joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487550
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
push str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x487582
sub esp, 0xc
push eax
call fcn.0042b020
add esp, 0x10
mov ebx, eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
call fcn.004931a0
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
lea esi, [eax + 0xd]
push 0x231
push str.external_openssl_crypto_conf_conf_mod.c
push esi
call fcn.00424980
add esp, 0x10
test eax, eax
je 0x487579
mov ebx, eax
call fcn.004931a0
push edx
push esi
push eax
push ebx
call fcn.0042af10
add esp, 0xc
push esi
push 0x4c6960
push ebx
call fcn.0042af70
add esp, 0xc
push esi
push str.openssl.cnf
push ebx
call fcn.0042af70
add esp, 0x10
jmp 0x487579
Function at 0x494420
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x4944a0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4944aa
test esi, esi
je 0x494479
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
push eax
push eax
lea eax, [ebp - 0x18]
push eax
mov edi, dword [ebp + 8]
mov edi, dword [edi + 8]
push edi
call fcn.0043b520
add esp, 0x10
test eax, eax
je 0x494468
mov eax, dword [eax + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x4c8113
mov ecx, 4
cld
mov edi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4944b8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.default
mov dword [ebp - 0x14], ebx
push ecx
push ecx
push eax
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
push edx
call fcn.0043b520
add esp, 0x10
test eax, eax
jne 0x49445d
lea esi, [esi]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push ebx
call sub.msvcrt.dll_getenv
add esp, 0x10
jmp 0x494460
sub esp, 0xc
push ebx
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
jne 0x494460
jmp 0x494479
Function at 0x4967f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov ebx, dword [esp + 0x130]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4969ae
cmp byte [ebx], 0
je 0x496970
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x49699c
test al, 0x10
je 0x496970
push eax
push 0x104
push ebx
lea edi, [esp + 0x24]
push edi
call sub.msvcrt.dll__fullpath
pop eax
mov ecx, edi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x49684e
test edx, 0x8080
je 0x496962
add dl, dl
sbb ecx, 3
sub ecx, edi
lea eax, [ecx + 0x233]
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x49698a
lea esi, [eax + 0x22c]
mov ebp, eax
push eax
push eax
push edi
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
cmp byte [ebx + 0x22c], 0
jne 0x496914
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0xc
mov word [eax + esi], 0x2a
lea eax, [ebx + 0x120]
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov word [ebx + 0x11c], 0
mov word [ebx + 0x11e], 0
push 0x104
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
pop edx
pop ecx
push 0x2f
lea edi, [esi + eax - 1]
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
cmp eax, edi
je 0x4968af
push eax
push eax
push 0x5c
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
cmp edi, eax
je 0x4968af
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
mov word [eax + esi], 0x5c
jmp 0x4968af
shr edx, 0x10
add ecx, 2
jmp 0x496872
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0x14
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xc
jmp 0x496907
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 2
jmp 0x496907
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xe
jmp 0x496907
Function at 0x4103fe
Capabilities:
Get common file path
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x5cc]
sub esp, 0x64c
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x5c8], eax
mov eax, dword [ebp + 0x5d4]
push ebx
push esi
push edi
push 0x3c
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x80]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x3c4], bl
call fcn.0043b8b0
lea eax, [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x50], 0x400
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov edi, 0x104
cmp eax, ebx
je 0x4104a6
push 0x100
lea eax, [ebp + 0x3c4]
push eax
push edi
lea eax, [ebp + 0x4c4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0043e58d
lea eax, [ebp + 0x4c4]
push 0x464e60
push eax
call fcn.0043b3f0
add esp, 0x2c
test eax, eax
je 0x4104ef
mov eax, esi
mov dword [ebp - 0x40], ebx
cmp byte [esi], bl
je 0x4104d7
mov cl, byte [eax]
cmp cl, 0x20
je 0x4104bb
cmp cl, 9
jne 0x4104c4
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x4104af
mov ecx, dword [ebp - 0x40]
movsx edx, byte [eax]
imul ecx, ecx, 0x1f
add ecx, edx
inc eax
mov dword [ebp - 0x40], ecx
cmp byte [eax], bl
jne 0x4104af
push dword [ebp - 0x40]
lea eax, [ebp + 0x4c4]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x4c4]
push eax
push dword [ebp - 0x44]
call esi
lea eax, [ebp + 0x3c4]
push eax
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp + 0x5c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a455
add ebp, 0x5cc
leave
ret
Function at 0x41292f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push esi
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412a11
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.TransferJobID
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x78], 0
jbe 0x412a11
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
je 0x412a11
lea eax, [ebp - 0x70]
push eax
call esi
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x4129cf
xor eax, eax
jmp 0x4129e5
lea eax, [edi + edi]
call fcn.0044ee80
mov esi, esp
push 3
push edi
lea eax, [ebp - 0x70]
push eax
call fcn.00401098
push dword [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x10
push 0x45d5d8
push dword [ebp - 0x74]
call fcn.0043c108
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x412a16
mov eax, 0x80004005
lea esp, [ebp - 0x88]
pop edi
pop esi
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x394
leave
ret

Function at 0x413eeb
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x455b7c
call fcn.00441f1a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
dec ecx
push 4
neg ecx
sbb ecx, ecx
mov esi, edx
pop edx
and ecx, 0xfffffffc
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
add ecx, edx
lea eax, [ebp - 0x54]
push eax
or ecx, 1
push ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], edx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x413f78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.00413e85
push eax
lea eax, [ebp - 0x4c]
push str.encryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.00406098
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0040bdbf
push 0x46d650
mov eax, esi
push eax
call fcn.00441a81
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.0041053c
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.0043a470
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.00441f9d
ret
Function at 0x413faf
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x455b7c
call fcn.00441f1a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
mov esi, edx
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x41402d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.00413e85
push eax
lea eax, [ebp - 0x4c]
push str.decryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.00406098
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0040bdbf
push 0x46d650
mov eax, esi
push eax
call fcn.00441a81
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.0041053c
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.0043a470
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.00441f9d
ret

Function at 0x4140d6
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x6c
mov eax, 0x455b47
call fcn.00441f1a
mov eax, dword [ebp + 8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], ecx
cmp dword [ebp + 0xc], ecx
jne 0x414105
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ecx
mov byte [edi], cl
jmp 0x4141fe
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
lea edx, [ebp - 0x68]
push edx
push ecx
mov ebx, 0x40000001
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x68], ecx
push eax
call esi
test eax, eax
jne 0x414163
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x64]
call fcn.00413e85
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x48]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.00406098
add esp, 0x14
mov byte [ebp - 4], 1
lea esi, [ebp - 0x78]
call fcn.0040bdbf
push 0x46d650
mov eax, esi
push eax
call fcn.00441a81
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00414481
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x414190
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x6c]
call esi
test eax, eax
jne 0x4141d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x48]
call fcn.00413e85
push eax
lea eax, [ebp - 0x64]
push str.binary2string__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.00406098
add esp, 0x14
mov byte [ebp - 4], 4
jmp 0x41414e
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00414481
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea esi, [ebp - 0x2c]
mov byte [edi], 0
call fcn.00405cea
push 0
push 1
mov ecx, esi
call fcn.00405e43
mov eax, edi
call fcn.00441f9d
ret
Function at 0x414206
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x98
mov eax, 0x455af7
call fcn.00441f1a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x84], ebx
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x88], eax
cmp ecx, ebx
jne 0x41423c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x414376
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x84], ebx
jb 0x41424c
mov eax, dword [edi]
jmp 0x41424e
mov eax, edi
push ebx
push ebx
lea edx, [ebp - 0x84]
push edx
push ebx
push 1
push ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x4142a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x48]
call fcn.00413e85
push eax
lea eax, [ebp - 0x80]
push str.string2binary__phase1__failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.00406098
add esp, 0x14
lea esi, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0040bdbf
push 0x46d650
mov eax, esi
push eax
call fcn.00441a81
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.0041053c
mov dword [ebp - 4], 2
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x4142dc
mov edi, dword [edi]
push ebx
push ebx
lea ecx, [ebp - 0x84]
push ecx
push dword [ebp - 0x98]
push 1
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x41433a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x64]
call fcn.00413e85
push eax
lea eax, [ebp - 0x2c]
push str.string2binary__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.00406098
add esp, 0x14
lea esi, [ebp - 0xa4]
mov byte [ebp - 4], 4
call fcn.0040bdbf
push 0x46d650
mov eax, esi
jmp 0x4142a1
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x98]
call fcn.0041053c
mov eax, dword [ebp - 0x88]
lea edi, [ebp - 0x98]
call fcn.0041449c
cmp dword [ebp - 0x98], ebx
je 0x414370
push dword [ebp - 0x98]
call fcn.0043a44a
pop ecx
mov eax, dword [ebp - 0x88]
call fcn.00441f9d
ret
Function at 0x4155bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x457ba4
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x479630]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x479630]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
cmp dword [0x47d500], 1
mov ebx, ecx
jg 0x415645
lea eax, [esp + 0x1c]
push str.Executor.exec__:
lea edi, [ebx + 0x38]
push eax
call fcn.00412a81
pop ecx
pop ecx
and dword [esp + 0x48], 0
push str.Executor::startExecution
push 0x93
push str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Executor.cpp
push 1
mov edx, eax
mov ecx, 0x47d500
call fcn.004147a0
or dword [esp + 0x48], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x24]
call fcn.00405e43
push 0x44
pop esi
push esi
lea edi, [ebx + 0x7c]
push 0
push edi
call fcn.0043b8b0
add esp, 0xc
push 0x10
lea eax, [ebx + 0x6c]
push 0
push eax
mov dword [edi], esi
call fcn.0043b8b0
add esp, 0xc
cmp dword [ebx + 0xc0], 1
jne 0x415689
or dword [ebx + 0xa8], 1
xor eax, eax
mov word [ebx + 0xac], ax
mov dword [ebx + 0x60], 0x8000000
cmp byte [ebx + 0xcd], 0
je 0x415699
mov esi, ebx
call fcn.00415c0f
lea eax, [ebx + 0x38]
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x4156a8
mov esi, dword [eax]
jmp 0x4156aa
mov esi, eax
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, 0x10
jb 0x4156b6
mov eax, dword [eax]
push dword [esp + 0x18]
xor edx, edx
push ecx
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
call fcn.00425e6a
mov dword [esp + 0x48], 1
lea eax, [esp + 0x17]
lea esi, [esp + 0x1c]
mov byte [esp + 0x17], 0
call fcn.004118f7
cmp dword [ebx + 0x14], 0x10
jb 0x4156f8
mov ecx, dword [ebx]
jmp 0x4156fa
mov ecx, ebx
lea eax, [ebx + 0x6c]
push eax
push edi
push dword [ebx + 0x68]
push dword [ebx + 0x64]
push dword [ebx + 0x60]
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
push dword [ebx + 0x54]
push dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
cmp dword [esp + 0x1c], 0
je 0x415732
push dword [esp + 0x1c]
call fcn.0043a44a
pop ecx
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0043a455
mov esp, ebp
pop ebp
ret
Function at 0x415fa2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x456e64
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x479630]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x479630]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x416046
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.Destination_buffer_cant_be_NULL
call fcn.0043abdd
mov dword [esp + 0x20], vtable.std::invalid_argument.0
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_common_share_tstrings.cpp
mov dword [esp + 0x1c], str.tstrings::unsafe_format
mov dword [esp + 0x20], 0x1b
call fcn.0041695c
lea eax, [esp + 0x4c]
mov dword [esp], 0x46d82c
push eax
call fcn.00441a81
push 0xf
pop esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x80], 1
mov eax, dword [esp + 0x3c]
add eax, 0x100
lea ecx, [esp + 0x2c]
call fcn.00414481
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
jae 0x416081
lea eax, [esp + 0x2c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esp + 0x48]
push eax
call fcn.004402ce
add esp, 0x14
cmp eax, 0xffffffff
je 0x416060
lea ecx, [esp + 0x2c]
call fcn.00414481
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
lea esi, [esp + 0x2c]
mov byte [edi], bl
call fcn.00405cea
push ebx
push 1
mov ecx, esi
call fcn.00405e43
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0043a455
mov esp, ebp
pop ebp
ret
Function at 0x41aa49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x4593c3
call fcn.00441f1a
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.0041aa2b
mov edi, eax
test edi, edi
jne 0x41ab01
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.0041a976
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.00416cfa
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0042aa6f
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x58]
mov dword [esp], 0x46d888
push eax
call fcn.00441a81
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x41ab85
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0041a976
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.00416cfa
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0042aa6f
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x41aae0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x41abb5
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x41aba6
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x41ab9c
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x41abc4
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x420edc
Capabilities:
Check http status code

Disassembly:
push 0x94
mov eax, 0x459272
call fcn.00441f1a
mov esi, ecx
push esi
push 0x13
pop ecx
call fcn.0042093a
mov dword [ebp - 0x8c], eax
cmp eax, 0xc8
je 0x421023
cmp eax, 0xce
je 0x421023
cmp eax, 0x193
jne 0x420fd6
push 0x4634c6
lea ecx, [ebp - 0x4c]
call fcn.00405b5f
push 0x14
xor edi, edi
push esi
lea ecx, [ebp - 0x4c]
lea ebx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.00420ac4
push edi
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00405e43
mov esi, str.Export_Denied
push esi
call fcn.0043b360
pop ecx
push eax
push esi
mov eax, ebx
push eax
xor eax, eax
call fcn.00415e2c
cmp eax, 0xffffffff
je 0x420fc7
mov edi, 0x193
lea ecx, [ebp - 0xa0]
call fcn.0041ebb5
mov dword [ebp - 0xa0], vtable.HttpConnection::export_compliance_error.0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x7c]
push eax
lea esi, [ebp - 0x88]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2cb
call fcn.004233d7
mov dword [esp], 0x46dbd8
lea eax, [ebp - 0x7c]
push eax
call fcn.00441a81
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.00405e43
mov edi, dword [ebp - 0x8c]
lea ecx, [ebp - 0xa0]
call fcn.0041ebb5
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 4
push ecx
lea esi, [ebp - 0x88]
mov ecx, eax
mov dword [ebp - 0x88], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2ce
call fcn.00423378
mov dword [esp], 0x46db74
jmp 0x420fbe
call fcn.00441f9d
ret

Function at 0x421319
Capabilities:
Parse url

Disassembly:
push 0x5c
mov eax, 0x45590b
call fcn.00441f1a
push 0x38
lea eax, [ebp - 0x64]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.0043b8b0
xor ebx, ebx
inc ebx
add esp, 0xc
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x54], ebx
jb 0x42134e
mov esi, dword [esi]
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x421365
xor al, al
jmp 0x4213a9
mov eax, dword [ebp - 0x5c]
push 3
pop ecx
sub eax, ecx
je 0x42137a
dec eax
je 0x421376
mov dword [edi], ebx
jmp 0x421380
mov dword [edi], ecx
jmp 0x421380
mov dword [edi], 2
push dword [ebp - 0x54]
lea esi, [ebp - 0x2c]
push dword [ebp - 0x58]
call fcn.0040aa07
and dword [ebp - 4], 0
add edi, 4
mov esi, eax
call fcn.00405cea
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00405e43
mov al, bl
call fcn.00441f9d
ret

Function at 0x423caa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0043b8b0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
sete al
leave
ret