joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b85e
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x9c
mov eax, 0x477490
call fcn.004492cf
mov esi, edx
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x42b879
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x42b916
cmp dword [0x4ad0bc], 0
jg 0x42b90e
sub esp, 0x18
xor edi, edi
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.00404b71
push ecx
push ecx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], edi
call fcn.00403eb7
mov edx, str.Deleted__
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.00406a62
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.00405499
mov esi, eax
mov edx, str.__file
mov ecx, esi
call fcn.00406a62
push esi
push str.FileUtils::_anonymous_namespace::deleteFileImpl
push 0x25e
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
push edi
mov ecx, 0x4ad0bc
call fcn.00402d4b
lea ecx, [ebp - 0xa8]
call fcn.00402bf1
mov al, 1
call fcn.00449298
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42b90e
cmp eax, 3
je 0x42b90e
xor al, al
jmp 0x42b910
Function at 0x42b92a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, edi
call fcn.0042b85e
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, al
mov byte [esp + 0x17], bl
call ebp
test bl, bl
jne 0x42bae9
xor ebx, ebx
cmp eax, 5
jne 0x42badd
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x42b96e
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 5
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
jne 0x42b991
xor al, al
jmp 0x42baed
test al, 1
je 0x42badd
and eax, 0xfffffffe
mov ecx, edi
cmp dword [edi + 0x14], 0x10
jb 0x42b9a6
mov ecx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push ecx
call esi
test eax, eax
je 0x42ba2d
cmp dword [0x4ad0bc], ebx
jg 0x42ba21
sub esp, 0x18
mov ecx, esp
push edi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404b71
push ecx
push ecx
lea ecx, [esp + 0x48]
call fcn.00403eb7
mov edx, str.Discarded_R_O_attribute_from__
lea ecx, [esp + 0x40]
call fcn.00406a62
lea ecx, [esp + 0x40]
call fcn.00405499
mov esi, eax
mov edx, str.__file
mov ecx, esi
call fcn.00406a62
push esi
push str.FileUtils::deleteFile
push 0x276
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
push ebx
mov ecx, 0x4ad0bc
call fcn.00402d4b
lea ecx, [esp + 0x28]
call fcn.00402bf1
mov edx, edi
call fcn.0042b85e
jmp 0x42bad9
cmp dword [0x4ad0bc], 2
jg 0x42bacd
push str.System_error
call ebp
push eax
push esi
sub esp, 0x18
mov ecx, esp
push edi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404b71
push ecx
push ecx
lea ecx, [esp + 0x54]
call fcn.00403eb7
mov edx, str.Failed_to_discard_R_O_attribute_from__
lea ecx, [esp + 0x4c]
call fcn.00406a62
lea ecx, [esp + 0x4c]
call fcn.00405499
mov esi, eax
mov edx, str.__file._File_will_not_be_deleted
mov ecx, esi
call fcn.00406a62
push esi
lea ecx, [esp + 0x2c]
call fcn.00436384
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 4]
push eax
push str.FileUtils::deleteFile
push 0x27c
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
push 2
mov ecx, 0x4ad0bc
call fcn.00402d95
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], vtable.std::exception.0
push eax
call fcn.0044a323
pop ecx
lea ecx, [esp + 0x28]
call fcn.00402bf1
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [esp + 0x17]
test al, al
jne 0x42bae9
call ebp
cmp eax, 2
je 0x42bae9
cmp eax, 3
jne 0x42baeb
mov bl, 1
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bbab
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
push ebx
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x42bbc5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne cl
xor ebx, ebx
mov byte [esp + 0xb], cl
test eax, eax
je 0x42bc4c
cmp dword [0x4ad0bc], ebx
jg 0x42bc4c
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404b71
push ecx
push ecx
lea ecx, [esp + 0x30]
call fcn.00403eb7
mov edx, str.Deleted__
lea ecx, [esp + 0x28]
call fcn.00406a62
lea ecx, [esp + 0x28]
call fcn.00405499
mov esi, eax
mov edx, str.__directory
mov ecx, esi
call fcn.00406a62
push esi
push str.FileUtils::deleteDirectory
push 0x291
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
push ebx
mov ecx, 0x4ad0bc
call fcn.00402d4b
lea ecx, [esp + 0x10]
call fcn.00402bf1
mov cl, byte [esp + 0xb]
test cl, cl
jne 0x42bc60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42bc60
cmp eax, 3
jne 0x42bc62
mov bl, 1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c55e
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x477928
call fcn.00449303
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00404b71
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x3c], ebx
jb 0x42c5a5
mov eax, dword [esi]
mov ebx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call ebx
test eax, eax
je 0x42c66a
push edi
push eax
mov ecx, edi
call fcn.00418feb
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x42c5d2
mov ecx, dword [esi]
push dword [edi]
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push eax
push dword [ebp - 0x3c]
push ecx
call edi
test eax, eax
jne 0x42c660
push 0x46d
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.00402dde
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x48fc5c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00403e5a
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.00402b9d
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.00405485
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00405499
mov ecx, eax
call fcn.00405485
push eax
lea ecx, [ebp - 0x50]
call fcn.00436384
mov byte [ebp - 4], 9
jmp 0x42c6e0
mov eax, esi
call fcn.004492ad
ret 4
push 0x464
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.00402dde
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x48fc5c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00403e5a
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.00402b9d
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.00405485
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00405499
mov ecx, eax
call fcn.00405485
push eax
lea ecx, [ebp - 0x5c]
call fcn.00436384
mov byte [ebp - 4], 5
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.0041e29e
lea eax, [ebp - 0x38]
mov dword [esp], 0x4a60f4
push eax
call fcn.0044c6b7
int3

Function at 0x42e317
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0044be20
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x42eab1
Capabilities:
Get common file path

Disassembly:
push 0x2c
mov eax, 0x477e3b
call fcn.00449303
mov esi, ecx
mov dword [ebp - 0x38], esi
push ecx
push 0x104
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], esi
call fcn.00410cbc
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
cmp edx, eax
jbe 0x42eb14
lea eax, [ebp - 0x34]
push eax
push edx
mov ecx, eax
call fcn.0042597a
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00403e1c
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0042adf2
lea ecx, [ebp - 0x28]
call fcn.004049ff
lea ecx, [ebp - 0x34]
call fcn.0040c077
mov eax, esi
call fcn.004492ad
ret

Function at 0x42eb8a
Capabilities:
Get common file path

Disassembly:
push 0x208
mov eax, 0x477e81
call fcn.00449303
mov esi, ecx
mov dword [ebp - 0x160], esi
push 0x104
xor ebx, ebx
mov dword [ebp - 0x160], esi
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.0044be20
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push 0x8023
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, eax
test edi, edi
jne 0x42ec12
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
call fcn.00403e1c
lea edx, [ebp - 0x134]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.0042adf2
lea ecx, [ebp - 0x134]
call fcn.004049ff
mov eax, esi
call fcn.004492ad
ret
lea ecx, [ebp - 0x214]
call fcn.00402b9d
push edi
push ecx
push 0x489fac
sub esp, 0xc
mov dword [ebp - 4], ebx
push str.__mode
push ecx
push 0x23
push 0x412472
push str.SHGetFolderPath_0x
mov ecx, eax
call fcn.00405485
mov ecx, eax
call fcn.00412489
mov ecx, eax
call fcn.00413b79
pop ecx
mov ecx, eax
call fcn.00405485
pop ecx
mov ecx, eax
call fcn.0042f08e
pop ecx
mov ecx, eax
call fcn.00405485
pop ecx
push eax
lea ecx, [ebp - 0x17c]
call fcn.0043410b
mov edx, eax
push 0x1e4
push str.SysInfo::SHGetFolderPathAdapter
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_SysInfo.cpp
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 1
call fcn.00402dde
push eax
lea ecx, [ebp - 0x15c]
call fcn.0042f0a0
lea eax, [ebp - 0x15c]
mov dword [esp], 0x4a63f4
push eax
call fcn.0044c6b7
int3
Function at 0x42f531
Capabilities:
Create process on windows

Disassembly:
push 0x24
mov eax, 0x477ffc
call fcn.00449303
mov esi, ecx
cmp dword [0x4ad0bc], 1
jg 0x42f586
lea eax, [esi + 0x30]
mov edx, str.Executor.exec__:
push eax
lea ecx, [ebp - 0x28]
call fcn.00409fe9
pop ecx
and dword [ebp - 4], 0
mov ecx, 0x4ad0bc
push eax
push str.Executor::startExecution
push 0x93
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_Executor.cpp
push 1
call fcn.00427376
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049ff
push 0x44
pop ebx
push ebx
lea edi, [esi + 0x70]
push 0
push edi
call fcn.0044be20
add esp, 0xc
mov dword [edi], ebx
lea ebx, [esi + 0x60]
push 0x10
push 0
push ebx
call fcn.0044be20
add esp, 0xc
cmp dword [esi + 0xb4], 1
jne 0x42f5ca
or dword [esi + 0x9c], 1
xor eax, eax
mov word [esi + 0xa0], ax
mov dword [esi + 0x54], 0x8000000
cmp byte [esi + 0xc1], 0
je 0x42f5da
mov ecx, esi
call fcn.0042f95b
lea ecx, [esi + 0x30]
cmp dword [ecx + 0x14], 0x10
mov edx, ecx
jb 0x42f5e7
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x42f5f4
mov ecx, dword [ecx]
push dword [ebp - 0x2d]
xor edx, edx
push eax
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
call fcn.00410d38
lea eax, [ebp - 0x29]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x29], 0
call fcn.00411e31
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x42f62d
mov eax, dword [esi]
push ebx
push edi
push dword [esi + 0x5c]
push dword [esi + 0x58]
push dword [esi + 0x54]
push dword [esi + 0x50]
push dword [esi + 0x4c]
push dword [esi + 0x48]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.0040c077
mov al, bl
call fcn.004492ad
ret
Function at 0x4346fc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x7c
mov eax, 0x478de6
call fcn.00449303
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push esi
call fcn.00434169
xor ebx, ebx
cmp dword [ebp - 0x34], ebx
je 0x434794
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x84]
push ebx
or eax, 0x20019
push eax
lea eax, [ebp - 0x44]
push eax
push dword [edi]
call fcn.0043419b
mov esi, dword [ebp - 0x84]
add esp, 0x10
cmp dword [ebp - 0x7c], ebx
je 0x43474b
mov al, byte [ebp - 0x80]
jmp 0x434780
push ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x69], bl
push eax
mov al, byte [ebp - 0x80]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x44]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x68]
push edi
call fcn.00434337
mov ecx, eax
call fcn.004346fc
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.0043446e
mov al, byte [ebp - 0x69]
mov dword [ebp - 4], 1
test al, al
je 0x4347bb
push esi
call fcn.00437074
pop ecx
jmp 0x4347bb
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
jb 0x4347a2
mov esi, dword [esi]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4347bb
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004049ff
lea ecx, [ebp - 0x44]
call fcn.004049ff
mov al, bl
call fcn.004492ad
ret 8
Function at 0x434b24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0xac
push 0xffffffffffffffff
push 0x478f9e
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4a9068]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x78]
mov edi, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xbc]
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x20], eax
call fcn.00434169
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x88], eax
je 0x434bc1
push eax
lea eax, [ebp + 0x78]
push eax
push ebx
lea ecx, [ebp + 0x3c]
call fcn.004343d6
push dword [ebp - 0x20]
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.00434b24
lea ecx, [ebp + 0x3c]
call fcn.0043446e
jmp 0x434c39
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 2
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp ecx, edx
cmove ecx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x434bea
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push ecx
push dword [ebp - 0x20]
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x434c73
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
jne 0x434c90
test ebx, ebx
jne 0x434c94
test ecx, ecx
jne 0x434c76
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418feb
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00418fbe
lea ecx, [ebp - 0x18]
call fcn.0040c077
lea ecx, [ebp + 0x90]
call fcn.004049ff
lea ecx, [ebp + 0x78]
call fcn.004049ff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.004489ea
add ebp, 0xac
leave
ret 0xc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, eax
call fcn.00418feb
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
jmp 0x434bd2
test ebx, ebx
je 0x434c1a
push str.query_value
lea ecx, [ebp + 0x60]
call fcn.00403e1c
lea ecx, [ebp]
call fcn.00403e49
mov ecx, dword [ebp - 0x24]
push eax
push edi
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.004355a1
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 5
call fcn.00426fad
push str.System_error
push ebx
mov byte [ebp - 4], 6
lea eax, [ebp - 0xd4]
push dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x30]
push eax
call fcn.00436384
mov edx, eax
push 0x12b
push str.Registry::getValue
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.00402dde
push eax
lea ecx, [ebp + 0x18]
call fcn.0041e29e
lea eax, [ebp + 0x18]
mov dword [esp], 0x4a60f4
push eax
call fcn.0044c6b7
int3
Function at 0x43545e
Capabilities:
Delete registry value

Disassembly:
push 0x104
mov eax, 0x47915b
call fcn.00449303
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push esi
call fcn.00434169
cmp dword [ebp - 0x30], 0
je 0x4354fc
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x78]
push 0
or eax, 0x2001f
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebx]
call fcn.0043419b
mov edi, dword [ebp - 0x70]
add esp, 0x10
mov esi, dword [ebp - 0x78]
test edi, edi
je 0x4354ac
mov al, byte [ebp - 0x74]
jmp 0x4354e1
push 0x4ac119
lea eax, [ebp - 0x28]
push eax
mov al, byte [ebp - 0x74]
push ecx
push ecx
mov ecx, esp
mov byte [ecx + 4], al
lea eax, [ebp - 0x40]
push eax
mov dword [ecx], esi
lea ecx, [ebp - 0x64]
push ebx
call fcn.00434337
mov ecx, eax
call fcn.0043545e
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.0043446e
xor eax, eax
mov dword [ebp - 4], 1
test al, al
je 0x435587
push esi
call fcn.00437074
pop ecx
jmp 0x435587
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x435506
mov eax, dword [esi]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
jne 0x435587
cmp dword [0x4ad0bc], eax
jg 0x435587
push ecx
push ecx
lea ecx, [ebp - 0x110]
call fcn.00403eb7
mov edx, str.Deleted__
lea ecx, [ebp - 0x110]
call fcn.00406a62
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push esi
push eax
call fcn.0043464d
lea ecx, [ebp - 0x110]
call fcn.00405499
mov esi, eax
mov edx, str.__value
mov ecx, esi
call fcn.00406a62
push esi
push str.Registry::deleteValue
push 0x1d2
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_windows_common_Registry.cpp
push edi
mov ecx, 0x4ad0bc
call fcn.00402d4b
lea ecx, [ebp - 0x110]
call fcn.00402bf1
lea ecx, [ebp - 0x28]
call fcn.004049ff
lea ecx, [ebp - 0x40]
call fcn.004049ff
mov eax, edi
call fcn.004492ad
ret 8
Function at 0x436842
Capabilities:
Create thread

Disassembly:
push 0x70
mov eax, 0x479509
call fcn.00449303
mov edi, edx
mov esi, ecx
test edi, edi
jne 0x43685e
or dword [esi], 0xffffffff
jmp 0x4368f0
xor ebx, ebx
mov dword [ebp - 0x58], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
call fcn.00435d92
mov byte [ebp - 4], 2
lea eax, [ebp - 0x54]
or dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], edi
push eax
push 0x436827
push ebx
push ebx
mov dword [ebp - 0x40], ebx
call fcn.0045c904
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4368f8
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.00435f69
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
push 1
mov dword [ebp - 0x40], edi
call fcn.00435c83
jmp 0x4368d5
push ecx
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ecx + 8]
call fcn.00435b16
cmp dword [ebp - 0x40], 0
jne 0x4368c5
lea ecx, [ebp - 0x70]
call fcn.00435fbc
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
mov dword [esi], eax
call fcn.00435de1
mov eax, esi
call fcn.004492ad
ret
lea ecx, [ebp - 0x7c]
call fcn.00435aff
mov edx, eax
push 0x70
push str.ipc::Thread::start
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u361_3183_install_src_ipc_windows_ThreadImpl.cpp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00402dde
push eax
lea ecx, [ebp - 0x38]
call fcn.00435e2d
lea eax, [ebp - 0x38]
mov dword [esp], 0x4a6548
push eax
call fcn.0044c6b7
int3
Function at 0x43b3ac
Capabilities:
Write file on windows

Disassembly:
push 0xe8
mov eax, 0x47a505
call fcn.00449303
mov esi, ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xf4], 0x4947b8
call fcn.00403eb7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xec]
mov eax, dword [ebp - 0xec]
push 0
mov eax, dword [eax + 4]
add ecx, eax
push dword [ecx + 0xc]
mov dword [ecx + 0x10], 6
call fcn.00402a26
mov dword [ebp - 4], 2
lea eax, [ebp - 0xf4]
push dword [esi + 4]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x30], eax
call fcn.004402ab
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00404c02
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0043dcd9
cmp dword [ebp - 0x18], 0
jne 0x43b456
mov esi, 0x48ac20
push esi
call fcn.004519b0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00404a74
push ecx
push ecx
mov edx, ebx
lea ecx, [ebp - 0x3c]
call fcn.0043dc00
pop ecx
pop ecx
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x44], edi
mov byte [ebp - 0x40], cl
mov byte [ebp - 4], 4
cmp byte [ebp - 0x38], 0
je 0x43b490
cmp dword [ebp - 0x3c], 0
mov byte [ebp - 0x38], 0
je 0x43b490
push dword [ebp - 0x3c]
call fcn.0045745f
pop ecx
mov edx, ebx
test edi, edi
jne 0x43b509
lea ecx, [ebp - 0x34]
call fcn.0043dbb9
mov cl, byte [eax + 4]
mov ebx, dword [eax]
mov byte [ebp - 0x29], cl
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], cl
mov byte [ebp - 4], 5
cmp byte [ebp - 0x30], 0
je 0x43b4cd
cmp dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x30], 0
je 0x43b4cd
push dword [ebp - 0x34]
call fcn.0045b39f
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push 0x132
push esi
push eax
push ebx
call fcn.0045bc41
add esp, 0xc
mov edx, esi
mov ecx, eax
call fcn.0043c677
cmp byte [ebp - 0x29], 0
pop ecx
je 0x43b575
cmp ebx, 0xffffffff
je 0x43b575
push ebx
call fcn.0045b39f
pop ecx
jmp 0x43b575
lea eax, [ebp - 0x44]
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043dc2b
pop ecx
pop ecx
mov bl, byte [eax + 4]
mov esi, dword [eax]
mov byte [eax + 4], 0
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], bl
mov byte [ebp - 4], 6
cmp byte [ebp - 0x30], 0
je 0x43b544
cmp dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0
je 0x43b544
push dword [ebp - 0x34]
call fcn.0045745f
pop ecx
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.00457d73
add esp, 0x10
cmp eax, 1
jne 0x43b5a1
test bl, bl
je 0x43b572
test esi, esi
je 0x43b572
push esi
call fcn.0045745f
pop ecx
mov edi, dword [ebp - 0x44]
cmp byte [ebp - 0x40], 0
je 0x43b586
test edi, edi
je 0x43b586
push edi
call fcn.0045745f
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004049ff
lea ecx, [ebp - 0xec]
call fcn.00402bf1
call fcn.004492ad
ret 4
push 0x132
lea ecx, [ebp - 0x54]
call fcn.0041251e
push 0x4a6034
lea eax, [ebp - 0x54]
push eax
call fcn.0044c6b7
int3