joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40605a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
cmp word [eax], di
je 0x406076
add esi, 2
cmp word [esi], di
jne 0x40606e
push 0x5c
pop ecx
jmp 0x406082
cmp esi, eax
jbe 0x406089
sub esi, 2
cmp word [esi], cx
jne 0x40607b
cmp esi, eax
jne 0x40609d
push str.getDirPathOfFile_invalid_input_n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
xor eax, eax
jmp 0x406125
sub esi, eax
sar esi, 1
push ebx
lea eax, [esi*2 + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x4060c2
call fcn.00406ad2
mov ebx, eax
test ebx, ebx
je 0x40611e
lea eax, [esi + 1]
mov ecx, 0x80070057
test eax, eax
je 0x4060d5
cmp eax, 0x7fffffff
jbe 0x4060d7
mov edi, ecx
test edi, edi
js 0x4060fe
cmp esi, 0x7ffffffe
jbe 0x4060ec
xor eax, eax
mov edi, ecx
mov word [ebx], ax
jmp 0x40610b
push esi
push dword [ebp - 4]
mov edx, eax
push ecx
mov ecx, ebx
call fcn.004057b2
mov edi, eax
jmp 0x406107
test eax, eax
je 0x406107
xor eax, eax
mov word [ebx], ax
test edi, edi
jns 0x406122
mov edx, edi
mov ecx, str.StringCchCopyN
call fcn.00405a71
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor eax, eax
jmp 0x406124
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40612b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov edx, ecx
push esi
push edi
mov ecx, eax
mov dword [ebp - 0x26c], eax
call fcn.0040592b
mov esi, eax
test esi, esi
jne 0x40615c
or eax, 0xffffffff
jmp 0x4061d7
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp edi, 0xffffffff
jne 0x406187
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
jmp 0x4061d7
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x18], str.Found_suspicious_file__
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x26c]
push 5
pop edx
mov dword [ebp - 0x10], str.__in_directory__
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x4a4284
call fcn.004057f7
mov esi, eax
test esi, esi
je 0x4061cd
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret
Function at 0x4061e7
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push 0x20c
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x406211
call fcn.00406ad2
mov esi, eax
test esi, esi
je 0x406319
push edi
push esi
mov edi, 0x106
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x406227
cmp eax, edi
jbe 0x406242
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
mov ecx, str.GetTempPath
call fcn.00405a71
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor esi, esi
test esi, esi
je 0x406318
xor edi, edi
jmp 0x406256
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x40624e
push 0x12
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x406285
call fcn.00406ad2
mov edi, eax
test edi, edi
je 0x406311
push edi
push 4
pop edx
lea ecx, [ebp - 4]
call fcn.004059fc
pop ecx
test eax, eax
je 0x4062ab
mov edx, eax
mov ecx, str.binaryToHexStringW
call fcn.00405a71
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor edi, edi
test edi, edi
je 0x406311
mov edx, edi
mov ecx, esi
call fcn.0040592b
mov ebx, eax
test ebx, ebx
je 0x406311
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push str.CreateDirectory..._n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x406311
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, dword [ebp - 8]
cmp eax, 0xb7
je 0x406256
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
mov ecx, str.CreateDirectory
call fcn.00405a71
jmp 0x406256
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406321
Capabilities:
Accept command line arguments
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x40
mov dword [ebp - 0x18], eax
xor edi, edi
lea eax, [ebp - 0x70]
mov dword [ebp - 0x20], edx
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0x14], ebx
call fcn.0046e6d0
add esp, 0xc
mov dword [ebp - 0x74], 0x44
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
xorps xmm0, xmm0
mov dword [ebp - 0x10], str.CreateProcessW:
push 3
pop edx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
movdqu xmmword [ebp - 0x30], xmm0
mov dword [ebp - 8], 0x4a3d78
call fcn.004057f7
mov esi, eax
test esi, esi
je 0x40639c
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
call fcn.00405fd9
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4063f1
push 3
pop edx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], str.___initialPath
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x4a408c
call fcn.004057f7
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push 2
pop edx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call fcn.004057f7
push dword [ebp - 0x1c]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x4063f9
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x20]
push edi
push edi
push edi
push edi
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x14], eax
cmp eax, 1
je 0x406425
call esi
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x14], 0
jne 0x406442
mov edx, edi
mov ecx, str.CreateProcess
call fcn.00405a71
xor al, al
jmp 0x40649c
push dword [ebp - 0x2c]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push 0xffffffffffffffff
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x406470
call esi
mov edx, eax
mov ecx, 0x4a4334
call fcn.00405a71
mov ebx, dword [ebp - 0x18]
jmp 0x40648f
mov ebx, dword [ebp - 0x18]
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
jne 0x406495
call esi
mov edx, eax
mov ecx, 0x4a435c
call fcn.00405a71
mov dword [ebx], 0x103
push dword [ebp - 0x30]
call edi
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret
Function at 0x4064ad
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4064df
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x4064e1
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc edi
cmp edi, 0xa
jl 0x4064b4
jmp 0x4064e5
xor esi, esi
test esi, esi
je 0x4064f5
mov edx, esi
mov ecx, str.DeleteFile
call fcn.00405a71
xor al, al
jmp 0x4064f7
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x406584
Capabilities:
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push str.preLoadDllsFromSystem___n
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
xor esi, esi
push esi
push esi
call ebx
mov edi, eax
test edi, edi
je 0x406686
add edi, 0x202
lea eax, [edi + edi]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4065da
call fcn.00406ad2
mov esi, eax
test esi, esi
je 0x406686
push edi
push esi
call ebx
test eax, eax
je 0x40667f
push 0x5c
lea ebx, [esi + eax*2]
pop ecx
cmp word [ebx], cx
je 0x4065fd
inc eax
mov word [ebx], cx
xor ecx, ecx
lea ebx, [esi + eax*2]
mov word [ebx], cx
sub edi, eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 8], eax
jbe 0x40667f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 1
jl 0x406673
inc eax
cmp eax, edi
ja 0x406673
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
push 0x4a3d78
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
test eax, eax
jne 0x406673
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7e
jne 0x406667
push str._Not_found__n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
jmp 0x406673
mov edx, eax
mov ecx, 0x4a44e4
call fcn.00405a71
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 8]
jb 0x406609
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4067a1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0x20
push eax
movzx ebx, dx
mov esi, ecx
push 0x59
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x40681c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
push 0x3dc
push str.c:jenkinsworkspacePlatformServicesLauncherGoToOpenerAppGoToOpenerApp_BuildReleaseCDownloaderAppWin32CodeLibMainUtils.cpp
push eax
lea eax, [ebp - 0x58]
push str.GetLocaleInfo
push eax
call fcn.00436b55
add esp, 0xc
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00406ae7
add esp, 0x14
mov ecx, esi
push eax
call fcn.0043641b
lea ecx, [ebp - 0x6c]
call fcn.0043645f
lea ecx, [ebp - 0x58]
call fcn.0043645f
jmp 0x406887
push 0xffffffffffffffff
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0043a421
lea ecx, [ebp - 0x58]
call fcn.0043645f
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jle 0x40687b
push 0xffffffffffffffff
push 0x4a4688
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
call fcn.0043a192
lea ecx, [ebp - 0x58]
call fcn.0043645f
push 0xffffffffffffffff
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0043a192
lea ecx, [ebp - 0x58]
call fcn.0043645f
push 0x4a46ac
mov ecx, esi
call fcn.004363fb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret
Function at 0x409d4d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0042e3d3
mov eax, dword [ebp + 8]
lea ecx, [edi + 0xfc]
xor ebx, ebx
mov dword [edi], 0x4a7f20
mov dword [edi + 0xec], ebx
mov dword [edi + 0xf0], eax
mov dword [edi + 0xf4], 0x7d7
mov word [edi + 0xf8], bx
call fcn.00438b2f
lea ecx, [edi + 0x110]
call fcn.00438b2f
mov dword [edi + 0x124], ebx
lea ecx, [edi + 0x13c]
push ebx
mov dword [edi + 0x128], ebx
push ebx
mov dword [edi + 0x12c], ebx
mov dword [edi + 0x130], ebx
push ebx
mov dword [edi + 0x134], ebx
push str.DownloaderApp_inetUiSerMutex
mov dword [edi + 0x138], ebx
call fcn.0043bede
lea ecx, [edi + 0x170]
mov word [edi + 0x16c], bx
call fcn.00438b2f
lea ecx, [edi + 0x184]
call fcn.00438b2f
mov dword [edi + 0x198], ebx
lea esi, [edi + 0x1ac]
mov dword [edi + 0x19c], ebx
mov ecx, esi
push 3
mov dword [edi + 0x1a0], ebx
push 0x4a7edc
mov dword [edi + 0x1a4], ebx
mov byte [edi + 0x1a8], bl
call fcn.00442353
mov dword [esi], 0x4a7f00
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov esi, eax
push esi
push str.command_line:__s
push ebx
push ebx
push ebx
call fcn.00404c99
add esp, 0x14
lea ecx, [ebp - 0x18]
push esi
call fcn.00438ae2
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [edi + 4], eax
lea ecx, [edi + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.00438e03
push 0x1c
call fcn.0046b2bc
mov esi, eax
pop ecx
test esi, esi
je 0x409e8b
call fcn.00490101
lea ecx, [esi + 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
call fcn.00438b2f
jmp 0x409e8d
mov esi, ebx
mov dword [edi + 0x2c], esi
lea ecx, [ebp - 0x2c]
test esi, esi
jne 0x409e9e
push 0x4a49f0
jmp 0x409ea3
push 0x4a46ac
call fcn.004363fb
lea ecx, [ebp - 0x2c]
call fcn.0043645f
lea ecx, [ebp - 0x18]
call fcn.00438dea
mov dword [edi + 0x254], edi
call fcn.0043152e
mov ecx, edi
call fcn.004130b5
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret 4
Function at 0x40c8e1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x3c
push 0
push esi
mov edi, edx
call fcn.0046e6d0
add esp, 0xc
mov dword [esi], 0x3c
xor edx, edx
xor ecx, ecx
inc ecx
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov eax, 0xffff
push esi
mov dword [esi + 0x14], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x38], ecx
mov ecx, edi
push edx
mov dword [esi + 0x10], edx
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x24], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x34], edx
call fcn.0043b147
push eax
mov ecx, edi
call fcn.0043fdec
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x40c99f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
push 0x30f
push str.c:jenkinsworkspacePlatformServicesLauncherGoToOpenerAppGoToOpenerApp_BuildReleaseCDownloaderAppWin32CodeLibDownloaderApp.cpp
push eax
lea eax, [ebp - 0x28]
push str.InternetCrackUrl
push eax
call fcn.00436b55
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406ae7
add esp, 0x14
mov ecx, ebx
push eax
call fcn.0043641b
lea ecx, [ebp - 0x14]
call fcn.0043645f
lea ecx, [ebp - 0x28]
call fcn.0043645f
jmp 0x40c9ab
push 0x4a46ac
mov ecx, ebx
call fcn.004363fb
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416e13
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x4c1280]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x38]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add eax, 0xe4
push eax
call fcn.00438559
lea ecx, [esp + 0x44]
call fcn.0043af83
cmp eax, 0x3e8
je 0x416ebe
push 0x175
push str.c:jenkinsworkspacePlatformServicesLauncherGoToOpenerAppGoToOpenerApp_BuildReleaseCDownloaderAppWin32CodeLibEndpointToolsCollabEndpointTools.cpp
xor esi, esi
lea eax, [esp + 0x28]
push esi
push eax
call fcn.0042c09a
add esp, 0x10
mov ecx, eax
call fcn.0043fdec
push eax
push str.ECStatus::eNo__dir.isEmpty__
push str.Parameter_check___s__failed_at__s.
lea eax, [esp + 0x18]
push 0x4a4f10
push eax
call fcn.00436355
add esp, 0x14
lea ecx, [esp + 0x20]
call fcn.0044156c
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0043678d
pop ecx
pop ecx
push esi
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0043641b
lea ecx, [esp + 0xc]
call fcn.0043645f
jmp 0x416faa
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00441385
pop ecx
pop ecx
lea ecx, [esp + 0xc]
call fcn.0043645f
push str.g2m.dll
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.00438f74
add esp, 0xc
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
xor esi, esi
push esi
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00443a44
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0043641b
lea ecx, [esp + 0x30]
call fcn.0043645f
lea ecx, [esp + 0xc]
call fcn.0043ff50
cmp eax, 0x3e9
jne 0x416f47
lea ecx, [esp + 0x58]
call fcn.0043fdec
push eax
push str._s_still_exists.
push esi
push esi
push esi
call fcn.00404c99
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.0043ff50
mov ecx, 0x3e8
cmp eax, ecx
je 0x416f8c
push ecx
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea ecx, [esp + 0xc]
call fcn.0043645f
call sub.KERNEL32.DLL_GetTickCount
xor ecx, ecx
sub eax, ebx
sbb ecx, esi
mov dword [esp + 0x24], ecx
jne 0x416f85
cmp eax, 0x7530
jb 0x416ef8
push 0x4a7e84
jmp 0x416f9a
lea ecx, [esp + 0xc]
call fcn.0043645f
push 0x4a7e80
mov ecx, edi
call fcn.004363fb
lea ecx, [esp + 0x58]
call fcn.00438dea
lea ecx, [esp + 0x44]
call fcn.00438dea
mov ecx, dword [esp + 0x6c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret 8
Function at 0x418193
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 4]
push ebx
push esi
push edi
push str._anonymous_namespace::removePluginRegistryEntriesDirectly__
push 0x4a4714
push eax
mov esi, ecx
call fcn.00415a33
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
mov ebx, str.SoftwareMozillaPlugins_citrixonline.com_appdetectorplugin
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x4181dc
push 0x4a46ac
mov ecx, esi
call fcn.004363fb
jmp 0x41827a
push 0
push eax
lea eax, [ebp - 0x2c]
push str.RegDeleteKey_HKEY_CURRENT_USER_..._
push eax
call fcn.00436b55
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.0043641b
lea ecx, [ebp - 0x2c]
call fcn.0043645f
push ebx
push 0x80000002
call edi
test eax, eax
jne 0x41821b
push 0x4a46ac
mov ecx, esi
call fcn.004363fb
jmp 0x418272
xor ebx, ebx
mov edi, str.c:jenkinsworkspacePlatformServicesLauncherGoToOpenerAppGoToOpenerApp_BuildReleaseCDownloaderAppWin32CodeLibTaskUninstallPlugin.cpp
push ebx
push 0x56
push edi
push eax
lea eax, [ebp - 0x2c]
push str.RegDeleteKey_HKEY_LOCAL_MACHINE_..._
push eax
call fcn.00436b55
add esp, 0xc
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004364ba
add esp, 0x14
lea ecx, [ebp - 0x2c]
call fcn.0043645f
push ebx
push ebx
push 0x58
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00406ae7
add esp, 0x14
mov ecx, esi
push eax
call fcn.0043641b
lea ecx, [ebp - 0x2c]
call fcn.0043645f
lea ecx, [ebp - 0x18]
call fcn.0043645f
lea ecx, [ebp - 4]
call fcn.00415a12
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418b82
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SoftwareLogMeInIncGoTo_Opener
lea ecx, [ebp - 0x18]
call fcn.00438ae2
push 0
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x58]
call fcn.0043c5d3
lea ecx, [ebp - 0x18]
call fcn.00438dea
push str.SoftwareCitrixLauncherApp
lea ecx, [ebp - 0x18]
call fcn.00438ae2
push 0
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043c5d3
lea ecx, [ebp - 0x18]
call fcn.00438dea
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov edi, str.Locale
movzx esi, ax
push edi
lea ecx, [ebp - 0x18]
call fcn.00438ae2
push esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x58]
call fcn.0043d17b
mov ecx, eax
call fcn.0043ff50
cmp eax, 0x7d0
lea ecx, [ebp - 0x70]
setne bl
call fcn.0043645f
lea ecx, [ebp - 0x18]
call fcn.00438dea
test bl, bl
je 0x418c5c
push edi
lea ecx, [ebp - 0x18]
call fcn.00438ae2
push esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043d17b
lea ecx, [ebp - 0x70]
call fcn.0043645f
lea ecx, [ebp - 0x18]
call fcn.00438dea
movzx esi, word [ebp - 0x5c]
lea ecx, [ebp - 0x30]
call fcn.00438dea
lea ecx, [ebp - 0x38]
call fcn.0043f779
lea ecx, [ebp - 0x50]
call fcn.00438dea
lea ecx, [ebp - 0x58]
call fcn.0043f779
mov ecx, dword [ebp - 4]
mov ax, si
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret
Function at 0x41b098
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x48]
push 0x4a46ac
mov dword [ebp - 0x1c], eax
call fcn.004363fb
lea ecx, [ebp - 0x18]
call fcn.00438b2f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0043ef17
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0043645f
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.0043f716
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0043645f
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0046e6d0
add esp, 0xc
mov dword [ebp - 0x84], esi
mov ecx, edi
mov dword [ebp - 0x80], 0x500
mov dword [ebp - 0x68], 5
mov dword [ebp - 0x78], str.open
call fcn.0043fdec
mov ecx, ebx
mov dword [ebp - 0x74], eax
call fcn.0043fdec
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41b182
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x1c]
push eax
push str.ShellExecuteEx
mov dword [ecx], eax
lea eax, [ebp - 0x34]
push eax
call fcn.00436b55
add esp, 0xc
lea ecx, [ebp - 0x48]
push eax
call fcn.00436492
lea ecx, [ebp - 0x34]
call fcn.0043645f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0043f716
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.0043645f
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.0043641b
lea ecx, [ebp - 0x18]
call fcn.00438dea
lea ecx, [ebp - 0x48]
call fcn.0043645f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046a7e5
mov esp, ebp
pop ebp
ret