joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b908
Capabilities:
Get common file path

Disassembly:
push 0x20c
mov eax, 0x46d655
call fcn.004525fd
xor esi, esi
push 0x104
lea eax, [ebp - 0x118]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x170], esi
call fcn.0044c700
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push esi
push esi
push 0x8023
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov ebx, eax
cmp ebx, esi
je 0x42ba36
lea eax, [ebp - 0x218]
push eax
call fcn.00402774
lea eax, [ebp - 0x218]
push str.SHGetFolderPath_0x
push eax
mov dword [ebp - 4], esi
call fcn.0040560b
mov eax, dword [ebp - 0x218]
mov eax, dword [eax + 4]
pop ecx
lea eax, [ebp + eax - 0x218]
pop ecx
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
push 0x23
lea eax, [ebp - 0x218]
push eax
call fcn.0040aa33
lea eax, [ebp - 0x218]
push str.__mode
push eax
call fcn.0040560b
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x218]
push eax
call fcn.0040aa33
lea eax, [ebp - 0x218]
push 0x47a530
push eax
call fcn.0040560b
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
lea edi, [ebp - 0x180]
call fcn.00434e69
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 1
push ecx
lea esi, [ebp - 0x16c]
mov ecx, eax
mov dword [ebp - 0x16c], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_SysInfo.cpp
mov dword [ebp - 0x168], str.SysInfo::SHGetFolderPathAdapter
mov dword [ebp - 0x164], 0x1bf
call fcn.0042be5a
lea eax, [ebp - 0x160]
mov dword [esp], 0x487b68
push eax
call fcn.00452164
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x134]
call fcn.00402450
lea edx, [ebp - 0x134]
mov eax, edi
mov dword [ebp - 4], 2
call fcn.0042c7d8
push esi
push 1
lea ecx, [ebp - 0x134]
call fcn.0040320c
mov eax, edi
call fcn.00452680
ret
Function at 0x42c04b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46d5a5
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4976a0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov eax, dword [0x4976a0]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [esp + 0x10], eax
mov eax, esi
call fcn.0042c02d
mov edi, eax
test edi, edi
jne 0x42c153
push str.cannot_find_resource
lea ecx, [esp + 0xcc]
call fcn.00402450
and dword [esp + 0x138], edi
lea eax, [esp + 0x10c]
push eax
lea edx, [esp + 0xcc]
mov ecx, esi
call fcn.0042bf78
mov edi, eax
lea esi, [esp + 0x2c]
mov byte [esp + 0x138], 1
call fcn.0042670f
push str.System_error
mov byte [esp + 0x13c], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [esp + 0x2c]
call fcn.00437531
lea ecx, [esp + 0xe4]
mov byte [esp + 0x138], 3
push ecx
lea esi, [esp + 0x18]
mov ecx, eax
mov dword [esp + 0x18], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_Resources.cpp
mov dword [esp + 0x1c], str.Resource::getPtr
mov dword [esp + 0x20], 0x41
call fcn.0041b855
mov dword [esp], 0x487838
lea eax, [esp + 0xe8]
push eax
call fcn.00452164
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x42c214
push str.cannot_load_resource
lea ecx, [esp + 0xcc]
call fcn.00402450
lea eax, [esp + 0x10c]
push eax
lea edx, [esp + 0xcc]
mov ecx, esi
mov dword [esp + 0x13c], 4
call fcn.0042bf78
mov edi, eax
lea esi, [esp + 0x2c]
mov byte [esp + 0x138], 5
call fcn.0042670f
push str.System_error
mov byte [esp + 0x13c], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [esp + 0x2c]
call fcn.00437531
lea ecx, [esp + 0xe4]
mov byte [esp + 0x138], 7
push ecx
lea esi, [esp + 0x18]
mov ecx, eax
mov dword [esp + 0x18], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_Resources.cpp
mov dword [esp + 0x1c], str.Resource::getPtr
mov dword [esp + 0x20], 0x46
call fcn.0041b855
mov dword [esp], 0x487838
lea eax, [esp + 0xe8]
jmp 0x42c14d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x42c245
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x42c235
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x42c22b
movzx ecx, word [eax]
mov edx, dword [esp + 0x10]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x42c255
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ebx
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0044a659
mov esp, ebp
pop ebp
ret 4
Function at 0x42c56c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x42c574
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x42c584
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x42c58c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42c5a0
test al, 0x10
je 0x42c5a0
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x42cca7
Capabilities:
Create directory

Disassembly:
push 0xe4
mov eax, 0x46d531
call fcn.004525fd
mov eax, dword [ebp + 0x24]
mov ebx, ecx
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x42ccce
lea eax, [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push eax
call edi
test eax, eax
je 0x42cd98
cmp dword [0x49c100], 0
jg 0x42cd6e
sub esp, 0x1c
lea eax, [ebp + 8]
mov esi, esp
mov dword [ebp - 0x3c], esp
push eax
call fcn.0040242f
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 1
call fcn.00402774
lea eax, [ebp - 0xf0]
push str.Created__
push eax
mov byte [ebp - 4], 2
call fcn.0040560b
pop ecx
pop ecx
lea esi, [ebp - 0xf0]
mov byte [ebp - 4], 3
call fcn.004042ae
mov esi, eax
push str.__directory
push esi
call fcn.0040560b
pop ecx
pop ecx
push esi
push 0x1ce
push 0
mov ebx, str.FileUtils::_anonymous_namespace::createDir
mov edi, str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov esi, 0x49c100
call fcn.004016a9
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.004015cb
mov edi, dword [ebp - 0x40]
test edi, edi
je 0x42cdb0
lea edx, [ebp + 8]
lea eax, [ebp - 0x2c]
call fcn.0042c7d8
push eax
mov byte [ebp - 4], 4
call fcn.00412c7c
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040320c
jmp 0x42cdb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
jne 0x42cdc2
lea eax, [ebp + 8]
call fcn.0042c584
test al, al
je 0x42cdc2
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040320c
call fcn.00452680
ret
push str.System_error
push esi
sub esp, 0x1c
lea eax, [ebp + 8]
mov esi, esp
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x4c], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.FileUtils::_anonymous_namespace::createDir
mov dword [ebp - 0x44], 0x1d7
lea ebx, [ebp - 0x4c]
call fcn.0040242f
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 5
call fcn.00402774
lea eax, [ebp - 0xf0]
push str.CreateDirectory_
push eax
mov byte [ebp - 4], 6
call fcn.0040560b
pop ecx
pop ecx
lea esi, [ebp - 0xf0]
mov byte [ebp - 4], 7
call fcn.004042ae
mov esi, eax
push 0x47e1d4
push esi
call fcn.0040560b
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x58]
call fcn.00437531
lea ecx, [ebp - 0x38]
push ecx
mov esi, ebx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0041b855
lea eax, [ebp - 0x38]
mov dword [esp], 0x487838
push eax
call fcn.00452164
int3
Function at 0x42d3da
Capabilities:
Delete file

Disassembly:
push 0x9c
mov eax, 0x46a55d
call fcn.00452594
mov edi, ecx
cmp dword [edi + 0x14], 0x10
jb 0x42d3f5
mov eax, dword [edi]
jmp 0x42d3f7
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
xor ebx, ebx
cmp al, bl
je 0x42d495
cmp dword [0x49c100], ebx
jg 0x42d491
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x10], esp
push edi
call fcn.0040242f
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 4], ebx
call fcn.00402774
lea eax, [ebp - 0xa8]
push str.Deleted__
push eax
mov byte [ebp - 4], 1
call fcn.0040560b
pop ecx
pop ecx
lea esi, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.004042ae
mov esi, eax
push str.__file
push esi
call fcn.0040560b
pop ecx
pop ecx
push esi
push 0x25e
push ebx
mov ebx, str.FileUtils::_anonymous_namespace::deleteFileImpl
mov edi, str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov esi, 0x49c100
call fcn.004016a9
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa8]
call fcn.004015cb
mov al, 1
jmp 0x42d4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042d3c5
add esp, 4
call fcn.0045266c
ret
Function at 0x42d4aa
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0042d3da
mov byte [esp + 0xf], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esp + 0xf], 0
jne 0x42d675
cmp eax, 5
jne 0x42d65e
cmp dword [edi + 0x14], 0x10
jb 0x42d4eb
mov eax, dword [edi]
jmp 0x42d4ed
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 5
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0xffffffff
jne 0x42d50a
xor al, al
jmp 0x42d678
test bl, 1
je 0x42d65e
and ebx, 0xfffffffe
cmp dword [edi + 0x14], 0x10
jb 0x42d520
mov eax, dword [edi]
jmp 0x42d522
mov eax, edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
call ebx
test eax, eax
je 0x42d5b5
cmp dword [0x49c100], 0
jg 0x42d5a5
lea eax, [esp + 0x20]
push eax
call fcn.00402774
lea eax, [esp + 0x20]
push str.Discarded_R_O_attribute_from__
push eax
call fcn.0040560b
sub esp, 0x14
mov esi, esp
mov dword [esp + 0x2c], esp
push edi
call fcn.0040242f
lea esi, [esp + 0x3c]
call fcn.004042ae
mov esi, eax
push str.__file
push esi
call fcn.0040560b
pop ecx
pop ecx
push esi
push 0x276
push 0
mov ebx, str.FileUtils::deleteFile
mov edi, str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov esi, 0x49c100
call fcn.004016a9
lea eax, [esp + 0x20]
call fcn.004015cb
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0042d3da
mov byte [esp + 0xf], al
jmp 0x42d657
cmp dword [0x49c100], 2
jg 0x42d64f
lea eax, [esp + 0x20]
push eax
call fcn.00402774
lea eax, [esp + 0x20]
push str.Failed_to_discard_R_O_attribute_from__
push eax
call fcn.0040560b
sub esp, 0x14
mov esi, esp
mov dword [esp + 0x2c], esp
push edi
call fcn.0040242f
lea esi, [esp + 0x3c]
call fcn.004042ae
mov esi, eax
push str.__file._File_will_not_be_deleted
push esi
call fcn.0040560b
pop ecx
pop ecx
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
mov ecx, ebx
lea edi, [esp + 0x20]
call fcn.00437531
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
push eax
push 0x27c
push 2
mov ebx, str.FileUtils::deleteFile
mov edi, str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov esi, 0x49c100
call fcn.004016ea
lea ecx, [esp + 0x14]
call fcn.0044ab26
lea eax, [esp + 0x20]
call fcn.004015cb
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [esp + 0xf], 0
jne 0x42d675
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042d3c5
add esp, 4
test al, al
jne 0x42d675
xor eax, eax
jmp 0x42d678
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d750
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi + 0x14], 0x10
jb 0x42d769
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
test al, al
je 0x42d7f1
cmp dword [0x49c100], 0
jg 0x42d7e7
lea eax, [esp + 0x10]
push eax
call fcn.00402774
lea eax, [esp + 0x10]
push str.Deleted__
push eax
call fcn.0040560b
sub esp, 0x14
mov esi, esp
mov dword [esp + 0x28], esp
push edi
call fcn.0040242f
lea esi, [esp + 0x2c]
call fcn.004042ae
mov esi, eax
push str.__directory
push esi
call fcn.0040560b
pop ecx
pop ecx
push esi
push 0x291
push 0
mov ebx, str.FileUtils::deleteDirectory
mov edi, str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov esi, 0x49c100
call fcn.004016a9
lea eax, [esp + 0x10]
call fcn.004015cb
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042d3c5
add esp, 4
test al, al
jne 0x42d7e7
xor eax, eax
jmp 0x42d7ea
Function at 0x42e2d0
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x46d2e7
call fcn.004525fd
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.0040242f
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x42e30c
mov eax, dword [ebx]
jmp 0x42e30e
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x42e3c6
push str.System_error
mov dword [ebp - 0x4c], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x464
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.0040242f
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00402774
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040560b
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.004042ae
mov esi, eax
push 0x47e1d4
push esi
call fcn.0040560b
pop ecx
pop ecx
mov ecx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.00437531
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.0041b855
lea eax, [ebp - 0x3c]
mov dword [esp], 0x487838
push eax
call fcn.00452164
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0040faa8
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x42e3e2
mov edx, dword [ebx]
jmp 0x42e3e4
mov edx, ebx
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x42e482
push str.System_error
mov dword [ebp - 0x4c], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.0040242f
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00402774
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040560b
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.004042ae
mov esi, eax
push 0x47e1d4
push esi
call fcn.0040560b
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.00437531
mov byte [ebp - 4], 9
jmp 0x42e3a8
mov eax, ebx
call fcn.00452680
ret 4
Function at 0x42fceb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46afa0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4976a0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x4976a0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
cmp dword [0x49c100], 1
mov ebx, ecx
jg 0x42fd75
lea eax, [esp + 0x1c]
push str.Executor.exec__:
lea edi, [ebx + 0x38]
push eax
call fcn.00408a34
pop ecx
pop ecx
and dword [esp + 0x48], 0
push str.Executor::startExecution
push 0x93
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_Executor.cpp
push 1
mov edx, eax
mov ecx, 0x49c100
call fcn.00421620
or dword [esp + 0x48], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x24]
call fcn.0040320c
push 0x44
pop esi
push esi
lea edi, [ebx + 0x7c]
push 0
push edi
call fcn.0044c700
add esp, 0xc
push 0x10
lea eax, [ebx + 0x6c]
push 0
push eax
mov dword [edi], esi
call fcn.0044c700
add esp, 0xc
cmp dword [ebx + 0xc0], 1
jne 0x42fdb9
or dword [ebx + 0xa8], 1
xor eax, eax
mov word [ebx + 0xac], ax
mov dword [ebx + 0x60], 0x8000000
cmp byte [ebx + 0xcd], 0
je 0x42fdc9
mov esi, ebx
call fcn.00430341
lea eax, [ebx + 0x38]
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x42fdd8
mov esi, dword [eax]
jmp 0x42fdda
mov esi, eax
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, 0x10
jb 0x42fde6
mov eax, dword [eax]
push dword [esp + 0x18]
xor edx, edx
push ecx
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
call fcn.0042ebe2
mov dword [esp + 0x48], 1
lea eax, [esp + 0x17]
lea esi, [esp + 0x1c]
mov byte [esp + 0x17], 0
call fcn.00410d9d
cmp dword [ebx + 0x14], 0x10
jb 0x42fe28
mov ecx, dword [ebx]
jmp 0x42fe2a
mov ecx, ebx
lea eax, [ebx + 0x6c]
push eax
push edi
push dword [ebx + 0x68]
push dword [ebx + 0x64]
push dword [ebx + 0x60]
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
push dword [ebx + 0x54]
push dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
cmp dword [esp + 0x1c], 0
je 0x42fe62
push dword [esp + 0x1c]
call fcn.0044a64e
pop ecx
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0044a659
mov esp, ebp
pop ebp
ret
Function at 0x433ffd
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x467338
call fcn.00452594
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.00433fd1
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.00433fd1
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.00433fd1
mov eax, esi
mov dword [esp], 0x409
call fcn.00433fd1
pop ecx
mov eax, esi
call fcn.0045266c
ret

Function at 0x4353d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4976a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x6c], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
mov esi, ecx
call fcn.0042c5a3
pop ecx
push edi
lea eax, [ebp - 0x20]
call fcn.0042c657
xor ebx, ebx
pop ecx
cmp dword [ebp - 0x2c], ebx
je 0x4354b2
mov ecx, dword [esi + 8]
mov eax, dword [esi]
push ebx
or ecx, 0x20019
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00434ec9
add esp, 0x14
cmp dword [ebp - 0x78], ebx
je 0x435463
cmp byte [ebp - 0x7c], bl
je 0x435448
push dword [ebp - 0x80]
mov byte [ebp - 0x7c], bl
call fcn.0043b105
pop ecx
lea esi, [ebp - 0x3c]
call fcn.0040e8e2
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0044a659
leave
ret 8
push dword [ebp - 0x6c]
lea eax, [ebp - 0x20]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x80]
mov eax, esp
mov dword [eax], ecx
mov cl, byte [ebp - 0x7c]
mov byte [eax + 4], cl
mov dword [ebp - 0x6c], esp
push esi
lea ecx, [ebp - 0x3c]
lea edi, [ebp - 0x64]
mov byte [ebp - 0x7c], bl
call fcn.0043503d
mov ecx, eax
call fcn.004353d4
mov esi, edi
mov byte [ebp - 0x65], al
call fcn.00435144
cmp byte [ebp - 0x7c], bl
je 0x4354ad
push dword [ebp - 0x80]
mov byte [ebp - 0x7c], bl
call fcn.0043b105
pop ecx
mov bl, byte [ebp - 0x65]
jmp 0x435448
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x70], ebx
jb 0x4354c3
mov edi, dword [edi]
mov esi, dword [esi]
lea eax, [ebp - 0x84]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x435448
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
je 0x4354ee
mov ecx, dword [ebp - 0x70]
mov dword [eax], ecx
mov bl, 1
jmp 0x435448
Function at 0x435cda
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46dfeb
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x4976a0]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
mov eax, dword [0x4976a0]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x108]
mov ebx, ecx
push eax
mov edi, esi
mov dword [esp + 0x18], ebx
call fcn.0042c5a3
pop ecx
xor edi, edi
push esi
lea eax, [esp + 0x128]
mov dword [esp + 0x1a4], edi
call fcn.0042c657
pop ecx
xor eax, eax
inc eax
mov dword [esp + 0x1a0], eax
cmp dword [esp + 0x118], edi
je 0x435da0
push eax
lea eax, [esp + 0x10c]
push eax
lea edi, [esp + 0x148]
call fcn.004350c0
mov byte [esp + 0x1a0], 2
push dword [ebp + 0xc]
lea ecx, [esp + 0x128]
push ecx
mov ecx, eax
call fcn.00435cda
mov esi, edi
mov byte [esp + 0x1a0], 1
call fcn.00435144
jmp 0x435f0e
cmp dword [esi + 0x14], 0x10
jb 0x435daa
mov ecx, dword [esi]
jmp 0x435dac
mov ecx, esi
mov eax, dword [ebx]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push edi
push ecx
push eax
call ebx
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x435e9a
push str.set_dword_value
lea ecx, [esp + 0xf0]
call fcn.00402450
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], edi
mov byte [esp + 0xd0], 0
push esi
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 4
call fcn.00436727
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x1a0], 5
call fcn.0042670f
push str.System_error
push dword [esp + 0x1c]
mov eax, esi
push eax
mov ecx, ebx
lea edi, [esp + 0x34]
mov byte [esp + 0x1ac], 6
call fcn.00437531
lea ecx, [esp + 0x168]
mov byte [esp + 0x1a0], 7
push ecx
lea esi, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x20], str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_Registry.cpp
mov dword [esp + 0x24], str.Registry::setDword
mov dword [esp + 0x28], 0x181
call fcn.0041b855
lea eax, [esp + 0x16c]
mov dword [esp], 0x487838
push eax
call fcn.00452164
cmp dword [0x49c100], edi
jg 0x435f0e
mov eax, dword [esp + 0x14]
mov ecx, esi
lea esi, [esp + 0xd0]
call fcn.0043537c
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [esp + 0xf4]
push eax
mov byte [esp + 0x1ac], 8
call fcn.0043685c
add esp, 0xc
push str.Registry::setDword
push 0x184
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u251_737_install_src_windows_common_Registry.cpp
push edi
mov edx, eax
mov ecx, 0x49c100
mov byte [esp + 0x1b0], 9
call fcn.00421620
push edi
push 1
lea ecx, [esp + 0xf4]
call fcn.0040320c
push edi
push 1
mov ecx, esi
call fcn.0040320c
lea esi, [esp + 0x108]
call fcn.0040e8e2
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0044a659
mov esp, ebp
pop ebp
ret 8