joyce8/EMBER2024-capa huggingface dataset:
Function at 0xda21f5
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0xe24244]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push ebx
push esi
push edi
mov ebx, 0x80000003
lea ecx, [ebp - 0x64]
push ebx
call fcn.00da9a04
lea eax, [ebp - 0x48]
push 0x400
push eax
call fcn.00da2e67
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0xda2241
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call fcn.00da2606
pop ecx
test eax, eax
je 0xda2261
lea eax, [ebp - 0x48]
push eax
push eax
call fcn.00da2896
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
call esi
call fcn.00da2315
xor edi, edi
push edi
push str.PreDownldStatus
push edi
call fcn.00da2f80
add esp, 0xc
lea ecx, [ebp - 0x64]
push ebx
call fcn.00da9a42
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.00da9a89
test eax, eax
jne 0xda22fd
mov ebx, 0x20019
push ebx
lea eax, [ebp - 0x48]
inc edi
push eax
lea ecx, [ebp - 0x64]
call fcn.00da9aa2
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.00d9528e
test esi, esi
jne 0xda22ec
push eax
lea ecx, [ebp - 0x80]
call fcn.00da9a04
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.00da9aa2
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00d9528e
push eax
lea ecx, [ebp - 0x80]
call fcn.00da9a42
test esi, esi
jne 0xda22ec
push str.VersionXmlURL
lea ecx, [ebp - 0x80]
call fcn.00da9a79
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.00da9a89
test eax, eax
je 0xda2296
mov ecx, dword [ebp + 0x3b8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00dd0ce3
add ebp, 0x3bc
leave
ret

Function at 0xda2896
Capabilities:
Get common file path
Parse url

Disassembly:
sub esp, 0x644
mov eax, dword [0xe24244]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x654]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x65c]
push 0x3c
pop ebx
push ebx
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.00dd2690
add esp, 0xc
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x250]
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x3c], eax
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov ebp, 0x104
test eax, eax
je 0xda2948
push 0x100
lea eax, [esp + 0x154]
push eax
push ebp
lea eax, [esp + 0x58]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x26c]
push ebx
push eax
call fcn.00ddb9aa
lea eax, [esp + 0x70]
push 0xe01868
push eax
call fcn.00dd27f0
add esp, 0x2c
test eax, eax
je 0xda2964
push 1
push esi
call fcn.00da3168
push eax
lea eax, [esp + 0x58]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x4c]
push eax
push edi
call esi
lea eax, [esp + 0x150]
push eax
push edi
call esi
mov ecx, dword [esp + 0x650]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00dd0ce3
add esp, 0x644
ret
Function at 0xda299e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0xe24244]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, 0x9c
lea eax, [ebp - 0x28]
push esi
push 0
push eax
call fcn.00dd2690
add esp, 0xc
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0xda29ec
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x94
push eax
call esi
test eax, eax
je 0xda2a08
cmp dword [ebp - 0x18], 2
jne 0xda2a05
cmp dword [ebp - 0x24], 6
jae 0xda2a05
cmp dword [ebp - 0x24], 4
jb 0xda2a05
call fcn.00da2a5e
jmp 0xda2a08
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.00dd0ce3
add ebp, 0x78
leave
ret
Function at 0xda4e69
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0xe24244]
xor eax, ebp
mov dword [ebp + 0x38c], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x398]
lea eax, [ebp - 0x78]
push eax
push 1
xor ebx, ebx
mov dword [ebp - 0x7c], 0x400
push ebx
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xda4f3d
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x74], bl
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.TransferJobID
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], ebx
jbe 0xda4f3d
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0xda4f3d
lea eax, [ebp - 0x74]
push eax
call fcn.00dd6690
pop ecx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jg 0xda4f1d
lea eax, [esi + esi]
call fcn.00dd0e50
mov eax, esp
lea ecx, [ebp - 0x74]
push 3
push esi
push ecx
push eax
call fcn.00d9444b
mov ebx, eax
push edi
push ebx
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x10
push 0xe0a810
push edi
call fcn.00dd309e
add esp, 0xc
test eax, eax
je 0xda4f3d
xor eax, eax
jmp 0xda4f42
mov eax, 0x80004005
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x38c]
xor ecx, ebp
call fcn.00dd0ce3
add ebp, 0x390
leave
ret
Function at 0xda6b4c
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x68
mov eax, 0xdf7889
call fcn.00dd0d56
mov esi, dword [ebp + 8]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x60], esi
cmp dword [ebp + 0x10], ecx
jne 0xda6b7b
mov dword [esi], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
jmp 0xda6c98
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], ecx
push eax
push ecx
push 0x40000001
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0xda6ca0
xor ecx, ecx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], 2
test eax, eax
jne 0xda6bc3
mov dword [ebp - 0x18], eax
mov byte [ebp + eax - 0x28], cl
jmp 0xda6bcd
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00d9e961
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x5c]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x40000001
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0xda6c21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00da7118
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push str.binary2string__phase2__failed__sysError
push eax
call fcn.00d929da
add esp, 0x18
mov byte [ebp - 4], 4
jmp 0xda6ccc
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x18]
ja 0xda6c3d
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0xda6c4b
sub ecx, dword [ebp - 0x18]
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00d9e961
and dword [esi], 0
lea eax, [ebp - 0x28]
and dword [esi + 0x10], 0
mov ecx, esi
and dword [esi + 0x14], 0
push eax
call fcn.00d98316
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0xda6c98
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ecx
cmp eax, 0x1000
jb 0xda6c8f
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00d97ee8
mov eax, dword [ebp - 0x64]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x60]
push eax
push ecx
call fcn.00dd0879
pop ecx
pop ecx
mov eax, esi
call fcn.00dd0d05
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00da7118
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.00d929da
add esp, 0x18
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x70]
call fcn.00d933a6
push 0xe1a77c
lea eax, [ebp - 0x70]
push eax
call fcn.00dd2add
int3
Function at 0xda6ce4
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x54
mov eax, 0xdf78c5
call fcn.00dd0d56
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push eax
push 1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], ecx
push eax
movlpd qword [ebp - 0x48], xmm0
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0xda6d57
push dword [ebp - 0x48]
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00da2080
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [esi]
call fcn.00dd2110
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
call fcn.00dd0d05
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00da7118
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push str.decryption_failed__sysError
push eax
call fcn.00d929da
add esp, 0x18
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00d933a6
push 0xe1a77c
lea eax, [ebp - 0x60]
push eax
call fcn.00dd2add
int3

Function at 0xda6e81
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x54
mov eax, 0xdf78c5
call fcn.00dd0d56
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
xor eax, eax
push 5
inc eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 0x14], eax
pop ecx
cmove eax, ecx
movlpd qword [ebp - 0x48], xmm0
lea ecx, [ebp - 0x48]
push ecx
push eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0xda6eff
push dword [ebp - 0x48]
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00da2080
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [esi]
call fcn.00dd2110
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
call fcn.00dd0d05
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00da7118
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push str.encryption_failed__sysError
push eax
call fcn.00d929da
add esp, 0x18
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00d933a6
push 0xe1a77c
lea eax, [ebp - 0x60]
push eax
call fcn.00dd2add
int3
Function at 0xda6f9d
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x6c
mov eax, 0xdf796d
call fcn.00dd0d56
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x74], edi
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x74], ecx
cmp dword [ecx], esi
jne 0xda6fcb
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
jmp 0xda70c9
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
mov dword [ebp - 0x5c], esi
jb 0xda6fd8
mov eax, dword [ebx]
push esi
push esi
lea edx, [ebp - 0x5c]
push edx
push esi
push 1
push dword [ecx]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0xda70d1
mov esi, dword [ebp - 0x5c]
xor eax, eax
and dword [ebp - 0x68], eax
and dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], eax
test esi, esi
je 0xda7040
cmp esi, 0x7fffffff
ja 0xda7112
push esi
cmp esi, 0x1000
jb 0xda7020
call fcn.00d92af6
jmp 0xda7025
call fcn.00dd0849
pop ecx
add esi, eax
mov dword [ebp - 0x70], eax
push esi
push eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], esi
call fcn.00da211b
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov dword [ebp - 0x68], esi
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 4], 2
jb 0xda704f
mov ebx, dword [ebx]
push 0
push 0
lea ecx, [ebp - 0x5c]
push ecx
push eax
mov eax, dword [ebp - 0x74]
push 1
push dword [eax]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0xda70a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00da7118
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push str.string2binary__phase2__failed__sysError
push eax
call fcn.00d929da
add esp, 0x18
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00d933a6
push 0xe1a77c
lea eax, [ebp - 0x1c]
jmp 0xda710c
lea eax, [ebp - 0x5d]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x6c]
call fcn.00da69a1
mov eax, dword [ebp - 0x6c]
mov dword [edi], eax
mov eax, dword [ebp - 0x68]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x64]
mov dword [edi + 8], eax
mov eax, edi
call fcn.00dd0d05
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00da7118
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], esi
push str.string2binary__phase1__failed__sysError
push eax
call fcn.00d929da
add esp, 0x18
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00d933a6
push 0xe1a77c
lea eax, [ebp - 0x6c]
push eax
call fcn.00dd2add
call fcn.00d9e938
int3
Function at 0xda9642
Capabilities:
Get common file path

Disassembly:
sub esp, 0xa0c
mov eax, dword [0xe24244]
xor eax, esp
mov dword [esp + 0xa08], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa1c]
lea eax, [esp + 0x110]
push edi
mov ebp, 0x104
xor ebx, ebx
push ebp
push ebx
push eax
call fcn.00dd2690
add esp, 0xc
lea eax, [esp + 0x114]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0xda97d7
cmp edi, ebp
ja 0xda97d7
push ebp
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00dd2690
push esi
lea eax, [esp + 0x124]
push eax
push 0xe00118
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.00d99cd1
add esp, 0x24
test eax, eax
jg 0xda9738
mov esi, 0x800
lea eax, [esp + 0x218]
push esi
push ebx
push eax
call fcn.00dd2690
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._snprintf_failed.__ErrorCode:__d
push 0xffffffffffffffff
lea eax, [esp + 0x224]
push esi
push eax
call fcn.00d99cd1
add esp, 0x14
cmp eax, esi
jae 0xda9868
push 3
mov byte [esp + eax + 0x21c], bl
call fcn.00da85e3
mov ecx, eax
call fcn.00da879e
test al, al
je 0xda984d
lea eax, [esp + 0x218]
push eax
push str.JRE_System_LoadLibrary
push 0x50
jmp 0xda983a
cmp eax, ebp
jae 0xda9868
mov byte [esp + eax + 0x10], bl
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0xda97d3
mov esi, 0x800
lea eax, [esp + 0x218]
push esi
push ebx
push eax
call fcn.00dd2690
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push eax
push str.LoadLibrary__s__failed.__ErrorCode:__d
push 0xffffffffffffffff
lea eax, [esp + 0x228]
push esi
push eax
call fcn.00d99cd1
add esp, 0x18
cmp eax, esi
jae 0xda9868
push 3
mov byte [esp + eax + 0x21c], bl
call fcn.00da85e3
mov ecx, eax
call fcn.00da879e
test al, al
je 0xda97d3
lea eax, [esp + 0x218]
push eax
push str.JRE_System_LoadLibrary
push 0x5a
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u391_514_install_src_windows_common_AllUtils.cpp
push 3
call fcn.00da85e3
mov ecx, eax
call fcn.00d988a5
mov eax, edi
jmp 0xda984f
mov esi, 0x800
lea eax, [esp + 0x218]
push esi
push ebx
push eax
call fcn.00dd2690
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.GetSystemDirectory_failed.__Return_Code:__d__ErrorCode:__d
push 0xffffffffffffffff
lea eax, [esp + 0x228]
push esi
push eax
call fcn.00d99cd1
add esp, 0x18
cmp eax, esi
jae 0xda9868
push 3
mov byte [esp + eax + 0x21c], bl
call fcn.00da85e3
mov ecx, eax
call fcn.00da879e
test al, al
je 0xda984d
lea eax, [esp + 0x218]
push eax
push str.JRE_System_LoadLibrary
push 0x46
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u391_514_install_src_windows_common_AllUtils.cpp
push 3
call fcn.00da85e3
mov ecx, eax
call fcn.00d988a5
xor eax, eax
mov ecx, dword [esp + 0xa18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00dd0ce3
add esp, 0xa0c
ret
call fcn.00dd0bff
int3
Function at 0xda9ad9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0xdf7fc4
call fcn.00dd0d23
mov ebx, ecx
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0xda9b5c
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov ecx, edi
lea eax, [ebp - 0x20]
push eax
call fcn.00da9a17
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0xda9b58
mov eax, dword [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
cmp eax, 0x1000
jb 0xda9b4f
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00d97ee8
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.00dd0879
pop ecx
pop ecx
mov eax, esi
jmp 0xda9b81
lea eax, [ebp + 0xf]
push eax
push dword [ebp - 0x10]
lea ecx, [edi + 4]
call fcn.00da69a1
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
push edi
push 0
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call fcn.00dd0cf1
ret 8
Function at 0xdad82a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00dd2690
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret

Function at 0xdaf0cf
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0xe24244]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push esi
lea ecx, [ebp - 0x34]
call fcn.00daed43
cmp dword [ebp - 0x24], 0
je 0xdaf166
mov eax, dword [ebx + 8]
mov esi, 0xe0b418
push 0
or eax, 0x2001f
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebx]
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.00dafcda
mov edi, dword [ebp - 0x64]
add esp, 0x18
test edi, edi
jne 0xdaf159
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x6c]
push ecx
push ecx
mov ecx, esp
push ebx
mov dword [ecx], eax
mov al, byte [ebp - 0x68]
mov byte [ecx + 4], al
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x68], 0
call fcn.00daed7a
mov ecx, eax
call fcn.00daf0cf
lea ecx, [ebp - 0x58]
mov edi, eax
call fcn.00daeffb
lea ecx, [ebp - 0x6c]
call fcn.00daefb1
jmp 0xdaf1fe
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0xdaf170
mov eax, dword [esi]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
jne 0xdaf1fe
push eax
call fcn.00da85e3
mov ecx, eax
call fcn.00da879e
test al, al
je 0xdaf1fe
push 1
lea ecx, [ebp - 0x104]
call fcn.00d92e8f
lea eax, [ebp - 0x104]
push str.Deleted__
push eax
call fcn.00d927d5
sub esp, 0x10
mov ecx, ebx
mov eax, esp
push esi
push eax
call fcn.00daf394
lea ecx, [ebp - 0x104]
call fcn.00d9ae4d
mov esi, eax
push str.__value
push esi
call fcn.00d927d5
pop ecx
pop ecx
push esi
push str.Registry::deleteValue
push 0x1d2
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u391_514_install_src_windows_common_Registry.cpp
push edi
call fcn.00da85e3
mov ecx, eax
call fcn.00d9f39a
lea ecx, [ebp - 0x104]
call fcn.00d93981
lea ecx, [ebp - 0x1c]
call fcn.00d983fa
lea ecx, [ebp - 0x34]
call fcn.00d983fa
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00dd0ce3
leave
ret 8
Function at 0xdaf853
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0xac
push 0xffffffffffffffff
push 0xdf8d8a
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0xe24244]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x78]
mov ebx, dword [ebp + 0xb8]
mov eax, dword [ebp + 0xbc]
mov dword [ebp - 0x18], esi
push ebx
mov dword [ebp - 0x18], eax
call fcn.00daed43
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x88], eax
je 0xdaf8f3
push eax
lea eax, [ebp + 0x78]
push eax
push edi
lea ecx, [ebp + 0x3c]
call fcn.00daee92
push dword [ebp - 0x18]
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.00daf853
lea ecx, [ebp + 0x3c]
call fcn.00daeffb
jmp 0xdaf98a
mov ecx, eax
mov dword [ebp - 0x1c], eax
mov edx, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 2
mov eax, edx
sub eax, ecx
cmp ecx, edx
mov dword [ebp - 0x14], eax
sete byte [ebp - 0xd]
xor eax, eax
cmp ecx, edx
cmove ecx, eax
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0xdaf922
mov eax, dword [ebx]
lea edx, [ebp - 0x14]
push edx
push ecx
push dword [ebp - 0x18]
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov edi, eax
cmp edi, 0xea
je 0xdaf950
cmp byte [ebp - 0xd], 0
je 0xdaf968
test edi, edi
jne 0xdaf9c4
test ecx, ecx
je 0xdaf96c
lea eax, [ebp - 0xd]
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.00da69a1
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
jmp 0xdaf904
test edi, edi
jne 0xdaf9c4
lea eax, [ebp - 0xd]
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.00da69a1
mov eax, dword [ebp - 0x24]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], eax
lea ecx, [ebp + 0x90]
call fcn.00d983fa
lea ecx, [ebp + 0x78]
call fcn.00d983fa
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.00dd0ce3
add ebp, 0xac
leave
ret 0xc
push str.query_value
lea ecx, [ebp + 0x60]
call fcn.00d92f72
lea ecx, [ebp]
call fcn.00d92fc3
mov ecx, dword [ebp - 0x28]
push eax
push ebx
lea eax, [ebp + 0x60]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.00daf3c4
push eax
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 5
call fcn.00da944a
push str.System_error
push edi
push dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x38]
call fcn.00dbcd89
mov esi, eax
push 0x12b
push str.Registry::getValue
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u391_514_install_src_windows_common_Registry.cpp
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00d930f3
push eax
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.00daa246
add esp, 0xc
lea eax, [ebp + 0x18]
push 0xe1bb40
push eax
call fcn.00dd2add
int3