joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407f49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407f49
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x407f3a
cmp esi, edx
jae 0x407f49
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x407f28
cmp esi, edx
jae 0x407f49
cmp word [esi], 0
je 0x407f49
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x408dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e168
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4cf484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00454291
mov edi, eax
add esp, 4
test edi, edi
je 0x408e63
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004272fd
add esp, 4
mov dword [edi + 4], eax
jmp 0x408e65
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004031d0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x408ec5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x408ec5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x408ee9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x408f0b
cmp byte [ebp + 0xc], 0
je 0x408ef8
push esi
call fcn.00427824
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x408f17
mov esi, str.ios_base::badbit_set
jmp 0x408f27
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00408f50
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00403c40
push 0x4c2648
lea eax, [ebp - 0x30]
push eax
call fcn.00460214
int3
Function at 0x40be60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00454930
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.00461130
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x40bf56
test edi, edi
je 0x40bf56
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40bf56
cmp eax, 0x3fff
ja 0x40bf56
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40bf56
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x4a8100
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40bf56
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.00461130
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x4a8104
lea eax, [esi - 1]
push eax
push edi
call fcn.0040daa0
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00454577
mov esp, ebp
pop ebp
ret
Function at 0x40c2c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e556
mov eax, dword fs:[0]
push eax
sub esp, 0x194
push ebx
push esi
push edi
mov eax, dword [0x4cf484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4a8224
push 1
mov bl, 1
push 0
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x40c3de
call fcn.0044e0d0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x40c4ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x50
push str.d:jenkins.jenkinsworkspacepay_groupcclean_sys_disk_cleancclean_srcmain.cc
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov ebx, eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.004086a0
push 3
push 0x4a79e0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.004086a0
mov byte [ebp - 4], 1
call fcn.0044e0d0
mov edi, eax
lea ecx, [ebp - 0x108]
push 0x19
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004035f0
mov esi, eax
push str.check_instance_fail__errno_
push esi
mov byte [ebp - 4], 2
call fcn.004044e0
add esp, 8
mov ecx, esi
push ebx
call fcn.0040a430
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x108]
call fcn.00404600
lea ecx, [ebp - 0x28]
call fcn.00404010
lea ecx, [ebp - 0x40]
call fcn.00404010
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c4c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044e0d0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x40c4ad
push 0x50
push str.d:jenkins.jenkinsworkspacepay_groupcclean_sys_disk_cleancclean_srcmain.cc
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], al
call fcn.004086a0
push 3
push 0x4a79e0
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 3
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.004086a0
mov byte [ebp - 4], 4
call fcn.0044e0d0
mov edi, eax
lea ecx, [ebp - 0x1a0]
push 0x1e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004035f0
mov esi, eax
push str.instance_exist
push esi
mov byte [ebp - 4], 5
call fcn.004044e0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x1a0]
call fcn.00404600
lea ecx, [ebp - 0x58]
call fcn.00404010
lea ecx, [ebp - 0x70]
call fcn.00404010
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c4ca
mov dword [eax], esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ce80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e5c6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], 0
push 0x404
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.00461130
add esp, 0xc
mov dword [ebp - 0x420], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x40cf3c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x40cf3c
call fcn.0040b060
mov esi, eax
jmp 0x40d029
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40cf5f
call fcn.0040b060
jmp 0x40d01c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
test ebx, ebx
jne 0x40cf7d
call fcn.0040b060
jmp 0x40d01c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40cf9e
mov esi, 0x8007000e
jmp 0x40d01e
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.0040af30
jmp 0x40cfc8
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x40cfdf
mov esi, 0x8007000e
jmp 0x40d01e
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40cfff
call fcn.0040b060
jmp 0x40d01c
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.0040cce0
mov esi, eax
test edi, edi
je 0x40d029
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x40d042
lea ecx, [ebp - 0x420]
call fcn.0040be50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e490
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40e517
test ebx, ebx
je 0x40e517
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40e517
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40e517
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40e511
push esi
push ebx
push edi
call fcn.00460630
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40e511
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454577
mov esp, ebp
pop ebp
ret
Function at 0x412c20
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ea4a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4cf484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebx + 4], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], eax
mov dword [ebp - 4], 0
mov dword [ebx + 0x24], vtable.LdsJsBasic::WebWindowListener.0
mov dword [ebx + 0x28], vtable.LdsWebView::IWebViewExecuteFunction.0
lea esi, [ebx + 0x44]
mov dword [ebx], vtable.lds::WebviewWrapper_class_MainWnd_.0
mov ecx, esi
mov dword [ebx + 0x24], vtable.lds::WebviewWrapper_class_MainWnd_.1.0
mov dword [ebx + 0x28], vtable.lds::WebviewWrapper_class_MainWnd_.2.0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0x401
mov dword [ebx + 0x38], 0x402
mov dword [ebx + 0x3c], 0x403
mov dword [ebx + 0x40], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041bde0
mov dword [esi], eax
lea ecx, [ebx + 0x50]
mov dword [ebx + 0x4c], 0
push 6
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.cclean
mov byte [ebp - 4], 2
mov byte [ecx], 0
call fcn.004086a0
mov dword [ebx + 0x68], 0x65
mov dword [ebx + 0x6c], vtable.cclean::CleannerDelegate.0
lea ecx, [ebx + 0x70]
mov dword [ebp - 4], 3
mov dword [ebx], vtable.MainWnd.0
mov dword [ebx + 0x24], vtable.MainWnd.1.0
mov dword [ebx + 0x28], vtable.MainWnd.2.0
mov dword [ebx + 0x6c], vtable.MainWnd.3.0
call fcn.004337b0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
lea esi, [ebx + 0x80]
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041be20
mov dword [esi], eax
push 1
push str.cclean_main_ml
lea ecx, [ebx + 0x70]
mov byte [ebp - 4], 6
call fcn.00434700
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4248a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x4bc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x3e8
push 0
push eax
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], ebx
call fcn.00461130
push 0xc8
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.00461130
add esp, 0x18
test esi, esi
je 0x4249a0
test ebx, ebx
je 0x4249a0
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4249a0
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x4249a0
xor ecx, ecx
movzx edx, ax
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x42498b
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x4c4]
call fcn.0046889f
add esp, 0xc
test eax, eax
je 0x4249b3
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x424931
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x424a09
cmp edi, 0x7fffffff
ja 0x424a00
mov ecx, ebx
mov esi, 0x7ffffffe
lea ebx, [ebp - 0xc]
sub esi, edi
mov edx, edi
sub ebx, ecx
nop
lea eax, [esi + edx]
test eax, eax
je 0x4249eb
movzx eax, word [ebx + ecx]
test ax, ax
je 0x4249eb
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4249d0
mov ebx, dword [ebp - 0x4c0]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x424a09
test edi, edi
je 0x424a09
xor eax, eax
mov word [ebx], ax
xor ecx, ecx
test edi, edi
je 0x424a17
cmp edi, 0x7fffffff
jbe 0x424a1c
mov ecx, 0x80070057
test ecx, ecx
js 0x424a4e
mov esi, edi
mov eax, ebx
test edi, edi
je 0x424a36
cmp word [eax], 0
je 0x424a36
add eax, 2
sub esi, 1
jne 0x424a28
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x424a50
xor esi, esi
test ecx, ecx
js 0x424aa6
mov edx, edi
lea ecx, [ebx + esi*2]
sub edx, esi
je 0x424a99
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
mov eax, dword [ebp - 0x4c8]
add eax, eax
sub eax, ecx
add edi, eax
nop word [eax + eax]
test esi, esi
je 0x424a99
movzx eax, word [edi + ecx]
test ax, ax
je 0x424a99
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x424a80
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454577
mov esp, ebp
pop ebp
ret
Function at 0x424bb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a03c3
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov edx, 2
mul edx
push 0x4d4536
seto cl
neg ecx
or ecx, eax
push ecx
mov dword [ebp - 0x2c], ecx
call fcn.00454927
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
je 0x424cc9
push dword [ebp - 0x2c]
push ebx
push eax
call fcn.00461130
add esp, 0xc
push dword [ebp - 0x20]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x424cb0
mov edi, eax
cmp word [eax], bx
je 0x424cad
cmp ebx, esi
je 0x424c7a
mov ax, word [edi]
mov word [esi], ax
add esi, 2
mov dword [ebp - 0x18], esi
jmp 0x424c8a
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.004246c0
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424c90
sub eax, edx
sar eax, 1
lea edi, [edi + eax*2]
add edi, 2
cmp word [edi], cx
jne 0x424c68
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push eax
call fcn.004542d8
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov dword [edi], ecx
mov dword [edi + 4], esi
mov dword [edi + 8], ebx
jmp 0x424d97
call fcn.0044e0d0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x424d83
push 0x57
push str.d:jenkins.jenkinsworkspacepay_groupcclean_sys_disk_cleancclean_srcutilsutils.cc
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], al
call fcn.004086a0
push 3
push 0x4a79e0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.004086a0
mov byte [ebp - 4], 2
call fcn.0044e0d0
mov edi, eax
lea ecx, [ebp - 0xf4]
push 0x131
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004035f0
mov esi, eax
push str.new_fail
push esi
mov byte [ebp - 4], 3
call fcn.004044e0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xf4]
call fcn.00404600
lea ecx, [ebp - 0x44]
call fcn.00404010
lea ecx, [ebp - 0x5c]
call fcn.00404010
mov edi, dword [ebp - 0x24]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.004130b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret
Function at 0x4251a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a046b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4d4380]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], esi
test al, 1
jne 0x42520f
or eax, 1
mov dword [0x4d4378], 0
mov dword [0x4d4380], eax
xor eax, eax
push 0x4a6810
mov dword [0x4d437c], 7
mov word [0x4d4368], ax
call fcn.00454562
add esp, 4
cmp dword [0x4d4378], 0
jne 0x42530c
mov eax, dword [0x4d4364]
test al, 1
jne 0x425256
or eax, 1
mov dword [0x4d435c], 0
mov dword [0x4d4364], eax
xor eax, eax
push 0x4a6870
mov dword [0x4d4360], 7
mov word [0x4d434c], ax
call fcn.00454562
add esp, 4
cmp dword [0x4d435c], 0
jne 0x4252b2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00461130
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425291
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x4d434c
call fcn.004087a0
push 0x4d434c
lea ecx, [ebp - 0x234]
call fcn.00424810
push 9
push str.ludashi_
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.00408510
cmp eax, 0x4d4368
je 0x4252fa
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x4252ec
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, 0x4d4368
call fcn.004087a0
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
call fcn.00404060
push 0x4d4368
mov ecx, esi
call fcn.00424810
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret

Function at 0x4255a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.00461130
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x425618
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x228], edi
je 0x425611
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4255f6
jmp 0x425617
mov ebx, dword [ebp - 0x218]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00454577
mov esp, ebp
pop ebp
ret
Function at 0x425640
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00454930
mov eax, dword [0x4cf484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1008], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test eax, eax
je 0x4257b0
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jb 0x4257b0
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4256a5
push ebx
push eax
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4257b0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00461130
add esp, 0xc
lea eax, [ebp - 0x804]
xor ebx, ebx
push 0x400
push eax
push ebx
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x425768
push 0x800
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.00461130
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.00461abd
add esp, 0x14
test eax, eax
je 0x425725
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x425725
lea ecx, [ebx + 1]
jmp 0x425727
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
push edi
lea eax, [ebp - 0x804]
cmovne eax, edx
push eax
push edi
push dword [ebp - 0x1008]
call fcn.0046731e
add esp, 0x10
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
je 0x425796
push edi
push dword [ebp - 0x1008]
lea eax, [ebp - 0x804]
push eax
call fcn.004248a0
add esp, 0xc
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454577
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454577
mov esp, ebp
pop ebp
ret