
call fcn.00436b4f
pop ecx
jmp 0x434296
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
jb 0x43427d
mov esi, dword [esi]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x434296
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004049c7
lea ecx, [ebp - 0x44]
call fcn.004049c7
mov al, bl
call fcn.00448d87
ret 8
Function at 0x4345ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0xac
push 0xffffffffffffffff
push 0x478701
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4aa068]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x78]
mov edi, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xbc]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x20], eax
call fcn.00433c44
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x88], eax
je 0x43469c
push eax
lea eax, [ebp + 0x78]
push eax
push ebx
lea ecx, [ebp + 0x3c]
call fcn.00433eb1
push dword [ebp - 0x20]
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.004345ff
lea ecx, [ebp + 0x3c]
call fcn.00433f49
jmp 0x434714
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp ecx, edx
cmove ecx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4346c5
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push ecx
push dword [ebp - 0x20]
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x43474e
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
jne 0x43476b
test ebx, ebx
jne 0x43476f
test ecx, ecx
jne 0x434751
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418eeb
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00418ebe
lea ecx, [ebp - 0x18]
call fcn.0040c03a
lea ecx, [ebp + 0x90]
call fcn.004049c7
lea ecx, [ebp + 0x78]
call fcn.004049c7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.004484c4
add ebp, 0xac
leave
ret 0xc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418eeb
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
jmp 0x4346ad
test ebx, ebx
je 0x4346f5
push str.query_value
lea ecx, [ebp + 0x60]
call fcn.00403e12
lea ecx, [ebp]
call fcn.00403e3f
mov ecx, dword [ebp - 0x24]
push eax
push edi
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.0043507c
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00426e87
push str.System_error
push ebx
mov byte [ebp - 4], 6
lea eax, [ebp - 0xd4]
push dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x30]
push eax
call fcn.00435e5f
mov edx, eax
push 0x12b
push str.Registry::getValue
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00402dde
push eax
lea ecx, [ebp + 0x18]
call fcn.0041e178
lea eax, [ebp + 0x18]
mov dword [esp], 0x4a7154
push eax
call fcn.0044c197
int3
Function at 0x434f39
Capabilities:
Delete registry value

Disassembly:
push 0x104
mov eax, 0x4788be
call fcn.00448ddd
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push esi
call fcn.00433c44
cmp dword [ebp - 0x30], 0
je 0x434fd7
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x78]
push 0
or eax, 0x2001f
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebx]
call fcn.00433c76
mov edi, dword [ebp - 0x70]
add esp, 0x10
mov esi, dword [ebp - 0x78]
test edi, edi
je 0x434f87
mov al, byte [ebp - 0x74]
jmp 0x434fbc
push 0x4ad119
lea eax, [ebp - 0x28]
push eax
mov al, byte [ebp - 0x74]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x40]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x64]
push ebx
call fcn.00433e12
mov ecx, eax
call fcn.00434f39
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.00433f49
xor eax, eax
mov dword [ebp - 4], 1
test al, al
je 0x435062
push esi
call fcn.00436b4f
pop ecx
jmp 0x435062
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x434fe1
mov eax, dword [esi]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
jne 0x435062
cmp dword [0x4ae0bc], eax
jg 0x435062
push ecx
push ecx
lea ecx, [ebp - 0x110]
call fcn.00403ead
mov edx, str.Deleted__
lea ecx, [ebp - 0x110]
call fcn.00406a2a
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push esi
push eax
call fcn.00434128
lea ecx, [ebp - 0x110]
call fcn.00405461
mov esi, eax
mov edx, str.__value
mov ecx, esi
call fcn.00406a2a
push esi
push str.Registry::deleteValue
push 0x1d2
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_windows_common_Registry.cpp
push edi
mov ecx, 0x4ae0bc
call fcn.00402d4b
lea ecx, [ebp - 0x110]
call fcn.00402bf1
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0x40]
call fcn.004049c7
mov eax, edi
call fcn.00448d87
ret 8
Function at 0x43631d
Capabilities:
Create thread

Disassembly:
push 0x70
mov eax, 0x478c6c
call fcn.00448ddd
mov edi, edx
mov esi, ecx
test edi, edi
jne 0x436339
or dword [esi], 0xffffffff
jmp 0x4363cb
xor ebx, ebx
mov dword [ebp - 0x58], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
call fcn.0043586d
mov byte [ebp - 4], 2
lea eax, [ebp - 0x54]
or dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], edi
push eax
push 0x436302
push ebx
push ebx
mov dword [ebp - 0x40], ebx
call fcn.0045c49e
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4363d3
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.00435a44
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
push 1
mov dword [ebp - 0x40], edi
call fcn.0043575e
jmp 0x4363b0
push ecx
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ecx + 8]
call fcn.004355f1
cmp dword [ebp - 0x40], 0
jne 0x4363a0
lea ecx, [ebp - 0x70]
call fcn.00435a97
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
mov dword [esi], eax
call fcn.004358bc
mov eax, esi
call fcn.00448d87
ret
lea ecx, [ebp - 0x7c]
call fcn.004355da
mov edx, eax
push 0x70
push str.ipc::Thread::start
push str.c:_jenkins_workspace_8_2_build_windows_amd64_cygwin_jdk8u261_295_install_src_ipc_windows_ThreadImpl.cpp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00402dde
push eax
lea ecx, [ebp - 0x38]
call fcn.00435908
lea eax, [ebp - 0x38]
mov dword [esp], 0x4a75a8
push eax
call fcn.0044c197
int3
Function at 0x43ae87
Capabilities:
Write file on windows

Disassembly:
push 0xe8
mov eax, 0x479c68
call fcn.00448ddd
mov esi, ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xf4], 0x495980
call fcn.00403ead
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xec]
mov eax, dword [ebp - 0xec]
push 0
mov eax, dword [eax + 4]
add ecx, eax
push dword [ecx + 0xc]
mov dword [ecx + 0x10], 6
call fcn.00402a26
mov dword [ebp - 4], 2
lea eax, [ebp - 0xf4]
push dword [esi + 4]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x30], eax
call fcn.0043fd86
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00404bca
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0043d7b4
cmp dword [ebp - 0x18], 0
jne 0x43af31
mov esi, 0x48bf1c
push esi
call fcn.004514d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00404a3c
push ecx
push ecx
mov edx, ebx
lea ecx, [ebp - 0x3c]
call fcn.0043d6db
pop ecx
pop ecx
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x44], edi
mov byte [ebp - 0x40], cl
mov byte [ebp - 4], 4
cmp byte [ebp - 0x38], 0
je 0x43af6b
cmp dword [ebp - 0x3c], 0
mov byte [ebp - 0x38], 0
je 0x43af6b
push dword [ebp - 0x3c]
call fcn.00456fb8
pop ecx
mov edx, ebx
test edi, edi
jne 0x43afe4
lea ecx, [ebp - 0x34]
call fcn.0043d694
mov cl, byte [eax + 4]
mov ebx, dword [eax]
mov byte [ebp - 0x29], cl
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], cl
mov byte [ebp - 4], 5
cmp byte [ebp - 0x30], 0
je 0x43afa8
cmp dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x30], 0
je 0x43afa8
push dword [ebp - 0x34]
call fcn.0045afa8
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push 0x132
push esi
push eax
push ebx
call fcn.0045b858
add esp, 0xc
mov edx, esi
mov ecx, eax
call fcn.0043c152
cmp byte [ebp - 0x29], 0
pop ecx
je 0x43b050
cmp ebx, 0xffffffff
je 0x43b050
push ebx
call fcn.0045afa8
pop ecx
jmp 0x43b050
lea eax, [ebp - 0x44]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043d706
pop ecx
pop ecx
mov bl, byte [eax + 4]
mov esi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], bl
mov byte [ebp - 4], 6
cmp byte [ebp - 0x30], 0
je 0x43b01f
cmp dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0
je 0x43b01f
push dword [ebp - 0x34]
call fcn.00456fb8
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.004578b6
add esp, 0x10
cmp eax, 1
jne 0x43b07c
test bl, bl
je 0x43b04d
test esi, esi
je 0x43b04d
push esi
call fcn.00456fb8
pop ecx
mov edi, dword [ebp - 0x44]
cmp byte [ebp - 0x40], 0
je 0x43b061
test edi, edi
je 0x43b061
push edi
call fcn.00456fb8
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004049c7
lea ecx, [ebp - 0xec]
call fcn.00402bf1
call fcn.00448d87
ret 4
push 0x132
lea ecx, [ebp - 0x54]
call fcn.0041241e
push 0x4a7094
lea eax, [ebp - 0x54]
push eax
call fcn.0044c197
int3
Function at 0x43c856
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x479fef
call fcn.00448da9
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
mov edx, 0x4959a0
mov ecx, eax
call fcn.0043f5e8
mov esi, eax
mov ecx, esi
call fcn.0043d9a5
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x100001
mov ecx, eax
call fcn.00425854
push esi
mov ebx, 0x100000
push ebx
push 1
push dword [ebp - 0x28]
call fcn.00457e9e
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x43c931
push esi
call fcn.0045c55d
pop ecx
test eax, eax
je 0x43c8d6
push 0x133
jmp 0x43c936
push esi
call fcn.0045c531
pop ecx
test eax, eax
jne 0x43c8e8
push 0x13b
jmp 0x43c936
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.0043c822
mov ecx, dword [ebp - 0x10]
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebx + ecx]
cmp ebx, eax
je 0x43c916
push ecx
push ebx
mov ecx, edi
call fcn.00404a3c
lea ecx, [ebp - 0x28]
call fcn.0040c03a
test esi, esi
je 0x43c929
push esi
call fcn.00456fb8
pop ecx
mov eax, edi
call fcn.00448d72
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.0041241e
push 0x4a7094
lea eax, [ebp - 0x38]
push eax
call fcn.0044c197
int3
Function at 0x43d7b4
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x80]
sub esp, 0x80
push 0xffffffffffffffff
push 0x47a2bc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4aa068]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ecx + 0x30], 0
je 0x43d939
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov dword [ebp - 4], eax
call fcn.0043d26d
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ebx, dword [ebp - 0x18]
sub eax, ebx
push 0x18
cdq
pop ecx
idiv ecx
imul esi, eax, 0x18
add esi, ebx
jmp 0x43d82a
push esi
lea ecx, [esi - 0x18]
call fcn.00403dc5
add esi, 0x18
cmp esi, edi
jne 0x43d81e
add edi, 0xffffffe8
mov ecx, edi
call fcn.004049c7
mov dword [ebp - 0x14], edi
cmp ebx, edi
je 0x43d914
and dword [ebp + 0x74], 0
lea ecx, [ebp + 0x64]
and dword [ebp + 0x78], 0
lea esi, [ebx + 0x18]
push ebx
call fcn.00404b39
mov byte [ebp - 4], 1
jmp 0x43d904
push esi
mov edx, 0x48faf4
lea ecx, [ebp + 0x18]
call fcn.00409fb1
pop ecx
mov byte [ebp - 4], 2
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x43d87d
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp + 0x64]
call fcn.00404ae0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 1
call fcn.004049c7
lea eax, [ebp + 0x64]
push eax
lea ecx, [ebp + 0x30]
call fcn.0043d15d
mov byte [ebp - 4], 3
lea ecx, [ebp]
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
push ecx
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.0045d57b
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x43d8ed
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.0045cb3b
pop ecx
cmp eax, 0xffffffff
jne 0x43d8ed
call fcn.00451d11
push 0x137
push 0x11
pop ecx
mov edx, dword [eax]
call fcn.0043c152
pop ecx
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 1
call fcn.00419e55
lea ecx, [ebp + 0x30]
call fcn.004049c7
add esi, 0x18
cmp esi, edi
jne 0x43d860
lea ecx, [ebp + 0x64]
call fcn.004049c7
lea ecx, [ebp - 0x18]
call fcn.004139b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.004484c4
sub ebp, 0xffffff80
leave
ret
push str.canonicalized_file_name_expected
lea ecx, [ebp - 0x18]
call fcn.00417fc1
push 0x4a70d0
lea eax, [ebp - 0x18]
push eax
call fcn.0044c197
int3
Function at 0x43fc90
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x47a79b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4aa068]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x43fd6a
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp]
call fcn.0041d1c7
mov esi, eax
mov dword [ebp - 4], ebx
mov ebx, str.OracleJavajava.settings.cfg
push ebx
call fcn.00451e46
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00426fc3
xor ecx, ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0x10]
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
lea ecx, [ebp + 0x18]
push eax
call fcn.0041d2a0
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.0043f3d0
lea ecx, [ebp + 0x18]
call fcn.00419e55
lea ecx, [ebp]
call fcn.00419e55
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.004484c4
add ebp, 0x23c
leave
ret
push 0xc8
lea ecx, [ebp - 0x20]
call fcn.0041241e
push 0x4a7094
lea eax, [ebp - 0x20]
push eax
call fcn.0044c197
int3

Function at 0x44278c
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, SysReAllocString
test edi, edi
jl 0x44280f
jg 0x4427b8
test esi, esi
je 0x44280f
test edi, edi
jg 0x4427b8
jl 0x4427b4
cmp esi, ebp
jae 0x4427b8
mov eax, esi
jmp 0x4427ba
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x442800
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4427ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x44280a
jmp 0x442800
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x4427fb
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x4427a0
cmp eax, 0xffffffff
jne 0x44280a
call fcn.00451d11
cmp dword [eax], 4
je 0x4427a0
or eax, 0xffffffff
jmp 0x442811
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret