joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65012993
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
call fcn.65012993
add byte [edx], bh
cmp edi, dword [esi]
dec ebx
aaa
xor eax, dword [ebp + 0x3e]
xor al, 0x44
add esp, 4
call 0x650129a6
add byte [eax + 0x48], cl
xor bh, byte [esi]
xor al, 0x4b
dec ebp
xor cl, byte [ebp + 0x4f]
add esp, 4
sub edi, 0x610a
pop edi
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edx
sub edx, 0x1389b
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xa4b6
or ecx, 0x14d55
or ecx, 0x4780
add ecx, 0xfecb
pop ecx
push ecx
push edx
add esp, 4
sub ecx, 0xce5c
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
sub edx, 0xa6ab
sub edx, 0x782b
and edx, 0x45b1
pop edx
push eax
push ebx
add esp, 4
or eax, 0x6890
sub eax, 0x1681f
or eax, 0x6a8f
or eax, 0x132e9
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x65012ab2
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x65012b0c
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x650129da
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x650129da
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x65012af6
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x65012b00
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x65012b55
push ecx
add ecx, 0x137c0
add ecx, 0x15035
xor ecx, 0x1b00
xor ecx, 0x25f
pop ecx
push edx
push ebx
add esp, 4
xor edx, 0xc9d8
or edx, 0xd57c
xor edx, 0x1751d
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x65012bbd
push eax
and eax, 0x15c8a
call 0x65012b69
add byte [ebx], dh
cmp bh, byte [0x384a3d50]
add esp, 4
xor eax, 0xb546
jmp 0x65012b78
pop eax
push ebx
sub ebx, 0x1dc6
add ebx, 0x16ddf
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x65012bb3
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x6501297e
mov dword [ebp - 0x778], 0
Function at 0x650129a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
call fcn.65012993
add byte [edx], bh
cmp edi, dword [esi]
dec ebx
aaa
xor eax, dword [ebp + 0x3e]
xor al, 0x44
add esp, 4
call 0x650129a6
add byte [eax + 0x48], cl
xor bh, byte [esi]
xor al, 0x4b
dec ebp
xor cl, byte [ebp + 0x4f]
add esp, 4
sub edi, 0x610a
pop edi
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edx
sub edx, 0x1389b
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xa4b6
or ecx, 0x14d55
or ecx, 0x4780
add ecx, 0xfecb
pop ecx
push ecx
push edx
add esp, 4
sub ecx, 0xce5c
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
sub edx, 0xa6ab
sub edx, 0x782b
and edx, 0x45b1
pop edx
push eax
push ebx
add esp, 4
or eax, 0x6890
sub eax, 0x1681f
or eax, 0x6a8f
or eax, 0x132e9
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x65012ab2
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x65012b0c
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x650129da
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x650129da
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x65012af6
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x65012b00
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x65012b55
push ecx
add ecx, 0x137c0
add ecx, 0x15035
xor ecx, 0x1b00
xor ecx, 0x25f
pop ecx
push edx
push ebx
add esp, 4
xor edx, 0xc9d8
or edx, 0xd57c
xor edx, 0x1751d
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x65012bbd
push eax
and eax, 0x15c8a
call 0x65012b69
add byte [ebx], dh
cmp bh, byte [0x384a3d50]
add esp, 4
xor eax, 0xb546
jmp 0x65012b78
pop eax
push ebx
sub ebx, 0x1dc6
add ebx, 0x16ddf
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x65012bb3
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x6501297e
mov dword [ebp - 0x778], 0
Function at 0x65012b69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
call fcn.65012993
add byte [edx], bh
cmp edi, dword [esi]
dec ebx
aaa
xor eax, dword [ebp + 0x3e]
xor al, 0x44
add esp, 4
call 0x650129a6
add byte [eax + 0x48], cl
xor bh, byte [esi]
xor al, 0x4b
dec ebp
xor cl, byte [ebp + 0x4f]
add esp, 4
sub edi, 0x610a
pop edi
lea eax, [ebp - 0x17a0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edx
sub edx, 0x1389b
pop edx
push ecx
push edi
add esp, 4
add ecx, 0xa4b6
or ecx, 0x14d55
or ecx, 0x4780
add ecx, 0xfecb
pop ecx
push ecx
push edx
add esp, 4
sub ecx, 0xce5c
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
sub edx, 0xa6ab
sub edx, 0x782b
and edx, 0x45b1
pop edx
push eax
push ebx
add esp, 4
or eax, 0x6890
sub eax, 0x1681f
or eax, 0x6a8f
or eax, 0x132e9
pop eax
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x65012ab2
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x65012b0c
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x650129da
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x650129da
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x65012af6
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x65012b00
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x65012b55
push ecx
add ecx, 0x137c0
add ecx, 0x15035
xor ecx, 0x1b00
xor ecx, 0x25f
pop ecx
push edx
push ebx
add esp, 4
xor edx, 0xc9d8
or edx, 0xd57c
xor edx, 0x1751d
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x65012bbd
push eax
and eax, 0x15c8a
call 0x65012b69
add byte [ebx], dh
cmp bh, byte [0x384a3d50]
add esp, 4
xor eax, 0xb546
jmp 0x65012b78
pop eax
push ebx
sub ebx, 0x1dc6
add ebx, 0x16ddf
pop ebx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x65012bb3
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x6501297e
mov dword [ebp - 0x778], 0
Function at 0x406607
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4946a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [ebp - 0x118]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
call fcn.00406583
mov ebx, eax
cmp ebx, esi
je 0x406673
cmp dword [ebp - 0x118], esi
je 0x40666c
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40670b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40669b
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x118]
call fcn.00406607
mov dword [ebp - 0x124], eax
cmp eax, esi
jne 0x40671c
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x118]
mov dword [ebp - 0x11c], pe_nt_image_headers32
call ebx
test eax, eax
je 0x40667b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x118], esi
je 0x4066e6
push dword [ebp - 0x118]
call ebx
mov dword [ebp - 0x118], esi
push dword [ebp - 0x120]
mov dword [ebp - 0x114], esi
call fcn.004064a8
mov edi, eax
cmp dword [ebp - 0x118], esi
je 0x406709
push dword [ebp - 0x118]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448f27
leave
ret 4
cmp dword [ebp - 0x118], esi
je 0x406730
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
jmp 0x40670b
Function at 0x4090a6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x854
mov eax, dword [0x4946a0]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x7ff
lea eax, [esp + 0x5d]
push 0
mov esi, 0x80004005
push eax
mov dword [esp + 0x1c], esi
mov byte [esp + 0x64], 0
call fcn.0044afd0
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.004017ec
mov eax, dword [esp + 0x1c]
pop ecx
test eax, eax
jne 0x409102
mov eax, esi
jmp 0x40919e
lea edx, [eax + 8]
lea ecx, [esp + 0x24]
call fcn.00425d25
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
imul edi, edi, 0xa
mov dword [esp + 0x14], eax
lea eax, [esp + 0x58]
push eax
push 0x800
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x40917d
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0x4782fc
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x40917d
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + 0xa]
cmp ecx, esi
jg 0x409178
jne 0x40917d
movzx ecx, word [eax + 8]
cmp ecx, dword [esp + 0x14]
jg 0x409178
jne 0x40917d
movzx eax, word [eax + 0xe]
cmp eax, edi
jl 0x40917d
and dword [esp + 0x10], 0
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.00403182
mov esi, dword [esp + 0x18]
call fcn.0040395b
push esi
call fcn.00448f1c
mov eax, dword [esp + 0x14]
pop ecx
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00448f27
mov esp, ebp
pop ebp
ret 8

Function at 0x40a497
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
xor edi, edi
push 0x3c
lea eax, [ebp - 0x40]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0044afd0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [0x499234], 2
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x140
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], str.runas
jge 0x40a4e6
mov dword [ebp - 0x34], str.open
push 6
push edi
mov dword [ebp - 0x24], 1
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40a538
cmp dword [ebp + 0x10], edi
je 0x40a52a
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x669
jne 0x40a52d
mov dword [ebp - 4], edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a541
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x41650d
Capabilities:
Encode data using xor

Disassembly:
mov byte [eax + 0x3e9a153a], ch
mov eax, 0x5154bace
xchg ebx, eax
mov ecx, 0x15663aab
or cl, byte [eax + 0x73171406]
add esp, ebx
push ebp
pop edi
pop ebx
mov dl, 0x57
test eax, 0x650d12c0
xor eax, 0xffe6ddcf
sahf
mov ch, 0xe2
cmp al, 0x89
test al, 0xb
out dx, al
mov word [edx - 0x2230ca7c], es
out 0xff, al
sahf
mov ch, 0xd2
cmp al, 0x89
test al, 0xb
out dx, al
lea edx, [ecx + edx*8 - 0x46]
adc eax, 0x36b97817
xchg ebx, eax
pop esp
xor dl, ch
shl esi, 1
neg dword [edx + 0x15c36c92]
pop ss
js 0x41651e
xchg ebx, eax
je 0x41659b
aad 0xd6
out 0xf7, al
lcall 0x7817, 0x15bb6c92
mov ecx, 0x328c9336
aad 0xd3
adc al, 0xd3
dec ebx
mov dh, 0x8b
xor al, 0xcf
fisttp qword [ebx]
out dx, al
xchg ecx, eax
push edi
test eax, 0x8c0d1209
xor al, 0xcf
retf
cmp esp, dword [esi + 0x12]
or eax, 0x54aa5b8e
test eax, 0x602715c2
xchg edx, eax
lahf
pop edi
cmp esp, dword [esi + 0x12]
or eax, 0xe5d73567
out 0xef, al
xlatb
in eax, 0xe6
out dx, eax
cmpsb byte [esi], byte es:[edi]
mov eax, 0x55a26c2f
cmpsd dword [esi], dword es:[edi]
mov dh, 0x15
call [ebx + 0x6b]
jb 0x4165a9
out 0xef, al
cmpsb byte [esi], byte es:[edi]
mov eax, 0x559a6c2f
cmpsd dword [esi], dword es:[edi]
mov bh, 0x15
call [ebx + 0x6b]
jb 0x4165b1
out 0xef, al
cmpsb byte [esi], byte es:[edi]
mov eax, 0x55926c2f
cmpsd dword [esi], dword es:[edi]
mov eax, 0x9324f63b
xchg edx, eax
push edi
test eax, 0x8b0d12c2
xor al, 0xcf
invalid
Function at 0x424259
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x468a9c
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4946a0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x4946a0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x4242fd
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.Destination_buffer_cant_be_NULL
call fcn.0044937c
mov dword [esp + 0x20], vtable.std::invalid_argument.0
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.d:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u73_6086_install_src_common_share_tstrings.cpp
mov dword [esp + 0x1c], str.tstrings::format
mov dword [esp + 0x20], 0x1b
call fcn.00424b7f
lea eax, [esp + 0x4c]
mov dword [esp], 0x485480
push eax
call fcn.00450b59
push 0xf
pop esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x80], 1
mov eax, dword [esp + 0x3c]
add eax, 0x100
lea ecx, [esp + 0x2c]
call fcn.0041937b
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
jae 0x424338
lea eax, [esp + 0x2c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esp + 0x48]
push eax
call fcn.0044e8eb
add esp, 0x14
cmp eax, 0xffffffff
je 0x424317
lea ecx, [esp + 0x2c]
call fcn.0041937b
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
lea esi, [esp + 0x2c]
mov byte [edi], bl
call fcn.0040309f
push ebx
push 1
mov ecx, esi
call fcn.00403182
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00448f27
mov esp, ebp
pop ebp
ret
Function at 0x42b59e
Capabilities:
Check http status code
Check internet connectivity via wininet

Disassembly:
push 0xfc
mov eax, 0x46d276
call fcn.00451028
xor ebx, ebx
push ebx
lea eax, [ebp - 0xe8]
push eax
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x42b5ce
mov al, 1
jmp 0x42b671
test byte [ebp - 0xe8], 0x40
jne 0x42b5c7
push str.http:__java.sun.com
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0xe1], bl
mov dword [ebp - 4], ebx
call fcn.00402559
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 1
call fcn.00429b20
push ebx
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x108]
mov dword [eax + 0x20], 2
mov word [eax + 0x1c], 1
call fcn.00429bad
push eax
push 0x13
pop ecx
mov byte [ebp - 4], 3
call fcn.0042a7a2
mov esi, eax
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 2
call fcn.00409e54
lea edi, [ebp - 0xe0]
call fcn.00429b68
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.00403182
cmp esi, 0xc8
je 0x42b664
cmp esi, 0x197
jne 0x42b66b
mov byte [ebp - 0xe1], 1
mov al, byte [ebp - 0xe1]
call fcn.00451084
ret

Function at 0x42c31b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0044afd0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
sete al
leave
ret

Function at 0x42c77f
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x4669cf
call fcn.00450ff2
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.0042b863
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x42c7db
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.0042b863
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402559
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00430209
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403182
test esi, esi
je 0x42c80a
push esi
call fcn.00448f1c
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.00451075
ret
Function at 0x42c8b8
Capabilities:
Get common file path

Disassembly:
push 0x20c
mov eax, 0x46b9e1
call fcn.00450ff2
xor esi, esi
push 0x104
lea eax, [ebp - 0x118]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x170], esi
call fcn.0044afd0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push esi
push esi
push 0x8023
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov ebx, eax
cmp ebx, esi
je 0x42c9e6
lea eax, [ebp - 0x218]
push eax
call fcn.004027db
lea eax, [ebp - 0x218]
push str.SHGetFolderPath_0x
push eax
mov dword [ebp - 4], esi
call fcn.004055e5
mov eax, dword [ebp - 0x218]
mov eax, dword [eax + 4]
pop ecx
lea eax, [ebp + eax - 0x218]
pop ecx
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
push 0x23
lea eax, [ebp - 0x218]
push eax
call fcn.0041b0e4
lea eax, [ebp - 0x218]
push str.__mode
push eax
call fcn.004055e5
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x218]
push eax
call fcn.0041b0e4
lea eax, [ebp - 0x218]
push 0x47b794
push eax
call fcn.004055e5
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
lea edi, [ebp - 0x180]
call fcn.00431ea9
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 1
push ecx
lea esi, [ebp - 0x16c]
mov ecx, eax
mov dword [ebp - 0x16c], str.d:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u73_6086_install_src_windows_common_SysInfo.cpp
mov dword [ebp - 0x168], str.SysInfo::SHGetFolderPathAdapter
mov dword [ebp - 0x164], 0x179
call fcn.0042ce0a
lea eax, [ebp - 0x160]
mov dword [esp], 0x485754
push eax
call fcn.00450b59
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x134]
call fcn.00402559
lea edx, [ebp - 0x134]
mov eax, edi
mov dword [ebp - 4], 2
call fcn.00430209
push esi
push 1
lea ecx, [ebp - 0x134]
call fcn.00403182
mov eax, edi
call fcn.00451075
ret
Function at 0x42cffb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x46b937
call fcn.00450ff2
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.0042cfdd
mov edi, eax
test edi, edi
jne 0x42d0b3
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00402559
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.0042cf28
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.00421f92
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.00434676
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.d:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u73_6086_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.0041be8a
lea eax, [ebp - 0x58]
mov dword [esp], 0x485424
push eax
call fcn.00450b59
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x42d137
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00402559
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0042cf28
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.00421f92
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.00434676
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.d:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u73_6086_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x42d092
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x42d167
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x42d158
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x42d14e
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x42d176
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.00451075
ret 4

Function at 0x42f35a
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x465ee8
call fcn.00450f89
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.0042f32e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0042f32e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0042f32e
mov eax, esi
mov dword [esp], 0x409
call fcn.0042f32e
pop ecx
mov eax, esi
call fcn.00451061
ret