joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54c9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp edx, eax
je 0x54cb4c
cmp dword [edx + 0x1c], 0x10
lea ecx, [ebx + 4]
mov eax, dword [ecx]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], ecx
jb 0x54ca13
mov edi, dword [edi]
xor edx, edx
mov ebx, 0x811c9dc5
test eax, eax
je 0x54ca34
mov ecx, eax
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x54ca20
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, ebx
lea eax, [edx + eax*8]
mov edx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.00529200
push 0x40
push edi
call fcn.00503df0
mov ecx, dword [ebp - 4]
add esp, 0x10
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x54ca9f
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x54ca50
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x54cb42
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x54cab1
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x54cab4
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x54cb42
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x54cad0
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x54caf1
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x54cae0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
nop dword [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.00529200
push 0x40
push edi
call fcn.00503df0
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp + 0xc]
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x54cb53
cmp esi, eax
jne 0x54cb10
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x54cac2
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x54df50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x54df6c
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x54df88
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x54df77
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push edx
push eax
mov ecx, ebx
call fcn.004a9a60
mov esi, dword [eax + 4]
test esi, esi
je 0x54dffa
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x54dfc7
cmp eax, esi
jne 0x54dfbf
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x54dfcf
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x54dfcf
cmp eax, esi
jne 0x54dfcf
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [esi + 4]
push esi
push edx
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.00526900
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x55e290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 0x10]
shr ecx, 4
inc ecx
movzx ebx, cx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x55e2ce
push 0x409
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_load_message_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x1e
push eax
call fcn.0055e260
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 4]
mov edi, eax
push ebx
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x21
push ecx
call fcn.0055e260
mov edx, ebx
add esp, 0x18
and edx, 0xf
xor eax, eax
nop dword [eax]
movzx ecx, word [edi]
add edi, 2
test cx, cx
je 0x55e332
cmp eax, edx
je 0x55e374
lea edi, [edi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x55e320
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_find_message_resource__u
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x36
push eax
call fcn.0049fd30
mov eax, dword [ebp + 8]
add esp, 0x18
xor ecx, ecx
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
push ecx
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0047e880
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x55e3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [ebp + 0xc]
mov edi, eax
push 0xa
movzx ecx, bx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [ebp + 4]
mov esi, eax
push ebx
push str.failed_to_find_RCDATA_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x3e
push ecx
call fcn.0055e260
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 0xc]
mov ebx, eax
test ebx, ebx
push str.failed_to_get_size_of_resource__u
sete cl
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x41
push ecx
call fcn.0049fd30
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 4]
mov edi, eax
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x43
push ecx
call fcn.0055e260
mov esi, dword [ebp + 8]
add esp, 0x18
mov ecx, esi
push ebx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push edi
mov byte [esi], 0
call fcn.0047e790
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x55e470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
mov edi, eax
shr ecx, 4
inc ecx
push 0x409
movzx ebx, cx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x55e4b0
push 0x409
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_load_message_resource__u
push esi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x1e
push eax
call fcn.0055e260
add esp, 0x18
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 4]
mov edi, eax
push ebx
push str.failed_to_lock_resource__u
push edi
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x21
push ecx
call fcn.0055e260
mov edx, ebx
add esp, 0x18
and edx, 0xf
xor eax, eax
nop
movzx ecx, word [edi]
add edi, 2
test cx, cx
je 0x55e512
cmp eax, edx
je 0x55e554
lea edi, [edi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x55e500
mov eax, dword [ebp + 4]
push ebx
push str.failed_to_find_message_resource__u
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcLocalizedText.cpp
push 0x36
push eax
call fcn.0049fd30
mov eax, dword [ebp + 8]
add esp, 0x18
xor ecx, ecx
pop edi
pop esi
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
push ecx
push edi
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0047e880
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x55e870
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x55e984
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push dword [ebp - 8]
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x55e8cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x55e984
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x55e984
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 8]
call edi
test eax, eax
jne 0x55e903
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x55e986
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x500
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x55e967
xor edi, edi
cmp dword [esi], edi
jbe 0x55e967
lea ebx, [esi + 4]
nop word [eax + eax]
push dword [ebx]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x55e980
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x55e950
xor bl, bl
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x55e977
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x55e986
mov bl, 1
jmp 0x55e969
xor bl, bl
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x55e999
cmp ecx, 0xffffffff
je 0x55e999
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55f950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x55f96b
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x55f9b0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x55f9b0
cmp dword [ebp + 8], ebx
jne 0x55f9b0
mov bl, 1
jmp 0x55f9dd
cmp dword [edi + 0x14], 8
jb 0x55f9b8
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_append_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xd7
push eax
call fcn.0055d5a0
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x55f9e8
test esi, esi
je 0x55f9e8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x55fb40
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.00560a50
add esp, 4
test al, al
jne 0x55fb57
pop esi
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x55fb61
mov eax, dword [esi]
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x55fb70
mov ecx, dword [edi]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
cmp dword [esi + 0x14], 8
jb 0x55fb87
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x55fb8f
mov edi, dword [edi]
push esi
push edi
mov cl, bl
xor cl, 1
push str.Failed_to_copy__s_to__s
movzx ecx, cl
push ecx
mov ecx, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xa0
push ecx
call fcn.0055d5a0
add esp, 0x1c
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x55fea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x55febb
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x55fed7
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, 0xffffffff
jne 0x55ff1c
cmp dword [esi + 0x14], 8
jb 0x55fee4
mov esi, dword [esi]
call edi
cmp eax, 2
je 0x55fef6
call edi
cmp eax, 3
je 0x55fef6
mov al, 1
jmp 0x55fef8
xor al, al
push esi
push str.failed_to_get_attributes_of_file__s
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x84
push eax
call fcn.0055d5a0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
test ebx, 0x450
pop esi
sete al
pop ebx
pop ebp
ret

Function at 0x55ff30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x55ff4b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x55ff67
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp ebx, 0xffffffff
jne 0x55ffac
cmp dword [esi + 0x14], 8
jb 0x55ff74
mov esi, dword [esi]
call edi
cmp eax, 2
je 0x55ff86
call edi
cmp eax, 3
je 0x55ff86
mov al, 1
jmp 0x55ff88
xor al, al
push esi
push str.failed_to_get_attributes_of_folder__s
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x94
push eax
call fcn.0055d5a0
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
shr ebx, 4
pop edi
and bl, 1
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x55ffc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x55ffdb
mov eax, dword [edi]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x560023
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x560023
cmp dword [ebp + 8], ebx
jne 0x560023
mov bl, 1
jmp 0x560050
cmp dword [edi + 0x14], 8
jb 0x56002b
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_overwrite_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xea
push eax
call fcn.0055d5a0
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x56005b
test esi, esi
je 0x56005b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x560070
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73ac5d
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x5600a3
mov eax, dword [edi]
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x560189
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x560118
cmp dword [edi + 0x14], 8
jb 0x5600f0
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_get_file_size_of__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xfd
push eax
call fcn.0055d5a0
mov esi, dword [ebp - 0x10]
add esp, 0x18
xor bl, bl
jmp 0x5601b9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x1c]
mov dword [eax], ebx
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [ebp + 8], edx
sub edx, eax
cmp ebx, edx
jb 0x560161
jbe 0x560166
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
cmp ebx, eax
jbe 0x56014b
lea eax, [ebp + 0xb]
push eax
push ebx
call fcn.004934c0
mov ecx, dword [ebp + 0xc]
jmp 0x560166
sub ebx, edx
push ebx
push 0
push dword [ebp + 8]
call fcn.006f4b50
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
add eax, ebx
mov dword [ecx + 4], eax
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebx]
push dword [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x560189
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebx]
jne 0x560189
mov bl, 1
jmp 0x5601b9
cmp dword [edi + 0x14], 8
jb 0x560191
mov edi, dword [edi]
mov eax, dword [ebp + 4]
push edi
push str.Fail_to_read_file__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0x106
push eax
call fcn.0055d5a0
mov esi, dword [ebp - 0x10]
add esp, 0x18
xor bl, bl
cmp esi, 0xffffffff
je 0x5601c4
test esi, esi
je 0x5601c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x560a50
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x560a69
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x560ab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x560ab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x560ab5
cmp dword [esi + 0x14], 8
jb 0x560a92
mov esi, dword [esi]
mov eax, dword [ebp + 4]
push esi
push str.Failed_to_remove__s
push 1
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcFileSysUtil.cpp
push 0xbc
push eax
call fcn.0055d5a0
add esp, 0x18
xor al, al
pop esi
pop ebp
ret
mov al, 1
pop esi
pop ebp
ret

Function at 0x560b50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73acf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
jmp dword [eax*4 + 0x560c70]
Function at 0x561de0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x14], 8
mov eax, ecx
mov dword [ebp - 4], 0
jb 0x561df5
mov eax, dword [ecx]
push esi
lea edx, [ebp - 4]
push edx
push dword [ecx + 0x18]
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x561e26
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x561e1a
mov eax, dword [eax]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x561e34
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x561e40
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x561e59
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [esi + 0x18]
lea edi, [esi + 0x1c]
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x561e77
cmp eax, 2
jne 0x561eaf
test eax, eax
mov eax, dword [ebp - 4]
push ebx
sete bl
test eax, eax
je 0x561e8b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x561e98
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x561ea0
mov esi, dword [esi]
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientWinUtil_srcRegistryKey.cpp
push 0x63
push eax
call fcn.00470ea0
int3
Function at 0x561ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73ae1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x7887d0
push ebx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push esi
push edi
mov dword [ebp - 0x58], 0x5621d0
mov dword [ebp - 0x34], 0x7887b4
mov dword [ebp - 0x30], 0x5621c0
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov esi, 1
test eax, eax
cmovne esi, eax
cmp dword [ecx + 0x14], 8
mov eax, ecx
mov byte [ebp - 4], 2
mov dword [ebp + 0x10], 0
jb 0x561f2f
mov eax, dword [ecx]
lea edx, [ebp + 0x10]
push edx
push dword [ecx + 0x18]
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x561f96
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x561f56
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x561f75
mov edx, dword [ecx]
lea eax, [ebp - 0x34]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x56201c
mov edx, dword [ecx]
lea eax, [ebp - 0x5c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x56201c
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x562031
mov eax, dword [ecx]
mov edi, dword [ebp + 0xc]
push edi
call dword [eax + 8]
mov ecx, dword [ebp - 0x38]
mov ebx, eax
test ecx, ecx
je 0x562031
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x561fc6
mov eax, dword [eax]
push ecx
push ebx
push esi
push 0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x561fe5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x562004
mov edx, dword [ecx]
lea eax, [ebp - 0x34]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x56201c
mov esi, dword [ecx]
lea eax, [ebp - 0x5c]
cmp ecx, eax
setne al
movzx edx, al
push edx
call dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.006ddadd
int3