joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7e7
Capabilities:
Delete file

Disassembly:
sub esp, 0x18c
mov eax, dword [0x4b34c4]
xor eax, esp
mov dword [esp + 0x188], eax
cmp dword [esp + 0x194], 0
push esi
mov esi, dword [esp + 0x194]
push edi
mov ecx, dword [esi + 0x2478]
jne 0x40b850
mov edx, dword [esi + 0x2474]
test edx, edx
je 0x40b822
test ecx, ecx
je 0x40b850
mov eax, dword [esi]
push edx
push ecx
push esi
call dword [eax + 0x10]
mov edi, eax
test edi, edi
jne 0x40b846
push 1
call fcn.004109e6
pop ecx
test eax, eax
je 0x40b850
mov eax, 0x80070204
jmp 0x40ba0a
call fcn.00474cc0
jmp 0x40ba08
cmp dword [esi + 0x2478], 0
je 0x40b867
push 0x80
lea eax, [esi + 8]
push eax
call fcn.00474cc0
push 0x104
lea eax, [esp + 0x90]
mov ecx, esi
push eax
call fcn.0040bbaa
mov edi, eax
test edi, edi
js 0x40b9fd
push ebx
push ebp
push str.Download_Status:_Download_Complete
call fcn.00412911
pop ecx
push 1
call fcn.00425c61
mov ecx, eax
call fcn.00425e91
mov edi, str.CDownloadManager::DownloadExecInstaller
mov ebp, str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u381_237_install_src_windows_au_jucheck_DownloadManager.cpp
test al, al
je 0x40b8f5
lea eax, [esp + 0x40]
push 0
push eax
call fcn.004256c0
push eax
lea eax, [esp + 0x34]
push str.DownloadManager_MOS_MODE
push eax
call fcn.00474cc0
add esp, 0x14
push eax
push edi
push 0xa0
push ebp
push 1
call fcn.00425c61
mov ecx, eax
call fcn.00425e9d
lea ecx, [esp + 0x28]
call fcn.004063d7
lea ecx, [esp + 0x40]
call fcn.004063d7
lea eax, [esp + 0x94]
mov bl, 1
push eax
lea ecx, [esp + 0x14]
call fcn.004038cc
push 0
push 0x48764c
lea ecx, [esp + 0x18]
call fcn.0040d2aa
cmp eax, 0xffffffff
je 0x40b94b
push 1
call fcn.00425c61
mov ecx, eax
call fcn.00425e91
test al, al
je 0x40b949
push str.MOS__cb_detected__do_not_run
push edi
push 0xa6
push ebp
push 1
call fcn.00425c61
mov ecx, eax
call fcn.0040714b
xor bl, bl
mov eax, dword [esi]
lea ecx, [esp + 0x94]
push ecx
push esi
call dword [eax + 0x1c]
mov edi, eax
test edi, edi
js 0x40b987
test bl, bl
je 0x40b987
push dword [esp + 0x1a4]
mov eax, dword [esi]
lea ecx, [esp + 0x98]
push 1
push ecx
push esi
call dword [eax + 0x18]
mov edi, eax
test edi, edi
jns 0x40b9f0
push str.Download_Status:_Verification_of_Downloaded_File_Signature_Failed
jmp 0x40b9ea
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 0x58]
call fcn.0043078e
lea ecx, [esp + 0x58]
call fcn.00430a04
call fcn.0042c575
push eax
push 0x74
call fcn.0042c575
push eax
push 0x72
lea ecx, [esp + 0x68]
call fcn.00430907
mov ecx, eax
call fcn.00430aeb
mov ecx, eax
call fcn.00430a71
lea ecx, [esp + 0x70]
call fcn.004063fd
lea ecx, [esp + 0x58]
call fcn.004063fd
call fcn.00411a99
push str.Download_Status:_Verification_of_Downloaded_File_Version_Failed
call fcn.00412911
pop ecx
lea ecx, [esp + 0x10]
call fcn.004063d7
pop ebp
pop ebx
jmp 0x40ba08
push str.Download_Status:_Download_Failed
call fcn.00412911
pop ecx
mov eax, edi
mov ecx, dword [esp + 0x190]
pop edi
pop esi
xor ecx, esp
call fcn.00450e68
add esp, 0x18c
ret 8
Function at 0x40d072
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x160
mov eax, dword [0x4b34c4]
xor eax, esp
mov dword [esp + 0x15c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x170]
push edi
call fcn.00474cc0
mov ecx, dword [esp + 0x178]
xor edx, edx
inc edx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esi + 0x54], edx
test ecx, ecx
mov ebp, edx
sete al
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x40d0bc
and dword [esi + 0x58], 0
push 0x12
push str.PreDownldStatus
push 0
call fcn.0041210d
add esp, 0xc
lea ebx, [esi + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x28]
test eax, eax
je 0x40d216
mov edi, dword [esp + 0x14]
push 0
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40d216
mov eax, dword [ebx]
push ebp
push edi
push ebx
call dword [eax + 0x30]
mov edi, eax
cmp edi, 0x80070204
je 0x40d21b
test edi, edi
jne 0x40d203
cmp dword [esi + 0x2370], eax
je 0x40d203
and dword [esi + 0x50], eax
call fcn.0041bc0a
push eax
lea ecx, [esp + 0x94]
call fcn.0041b732
lea eax, [esi + 0x46c]
push eax
lea ecx, [esp + 0x7c]
call fcn.004038cc
lea eax, [esi + 0x18ec]
push eax
lea ecx, [esp + 0x64]
call fcn.004038cc
lea eax, [esi + 0x7ec]
push eax
lea ecx, [esp + 0x4c]
call fcn.004038cc
lea eax, [esi + 0x17ec]
push eax
lea ecx, [esp + 0x34]
call fcn.004038cc
lea eax, [esi + 0x19ec]
push eax
lea ecx, [esp + 0x1c]
call fcn.004038cc
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xa4]
call fcn.00474cc0
lea ecx, [esp + 0x18]
call fcn.004063d7
lea ecx, [esp + 0x30]
call fcn.004063d7
lea ecx, [esp + 0x48]
call fcn.004063d7
lea ecx, [esp + 0x60]
call fcn.004063d7
lea ecx, [esp + 0x78]
call fcn.004063d7
lea ecx, [esp + 0x90]
call fcn.0041bebb
xor ecx, ecx
inc ecx
mov dword [esi + 0x50], ecx
cmp eax, 2
je 0x40d25a
lea ecx, [esp + 0x90]
cmp dword [esp + 0x17c], edi
jne 0x40d24f
call fcn.0041b7e8
mov eax, dword [ebx]
xor edi, edi
push ebx
inc edi
xor ebp, ebp
call dword [eax + 0x28]
test eax, eax
jne 0x40d0e2
mov edi, 0x80004005
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esi + 0x247c], 0
je 0x40d232
and dword [esi + 0x54], 0
mov ecx, dword [esp + 0x16c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00450e68
add esp, 0x160
ret 0xc
and dword [esi + 0x247c], 0
xor edi, edi
jmp 0x40d267
mov dword [esi + 0x247c], ecx
lea ecx, [esp + 0x90]
call fcn.0041b7e8
jmp 0x40d21b
Function at 0x40d762
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4b34c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push ebx
push ebx
push 1
mov dword [edi + 0xc], 0xbc2
mov eax, dword [0x4b6c00]
push ebx
mov dword [edi + 0x18], eax
call esi
push ebx
push ebx
push 1
push ebx
mov dword [edi + 0x20], eax
call esi
push ebx
push ebx
push 1
push ebx
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x38], eax
call fcn.00474cc0
mov dword [edi + 0x3c], eax
call fcn.00474cc0
push dword [edi + 0x20]
mov esi, dword [sym.imp.kernel32.dll_ResetEvent]
mov dword [edi + 0x40], eax
call esi
push dword [edi + 0x24]
call esi
push dword [edi + 0x38]
call esi
lea eax, [ebp - 0x10c]
push eax
push ebx
push edi
push 0x40d5a4
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x40d7f6
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [edi + 0x20]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [edi + 0x20]
call esi
mov esi, dword [sym.imp.user32.dll_LoadStringA]
lea eax, [edi + 0x54]
mov ebx, 0x104
push ebx
push eax
push 0x7b
push dword [edi + 0x18]
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x7c
push dword [edi + 0x18]
call esi
lea eax, [ebp - 0x108]
mov ecx, edi
push eax
call fcn.0040d888
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450e68
leave
ret 4

Function at 0x40e7d4
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
lea ecx, [eax - 1]
push esi
mov ebx, ecx
push edi
mov edi, dword [esp + 0x1c]
mov esi, edi
sar ebx, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ecx
cmp edi, ebx
jge 0x40e830
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x30
add ecx, ebp
lea eax, [ecx - 0x30]
push eax
call fcn.0040443e
movzx eax, al
xor eax, 1
imul ecx, edi, 0x30
inc eax
add esi, eax
imul eax, esi, 0x30
add ecx, ebp
add eax, ebp
push eax
call fcn.0040b65a
mov edi, esi
cmp esi, ebx
jl 0x40e7fa
mov eax, dword [esp + 0x20]
cmp esi, ebx
jne 0x40e84f
test al, 1
jne 0x40e84f
imul eax, eax, 0x30
imul ecx, edi, 0x30
add eax, 0xffffffd0
add eax, ebp
add ecx, ebp
push eax
call fcn.0040b65a
mov edi, dword [esp + 0x1c]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x18]
push edi
push ebp
call fcn.0040e8f5
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x411a99
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x4b34c4]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push ebx
push esi
push edi
mov ebx, SysStringLen
lea ecx, [ebp - 0x64]
push ebx
call fcn.0043916c
lea eax, [ebp - 0x48]
push 0x400
push eax
call fcn.004120dc
mov esi, dword [sym.imp.kernel32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0x411ae5
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call fcn.00411e80
pop ecx
test eax, eax
je 0x411b05
lea eax, [ebp - 0x48]
push eax
push eax
call fcn.00411f80
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
call esi
call fcn.00474cc0
xor edi, edi
push edi
push str.PreDownldStatus
push edi
call fcn.004121c3
add esp, 0xc
lea ecx, [ebp - 0x64]
push ebx
call fcn.004391aa
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.004391f1
test eax, eax
jne 0x411ba1
mov ebx, 0x20019
push ebx
lea eax, [ebp - 0x48]
inc edi
push eax
lea ecx, [ebp - 0x64]
call fcn.0043920a
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.00408b63
test esi, esi
jne 0x411b90
push eax
lea ecx, [ebp - 0x80]
call fcn.0043916c
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.0043920a
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00408b63
push eax
lea ecx, [ebp - 0x80]
call fcn.004391aa
test esi, esi
jne 0x411b90
push str.VersionXmlURL
lea ecx, [ebp - 0x80]
call fcn.004391e1
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.004391f1
test eax, eax
je 0x411b3a
mov ecx, dword [ebp + 0x3b8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450e68
add ebp, 0x3bc
leave
ret

Function at 0x411f80
Capabilities:
Get common file path
Parse url

Disassembly:
sub esp, 0x644
mov eax, dword [0x4b34c4]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x654]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x65c]
push 0x3c
pop ebx
push ebx
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.004541a0
add esp, 0xc
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x250]
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x3c], eax
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
mov ebp, 0x104
test eax, eax
je 0x412032
push 0x100
lea eax, [esp + 0x154]
push eax
push ebp
lea eax, [esp + 0x58]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x26c]
push ebx
push eax
call fcn.00474cc0
lea eax, [esp + 0x70]
push 0x488208
push eax
call fcn.004547a0
add esp, 0x2c
test eax, eax
je 0x41204e
push 1
push esi
call fcn.004128da
push eax
lea eax, [esp + 0x58]
push str.jupdate__x
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x14
push edi
push ebp
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
lea eax, [esp + 0x4c]
push eax
push edi
call esi
lea eax, [esp + 0x150]
push eax
push edi
call esi
mov ecx, dword [esp + 0x650]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00450e68
add esp, 0x644
ret
Function at 0x41626a
Capabilities:
Delete file

Disassembly:
push 0x6c
mov eax, 0x47c105
call fcn.00450edb
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
inc ebx
push ebx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], esi
call fcn.00425c61
mov ecx, eax
call fcn.00425e91
test al, al
je 0x4162f3
push str.Verify_integrity_of___s__file_from___s_...
lea ecx, [ebp - 0x28]
call fcn.004038cc
and dword [ebp - 4], 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00474cc0
add esp, 0x10
push eax
push str.CheckFileIntegrity
push 0x95
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u381_237_install_src_windows_wrappers_common_UpdateUtils.cpp
push ebx
mov byte [ebp - 4], bl
call fcn.00425c61
mov ecx, eax
call fcn.00425e9d
lea ecx, [ebp - 0x58]
call fcn.004063d7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004063d7
test esi, esi
je 0x416300
push esi
call fcn.0042801c
pop ecx
mov ebx, eax
push edi
push 0xffffffffffffffff
call fcn.00474cc0
mov esi, eax
pop ecx
pop ecx
test ebx, ebx
je 0x416318
test esi, esi
je 0x41639b
push edi
push 0
call fcn.00474cc0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41639b
push edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 3
call fcn.00425c61
mov ecx, eax
call fcn.00425e91
test al, al
je 0x41639b
push str.Integrity_verification_failed_for___s_
lea ecx, [ebp - 0x40]
call fcn.004038cc
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00474cc0
add esp, 0xc
push eax
push str.CheckFileIntegrity
push 0xac
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u381_237_install_src_windows_wrappers_common_UpdateUtils.cpp
push 3
mov byte [ebp - 4], 3
call fcn.00425c61
mov ecx, eax
call fcn.00425e9d
lea ecx, [ebp - 0x70]
call fcn.004063d7
lea ecx, [ebp - 0x40]
call fcn.004063d7
mov eax, esi
call fcn.00450e8a
ret
Function at 0x41b0e6
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x68
mov eax, 0x47ced5
call fcn.00450edb
mov esi, dword [ebp + 8]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x60], esi
cmp dword [ebp + 0x10], ecx
jne 0x41b115
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
jmp 0x41b232
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], ecx
push eax
push ecx
push 0x40000001
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x41b23a
xor ecx, ecx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], 2
test eax, eax
jne 0x41b15d
mov dword [ebp - 0x18], eax
mov byte [ebp + eax - 0x28], cl
jmp 0x41b167
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00474cc0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x5c]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x40000001
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x41b1bb
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00474cc0
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push str.binary2string__phase2__failed__sysError
push eax
call fcn.00474cc0
add esp, 0x18
mov byte [ebp - 4], 4
jmp 0x41b266
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x18]
ja 0x41b1d7
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x41b1e5
sub ecx, dword [ebp - 0x18]
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00474cc0
and dword [esi], 0
lea eax, [ebp - 0x28]
and dword [esi + 0x10], 0
mov ecx, esi
and dword [esi + 0x14], 0
push eax
call fcn.00406263
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x41b232
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ecx
cmp eax, 0x1000
jb 0x41b229
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004055a1
mov eax, dword [ebp - 0x64]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x60]
push eax
push ecx
call fcn.00474cc0
pop ecx
pop ecx
mov eax, esi
call fcn.00450e8a
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00474cc0
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.00474cc0
add esp, 0x18
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x70]
call fcn.00474cc0
push 0x4a64a0
lea eax, [ebp - 0x70]
push eax
call fcn.00474cc0
int3
Function at 0x41b27e
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x54
mov eax, 0x47cf11
call fcn.00450edb
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push eax
push 1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], ecx
push eax
movlpd qword [ebp - 0x48], xmm0
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x41b2f1
push dword [ebp - 0x48]
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00411960
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [esi]
call fcn.00453c20
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, esi
call fcn.00450e8a
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00474cc0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push str.decryption_failed__sysError
push eax
call fcn.00474cc0
add esp, 0x18
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00474cc0
push 0x4a64a0
lea eax, [ebp - 0x60]
push eax
call fcn.00474cc0
int3

Function at 0x41b41b
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x54
mov eax, 0x47cf11
call fcn.00450edb
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
xor eax, eax
push 5
inc eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 0x14], eax
pop ecx
cmove eax, ecx
movlpd qword [ebp - 0x48], xmm0
lea ecx, [ebp - 0x48]
push ecx
push eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x41b499
push dword [ebp - 0x48]
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00411960
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [esi]
call fcn.00453c20
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, esi
call fcn.00450e8a
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00474cc0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push str.encryption_failed__sysError
push eax
call fcn.00474cc0
add esp, 0x18
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00474cc0
push 0x4a64a0
lea eax, [ebp - 0x60]
push eax
call fcn.00474cc0
int3
Function at 0x41b537
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x6c
mov eax, 0x47cfb9
call fcn.00450edb
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x74], edi
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x74], ecx
cmp dword [ecx], esi
jne 0x41b565
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
jmp 0x41b663
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
mov dword [ebp - 0x5c], esi
jb 0x41b572
mov eax, dword [ebx]
push esi
push esi
lea edx, [ebp - 0x5c]
push edx
push esi
push 1
push dword [ecx]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x41b66b
mov esi, dword [ebp - 0x5c]
xor eax, eax
and dword [ebp - 0x68], eax
and dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], eax
test esi, esi
je 0x41b5da
cmp esi, 0x7fffffff
ja 0x41b6ac
push esi
cmp esi, 0x1000
jb 0x41b5ba
call fcn.00402e37
jmp 0x41b5bf
call fcn.00474cc0
pop ecx
add esi, eax
mov dword [ebp - 0x70], eax
push esi
push eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], esi
call fcn.004119fb
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov dword [ebp - 0x68], esi
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 4], 2
jb 0x41b5e9
mov ebx, dword [ebx]
push 0
push 0
lea ecx, [ebp - 0x5c]
push ecx
push eax
mov eax, dword [ebp - 0x74]
push 1
push dword [eax]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x41b643
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00474cc0
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push str.string2binary__phase2__failed__sysError
push eax
call fcn.00474cc0
add esp, 0x18
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00474cc0
push 0x4a64a0
lea eax, [ebp - 0x1c]
jmp 0x41b6a6
lea eax, [ebp - 0x5d]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x6c]
call fcn.0041afd1
mov eax, dword [ebp - 0x6c]
mov dword [edi], eax
mov eax, dword [ebp - 0x68]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x64]
mov dword [edi + 8], eax
mov eax, edi
call fcn.00450e8a
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00474cc0
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], esi
push str.string2binary__phase1__failed__sysError
push eax
call fcn.00474cc0
add esp, 0x18
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00474cc0
push 0x4a64a0
lea eax, [ebp - 0x6c]
push eax
call fcn.00474cc0
call fcn.00410dc1
int3

Function at 0x41cfe8
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 4], 0
je 0x41cff9
push 0
push dword [ecx + 4]
call dword [sym.imp.user32.dll_ShowWindow]
ret
Function at 0x4290db
Capabilities:
Check http status code

Disassembly:
push 0x80
mov eax, 0x47ecf4
call fcn.00450edb
mov edi, ecx
push 0xffffffffffffffff
push 0x13
call fcn.0042ac71
mov esi, eax
cmp esi, 0xc8
je 0x4291a5
cmp esi, 0xce
je 0x4291a5
cmp esi, 0x193
jne 0x429164
push 0x486974
lea ecx, [ebp - 0x28]
call fcn.004038cc
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
push 0x14
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.0042afd3
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004063d7
push 0
push str.Export_Denied
lea ecx, [ebp - 0x40]
call fcn.0040d2aa
cmp eax, 0xffffffff
jne 0x4291ab
or dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
call fcn.0040401f
push esi
lea ecx, [ebp - 0x8c]
call fcn.00474cc0
mov esi, eax
push 0x2ce
push str.HttpConnection::Response::checkStatus
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u381_237_install_src_windows_common_NetUtils.cpp
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 4
call fcn.00403a94
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.00474cc0
add esp, 0xc
push 0x4a97a4
jmp 0x4291e6
call fcn.00450e8a
ret
lea ecx, [ebp - 0x8c]
call fcn.00428b1a
mov esi, eax
push 0x2cb
push str.HttpConnection::Response::checkStatus
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u381_237_install_src_windows_common_NetUtils.cpp
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.00403a94
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.00474cc0
add esp, 0xc
push 0x4a9804
lea eax, [ebp - 0x6c]
push eax
call fcn.00474cc0
int3