joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a82c
Capabilities:
Encode data using xor

Disassembly:
push esi
or al, byte [ebx + 6]
rcr dword [ecx + 0x310609df], cl
in eax, dx
push ebp
push ss
mov byte [0xc2e5087b], al
xchg ebx, eax
or al, 9
mov ah, 0x78
adc al, 0x2a
jecxz 0x43a825
test byte [edi + edx*8 + 6], 0x62
sub dword [ecx + 0x1de8686f], ebp
sbb bl, byte [edx + ebx + 0x8660e5]
jae 0x43a7d4
pop ebp
adc byte [si], dl
out dx, eax
stosb byte es:[edi], al
dec esp
pop edx
outsd dx, dword [esi]
xor eax, 0x342a0bf8
push ecx
fnstenv [0xb12bfa35]
push ecx
ja 0x43a865
xchg ebp, esp
invalid
push 0x70
add byte [ebx - 0x7c86c28c], bh
push 0x26
xchg byte [eax], al
dec esi
daa
outsd dx, dword [esi]
cmp byte [esi + edi*2 + 0x7d], dh
sal dh, 1
mov ecx, 0x518a7073
jo 0x43a79c
push ecx
imul ecx, dword [edi - 0xc], 0xffffffb8
daa
mov cl, 0x9b
xor byte [eax + 0x302a2365], al
jg 0x43a810
in eax, dx
das
daa
aad 4
adc byte [0xf4746082], dl
je 0x43a822
je 0x43a822
das
or cl, byte [edi + edx*2 - 0x6b]
jae 0x43a86e
add dword [ebx], 0x92f3ea1
jbe 0x43a813
xor al, 0x28
je 0x43a7f9
rcr byte [0x32520a5], cl
cld
xor byte [edi + 0x75], al
aam 0x41
inc ecx
xor ebx, dword [0xb523f60d]
or dword [ecx], edx
adc dword [edi + 0x3b], esi
hlt
jo 0x43a89c
cmpsb byte [esi], byte es:[edi]
int1
cmp dword [eax - 0x4b], edx
loope 0x43a8b9
sub al, 0xd4
rol dword [ebx - 0x48], 0xd0
add eax, 0x2fad30b1
jae 0x43a89f
xor edx, dword gs:[ebp - 0x50]
test eax, 0x828776d0
pop ds
and dl, dh
jb 0x43a905
sti
fist dword [eax]
xor al, 0x26
invalid
into
sub eax, dword [ebp + 0x16]
push ss
xor dword [esi - 0x2f], edi
salc
jno 0x43a847
stosd dword es:[edi], eax
daa
cdq
cmp ah, byte [esi + 0x6b]
imul esp, dword fs:[edx + edx*2 + 0x32e4b1fd], 0xfffffff4
mov al, 0x8c
mov al, 0x40
inc eax
ror byte [ebx + 0x20], 1
xchg edi, eax
add byte [ebp + 0x46], al
inc ecx
push ebx
mov edi, dword [edx]
sti
mov bl, 0xb2
sub dword [ebp + 0x36], eax
xchg ebp, eax
and eax, 0xf447e477
invalid

Function at 0x444cc6
Capabilities:
Encode data using xor

Disassembly:
pop eax
sbb edx, edi
std
mov word [esi], ds
adc al, 0xf6
cdq
xor dword [ebp - 0x1a], esp
in eax, dx
push ebx
movsb byte es:[edi], byte [esi]
cmp bh, byte gs:[eax + ecx - 0x6a]
cwde
daa
invalid
Function at 0x4475ca
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.004689e8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447615
push 0x80004005
call fcn.0044639a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.004689e8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447645
push 0x80004005
call fcn.0044639a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004689e8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447672
push 0x80004005
call fcn.0044639a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
and byte [edx + 0x79], ch
Function at 0x45c4c4
Capabilities:
Encode data using xor

Disassembly:
rcr byte [edi + ebp - 0x7c42833b], 1
insd dword es:[edi], dx
salc
sub esi, dword [esi]
pop edx
invalid

Function at 0x472d96
Capabilities:
Encode data using xor

Disassembly:
mov bl, byte [edi - 0x4dcf040e]
dec esp
add esi, dword [eax]
push ds
xlatb
aas
mul byte [ebx + 0x38769d65]
ficomp word [edi - 0x652d8617]
lodsd eax, dword [esi]
xchg dword [ebx + 0x7a], ebx
jg 0x472de8
stosb byte es:[edi], al
cli
sahf
jl 0x472dd0
std
shr ebp, cl
lodsb al, byte [esi]
mov eax, 0xe313f88b
adc esp, ebx
xor esp, ebx
clc
xor dword [ecx], ebx
test dword [ebp - 0x3ab324ad], edx
jle 0x472dc1
mov al, 0xd3
xor eax, 0xf8cd5333
test dword [edi - 0x1de43956], eax
or eax, 0x52b21b05
cmp bh, byte ds:[edx]
cmc
mov dh, 0x5c
mov dh, 0x5e
invalid

Function at 0x4756aa
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call int.00496ac8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4756f5
push 0x80004005
call fcn.0047447a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call int.00496ac8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x475725
push 0x80004005
call fcn.0047447a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call int.00496ac8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x475752
push 0x80004005
call fcn.0047447a
invalid
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
Function at 0x47f68d
Capabilities:
Encode data using xor

Disassembly:
cld
dec edx
mov ah, 0xc2
mov esi, 0x3ca9ddd7
xchg edx, eax
xchg esi, eax
mov ebx, 0x8a840e8c
loop 0x47f6c1
add dword [ebx], ebx
insb byte es:[edi], dx
invalid
invalid

Function at 0x48406a
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edi + 0x1d], dh
popal
salc
in al, dx
pushfd
mov cl, 0x8f
clc
mov esp, 0xcacca3d7
and dword [esi - 0x48], edx
scasb al, byte es:[edi]
je 0x4840c8
aaa
dec edx
pop esp
mov ecx, dword [eax - 0x36b7f652]
neg byte [edx - 0x68]
or dword [esi + 0x75f9be54], ebp
mov dl, 0x46
mov al, byte [ecx - 0x69]
ljmp 0xca6c
arpl word [ecx], si
add byte [edx], al
loopne 0x48411b
push cs
sub eax, 0xd4ba7628
loop 0x48414a
invalid
jnp 0x4840d6
inc eax
pop esi
test dword [edx - 0x3bd87f61], 0xdace213e
sbb ecx, ecx
inc esi
test al, 0xd5
sal byte [eax - 2], 1
into
jecxz 0x484184
dec edx
mov al, 0x48
jmp 0x484137
shr dword [esi - 0x32], 0xbe
bt dword [ebp - 0xf], ebp
pushal
mov ah, 0x48
or eax, 0x6d090426
into
mov byte [0x4d565888], al
adc dh, byte [esi + 0x3c]
xor ebp, ebp
sbb eax, 0x15160098
loopne 0x4841e1
or byte [edx], cl
mov bh, 0x57
or byte [esi + 0x49], ah
out dx, eax
sbb dword [0xf188dc07], esp
out 0xc2, eax
sub ch, dh
lds ebx, [ebx - 0x20d723d6]
iretd
mov eax, dword [0xef810a2]
mov eax, dword [0x7a2d7140]
lds ebx, [eax + 0xf]
invalid

Function at 0x48cbda
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call int.004adff8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc25
push 0x80004005
call fcn.0048b9aa
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call int.004adff8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc55
push 0x80004005
call fcn.0048b9aa
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call int.004adff8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc82
push 0x80004005
call fcn.0048b9aa
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0048c3da
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0048c3da
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d61a
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call int.004adff8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d674
push 0x80004005
call fcn.0048b9aa
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call int.004adff8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d6a7
push 0x80004005
call fcn.0048b9aa
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x13c], edi
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0048d55a
mov eax, dword [ebp - 0x134]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jne 0x48d745
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d6f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d719
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x134]
call fcn.0048c9da
add esp, 8
push 5
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
call fcn.0048c5aa
mov eax, dword [eax]
push 0x54ef60
Function at 0x4a10d6
Capabilities:
Encode data using xor

Disassembly:
in al, dx
std
pop ecx
stosd dword es:[edi], eax
aam 0xb6
cmp dword [ebx], ecx
invalid

Function at 0x4a3e9a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c52b8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ee5
push 0x80004005
call fcn.004a2c6a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c52b8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f15
push 0x80004005
call fcn.004a2c6a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c52b8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3f42
push 0x80004005
call fcn.004a2c6a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a369a
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a369a
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [fcn.0054e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1198
Capabilities:
Encode data using xor

Disassembly:
sub byte [0xf39ec15], cl
pop ss
adc al, 0xd3
rcr byte [edx + 0x13], 0x1c
out dx, al
xchg edi, eax
lea edi, [ecx]
out 0xbd, eax
std
sbb ch, dh
dec eax
sbb esi, dword [edx - 0x621cd7c9]
or al, 0x1c
add bl, byte [ebx]
xor al, 0xc9
sbb eax, 0x9d9b4eac
push cs
push eax
dec ebp
arpl word [0x8d3f7d62], dx
jmp 0xa9d2530f
in al, 0x7a
pop ebp
pop ecx
and eax, 0xd685a5cf
arpl word [ebx], sp
jae 0x4b1161
dec ecx
popfd
fisub dword [edx - 0x44]
stc
lea ebp, [esi - 0xd]
leave
jae 0x4b1179
invalid
Function at 0x40107e
Capabilities:
Delete file
Manipulate console buffer
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0040dce0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
xor ebx, ebx
cmp dword [0x43a674], 0x594
push edi
mov dword [ebp - 0x14], ecx
jne 0x4010b6
push ebx
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x42b338]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42b33c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x38], 0x9e3779b9
call fcn.00401077
mov eax, dword [0x42b340]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x42b344]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x20
jmp 0x4010fb
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [ebp - 0x14]
shl eax, 4
cmp dword [0x43a674], 0xc
mov dword [ebp - 4], eax
jne 0x401156
push ebx
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push ebx
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor eax, eax
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosw word es:[edi], ax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x1044]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x43a674]
cmp eax, 0xfa9
jne 0x401172
mov dword [0x43a670], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401198
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x43a5c8], ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add eax, edx
shr edx, cl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [0x43a66c], 0xf4ea3dee
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add eax, esi
shr esi, cl
mov dword [ebp - 0x1c], eax
add esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x43a674], 0xb03
jne 0x401211
push str.yacey_jutesepage_vomebawaridamuzixobonawodewagim
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
xor dword [ebp - 4], esi
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
sub dword [ebp - 8], eax
dec dword [ebp - 0x24]
jne 0x4010f8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x40145c
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x423aa1
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
cmp dword [0x43a674], 0x400
push edi
jne 0x40151d
push 0xf
pop esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x44], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401bf0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401930
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004015e0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.0040193a
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401710
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401ab0
fstp st(0)
or dword [esp + 0x44], 0xffffffff
add esp, 8
cmp dword [esp + 0x2c], 0x10
jb 0x401511
push dword [esp + 0x18]
call fcn.00401960
pop ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
call esi
cmp edi, 0x206d51
jg 0x40153a
inc edi
cmp edi, 0x4eed4
jl 0x401525
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp esi, 0x2b257f
jg 0x401554
inc esi
cmp esi, 0x118bb
jl 0x40153c
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
cmp esi, 0x2afdec
jle 0x401574
cmp dword [esp + 0x10], 0x787c7e45
jne 0x40157d
inc esi
cmp esi, 0x42f7
jl 0x401556
mov eax, dword [0x42dc8c]
mov dword [0x43a674], eax
call fcn.0040124c
mov esi, 0x3078f
cmp dword [0x43a674], 0x51f
jne 0x4015a6
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
dec esi
jne 0x401591
mov ecx, dword [esp + 0x34]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403410
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a1c8]
jne 0x40341a
repz ret
jmp fcn.00407ffe
Function at 0x407c2b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040491b
and dword [ebp - 4], 0
cmp dword [0x42f62c], 0
mov ebx, eax
jne 0x407cdc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407d8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407d8d
push eax
call fcn.004048a9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42f62c], eax
call esi
push eax
call fcn.004048a9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42f630], eax
call esi
push eax
call fcn.004048a9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42f634], eax
call esi
push eax
call fcn.004048a9
pop ecx
mov dword [0x42f63c], eax
test eax, eax
je 0x407cdc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004048a9
pop ecx
mov dword [0x42f638], eax
mov eax, dword [0x42f638]
cmp eax, ebx
je 0x407d34
cmp dword [0x42f63c], ebx
je 0x407d34
push eax
call fcn.00404924
push dword [0x42f63c]
mov esi, eax
call fcn.00404924
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407d34
test edi, edi
je 0x407d34
call esi
test eax, eax
je 0x407d2b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407d2b
test byte [ebp - 0xc], 1
jne 0x407d34
or dword [ebp + 0x10], 0x200000
jmp 0x407d6d
mov eax, dword [0x42f630]
cmp eax, ebx
je 0x407d6d
push eax
call fcn.00404924
pop ecx
test eax, eax
je 0x407d6d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407d6d
mov eax, dword [0x42f634]
cmp eax, ebx
je 0x407d6d
push eax
call fcn.00404924
pop ecx
test eax, eax
je 0x407d6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f62c]
call fcn.00404924
pop ecx
test eax, eax
je 0x407d8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407d8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a3e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x20
mov eax, 0x525a9d
call fcn.004e27d2
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x403a5a
xor al, al
jmp 0x403b17
cmp dword [esi + 0x14], 0x10
jb 0x403a64
mov eax, dword [esi]
jmp 0x403a66
mov eax, esi
test eax, eax
je 0x403a84
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403a84
shr eax, 4
and al, 1
je 0x403a84
mov al, 1
jmp 0x403b17
or edi, 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x403a8f
mov esi, dword [esi]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push eax
push 0x555be4
push esi
mov dword [ebp - 0x2c], ebx
call fcn.004fe934
add esp, 0xc
jmp 0x403afe
push esi
call fcn.00402ce5
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040c6c1
mov esi, 0x555be4
push esi
call fcn.00402ce5
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040c6c1
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00503e47
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
call fcn.004fe934
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x403ab6
cmp edi, 0xffffffff
lea ecx, [ebp - 0x28]
push eax
push 1
setne bl
call fcn.0040c02b
mov al, bl
call fcn.004e277c
ret
Function at 0x40c927
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x526bd9
call fcn.004e27d2
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40ca27
cmp byte [ebx + 0x3d], 0
je 0x40ca27
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x40c961
xor al, al
jmp 0x40ca29
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0040c504
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40c9bf
sub eax, 1
je 0x40c9c3
dec eax
sub eax, 1
je 0x40ca15
xor bl, bl
jmp 0x40ca17
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x40c9fb
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005032e0
add esp, 0x10
cmp esi, eax
jne 0x40c9bb
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x40ca15
test esi, esi
jne 0x40c985
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040c661
jmp 0x40c97f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040c02b
mov al, bl
jmp 0x40ca29
mov al, 1
call fcn.004e277c
ret

Function at 0x41151d
Capabilities:
Create thread

Disassembly:
push 0x38
mov eax, 0x5270b7
call fcn.004e279e
mov esi, ecx
xor ebx, ebx
push ebx
push ebx
push esi
push 0x4113af
push ebx
push ebx
call fcn.004fe593
add esp, 0x18
test eax, eax
jne 0x4115bb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push ecx
push ecx
push str.int___thiscall_CThread::init_void_
push 0x4c
push str.F:JenkinsWorkSpaceworkspaceCommon_DownloaderBranchesInstallWithoutUninstall_srcCThread.h
push 0x80
lea ecx, [ebp - 0x44]
mov edi, eax
call fcn.004064f1
mov dword [ebp - 4], ebx
inc ebx
push str.default
push ebx
push eax
call fcn.00406584
mov esi, eax
add esp, 0xc
cmp byte [esi + 0x1c], 0
je 0x41159d
push str.__creat_thread_error_code_
lea ecx, [esi + 0x20]
call fcn.00406419
cmp byte [esi + 0x1c], 0
je 0x41159d
push edi
lea ecx, [esi + 0x20]
call fcn.00406388
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], vtable.el::base::Writer.0
call fcn.004067e3
lea ecx, [ebp - 0x18]
call fcn.00409846
xor eax, eax
jmp 0x4115c1
mov dword [esi + 4], eax
xor eax, eax
inc eax
call fcn.004e2767
ret