joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e79
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x420a40]
sub esi, dword [0x420a4c]
mov edi, eax
add esi, dword [esp + 0x1c]
add edi, 0x1f4
cmp esi, ebp
jle 0x403043
push dword [0x420a48]
call fcn.00402e62
push ebp
push ebp
push dword [0x420a4c]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41ca38], esi
mov dword [0x41ca30], ebp
mov eax, dword [0x420a44]
sub eax, dword [0x420a48]
mov ebx, 0x4000
cmp eax, ebx
jg 0x402eec
mov ebx, eax
push ebx
mov esi, 0x41ca40
push esi
call fcn.00402e30
test eax, eax
je 0x40304e
add dword [0x420a48], ebx
mov dword [0x4149c0], esi
mov dword [0x4149c4], ebx
cmp dword [0x42a5ac], ebp
je 0x402f7d
cmp dword [0x42a640], ebp
jne 0x402f7d
cmp dword [esp + 0x10], ebp
je 0x402f4a
mov eax, dword [0x41ca38]
sub eax, dword [0x420a40]
push ebp
sub eax, dword [esp + 0x20]
add eax, dword [0x420a4c]
mov dword [0x41ca30], eax
call fcn.00405b68
jmp 0x402f7d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x402f7d
mov eax, dword [0x42a5a4]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402d7d
push ebp
push 0x6f
push dword [0x42a5a8]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [esp + 0x10], eax
mov ecx, 0x4149a8
mov dword [0x4149c8], 0x414a30
mov dword [0x4149cc], 0x8000
call fcn.004066b8
test eax, eax
jl 0x403057
mov esi, dword [0x4149c8]
mov eax, 0x414a30
sub esi, eax
je 0x402fe8
push ebp
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403053
cmp esi, dword [esp + 0x14]
jne 0x403053
add dword [0x420a4c], esi
cmp dword [0x4149c4], ebp
jne 0x402f12
jmp 0x402ff4
cmp dword [0x4149c4], ebp
jne 0x403057
cmp ebx, ebp
je 0x403057
mov eax, dword [0x420a40]
mov ecx, eax
sub ecx, dword [0x420a4c]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x402ed6
push ebp
push ebp
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x403043
mov eax, dword [0x41ca38]
push ebp
push ebp
push 0x113
push esi
mov dword [0x41ca30], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x403045
push 0xfffffffffffffffe
jmp 0x403059
push 0xfffffffffffffffd
pop eax
jmp 0x403045
Function at 0x40305c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x403088
mov ecx, dword [0x42a5f8]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x420a40], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402e79
cmp eax, edi
jl 0x403181
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x40317d
cmp dword [ebp - 4], esi
jne 0x40317d
push dword [ebp + 8]
add dword [0x420a40], esi
call fcn.00402e79
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403180
cmp dword [ebp + 0x10], edi
jne 0x40314c
cmp dword [ebp + 8], edi
jle 0x403178
mov esi, 0x41ca40
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x4030fc
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x40317d
cmp edi, dword [ebp - 4]
jne 0x40317d
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403148
cmp dword [ebp + 0x14], edi
jne 0x403148
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x420a40], eax
cmp dword [ebp + 8], 0
jg 0x4030ef
jmp 0x403178
push 0xfffffffffffffffe
jmp 0x40317f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403157
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x40317d
mov eax, dword [ebp - 4]
add dword [0x420a40], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403180
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x405666
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x425298
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x425298], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4056a1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405854
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405871
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405874
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x4058a3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x408924]
mov dword [ebp - 8], eax
mov eax, dword [0x408928]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4058f3
test edi, edi
jne 0x4058b0
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x4058ed

Function at 0x4058f7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push edi
push dword [ebp + 0xc]
mov word [esi], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40596b
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x800
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405958
cmp dword [ebp + 0x14], 1
je 0x40595b
cmp dword [ebp + 0x14], 2
je 0x40595b
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x7fe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x405f86
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4252e0
push esi
call fcn.00405a2a
push esi
call fcn.00405781
mov edi, eax
test edi, edi
jne 0x405fa7
xor eax, eax
jmp 0x406005
push edi
call fcn.00405a59
test byte [0x42a604], 0x80
je 0x405fc4
mov ax, word [edi]
test ax, ax
je 0x405fa3
cmp ax, 0x5c
je 0x405fa3
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x405fe6
push esi
call fcn.00405b0a
test eax, eax
je 0x405fe0
test byte [eax], 0x10
je 0x40600a
push esi
call fcn.00405f5a
push esi
call ebx
cmp eax, edi
jg 0x405fd1
push esi
call fcn.00405f2b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x406004
Function at 0x406262
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x408a0c
mov ebx, 0x425ae0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x400
je 0x4062b0
push 1
push ebp
push edi
call fcn.00405874
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406427
cmp eax, esi
jg 0x406427
push esi
mov edi, 0x427930
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x406427
cmp eax, esi
jg 0x406427
push ebp
push ebp
push esi
push 0x4262e0
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x406427
push ebp
push ebp
push esi
mov esi, 0x426930
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x406427
push esi
push 0x4262e0
push str._s_s_r_n
push 0x426d30
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42a5ac]
push dword [eax + 0x128]
push edi
call fcn.0040600e
push 4
push 0xc0000000
push edi
call fcn.00405874
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x406427
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x40641d
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40641d
cmp edi, dword [esp + 0x10]
jne 0x40641d
push str._Rename__r_n
push esi
call fcn.004057de
cmp eax, ebp
jne 0x4063b4
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4063e5
push 0x408a00
add eax, 0xa
push eax
call fcn.004057de
mov ebp, eax
test ebp, ebp
je 0x4063e3
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4063d6
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4063d0
sub ebp, esi
inc ebp
mov eax, ebp
xor ebp, ebp
jmp 0x4063e7
xor ebp, ebp
mov eax, edi
push ebx
push 0x426d30
add eax, esi
push eax
call fcn.00405834
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x406460
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405f86
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 0xc], eax
je 0x406495
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a628], eax
jmp 0x40662a
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x4064b0
test eax, eax
je 0x4065d5
test cl, 2
je 0x4065d5
push edi
push ebx
mov esi, 0x427130
push esi
call fcn.00405a2a
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4064d3
push str..
push esi
call edi
jmp 0x4064d9
push ebx
call fcn.00405f5a
push 0x4082c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4065c5
lea esi, [ebp - 0x230]
push 0x3f
mov eax, esi
push eax
call fcn.0040572b
xor edi, edi
cmp word [eax], di
je 0x406528
cmp word [ebp - 0x28], di
je 0x406528
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x406543
mov ax, word [esi + 2]
cmp ax, di
je 0x4065a2
cmp ax, 0x2e
jne 0x406543
cmp word [esi + 4], di
je 0x4065a2
push esi
push dword [ebp - 4]
call fcn.00405a2a
test byte [ebp - 0x25c], 0x10
je 0x40656a
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4065a2
push dword [ebp + 0xc]
push ebx
call fcn.00406460
jmp 0x4065a2
push ebx
call fcn.00405854
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40659a
test byte [ebp + 0xc], 4
je 0x406592
push ebx
push 0xfffffffffffffff1
call fcn.00404a6c
push edi
push ebx
call fcn.0040642d
jmp 0x4065a2
inc dword [0x42a628]
jmp 0x4065a2
push ebx
push 0xfffffffffffffff2
call fcn.00404a6c
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406508
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4065c7
xor edi, edi
cmp dword [ebp + 8], edi
pop edi
je 0x4065d5
mov eax, dword [ebp - 4]
and word [eax - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406629
cmp dword [ebp - 0xc], esi
jne 0x4065e9
inc dword [0x42a628]
jmp 0x406629
push ebx
call fcn.00405b0a
test eax, eax
je 0x406629
push ebx
call fcn.00405f2b
push ebx
call fcn.00405854
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x406621
test byte [ebp + 0xc], 4
je 0x4065e1
push ebx
push 0xfffffffffffffff1
call fcn.00404a6c
push esi
push ebx
call fcn.0040642d
jmp 0x406629
push ebx
push 0xffffffffffffffe5
call fcn.00404a6c
pop esi
pop ebx
leave
ret 8
Function at 0x40662f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x428134], 0
push esi
jne 0x406666
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406640
mov dword [ecx*4 + 0x428130], eax
inc ecx
cmp ecx, 0x100
jl 0x40663b
mov esi, dword [esp + 0x10]
test esi, esi
mov eax, dword [esp + 8]
not eax
jbe 0x406692
mov ecx, dword [esp + 0xc]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x428130]
inc ecx
dec esi
jne 0x406678
not eax
pop esi
ret 0xc

Function at 0x4038f2
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x41bcb0
call 0x405abc
mov edi, 0x94
mov eax, edi
call 0x403370
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x423810], ecx
mov eax, dword [esi + 4]
mov dword [0x42381c], eax
mov edx, dword [esi + 8]
mov dword [0x423820], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x423814], esi
cmp ecx, 2
je 0x403952
or esi, 0x8000
mov dword [0x423814], esi
shl eax, 8
add eax, edx
mov dword [0x423818], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40398d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40398d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4039a5
cmp eax, 0x20b
je 0x403992
mov dword [ebp - 0x1c], esi
jmp 0x4039b9
cmp dword [ecx + 0x84], 0xe
jbe 0x40398d
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4039b3
cmp dword [ecx + 0x74], 0xe
jbe 0x40398d
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call 0x4072a6
pop ecx
test eax, eax
jne 0x4039cd
push 0x1c
call 0x4038ce
pop ecx
call 0x4070e5
test eax, eax
jne 0x4039de
push 0x10
call 0x4038ce
pop ecx
call 0x4065d5
mov dword [ebp - 4], esi
call 0x4087c7
test eax, eax
jge 0x4039f7
push 0x1b
call 0x4038a9
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4250e0], eax
call 0x4086a5
mov dword [0x423854], eax
call 0x408603
test eax, eax
jge 0x403a1d
push 8
call 0x4038a9
pop ecx
call 0x4083d0
test eax, eax
jge 0x403a2e
push 9
call 0x4038a9
pop ecx
push 1
call 0x402e1e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x403a44
push eax
call 0x4038a9
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call 0x408373
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x403a65
movzx eax, word [ebp - 0x40]
jmp 0x403a68
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call 0x40f6b8
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x403a86
push edi
call 0x402f4b
call 0x402f6d
jmp 0x403ab8
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call 0x405af7
ret
Function at 0x497cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x497cca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x497cd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497cc0
mov eax, 1
add ebx, ebx
jne 0x497ce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x497cf4
jne 0x497d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d13
dec eax
add ebx, ebx
jne 0x497d00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x497cd8
add ebx, ebx
jne 0x497d0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x497d65
xor ecx, ecx
sub eax, 3
jb 0x497d2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x497d9a
sar eax, 1
mov ebp, eax
jmp 0x497d36
add ebx, ebx
jne 0x497d36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d04
inc ecx
add ebx, ebx
jne 0x497d44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d04
add ebx, ebx
jne 0x497d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x497d46
jne 0x497d62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x497d46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x497d84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x497d76
jmp 0x497cc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x497d84
add edi, ecx
jmp 0x497cc6
pop esi
mov edi, esi
mov ecx, 0x2cc1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x497da2
cmp byte [edi], 0x11
jne 0x497da2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x497da7
lea edi, [esi + 0x94000]
mov eax, dword [edi]
or eax, eax
je 0x497e1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c254]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9c36c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x497dd4
mov ecx, edi
jns 0x497e03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9c370]
or eax, eax
je 0x497e19
mov dword [ebx], eax
add ebx, 4
jmp 0x497df1
call dword [esi + 0x9c380]
mov ebp, dword [esi + 0x9c374]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x497e53
sub esp, 0xffffff80
jmp 0x454d5d
Function at 0x40bc83
Capabilities:
Check mutex on windows

Disassembly:
push 0xa0
mov eax, 0x44f35a
call fcn.0042a4ee
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
mov byte [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x40bd43
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp dword [ebp + 8], ebx
je 0x40bd3b
push 1
call fcn.0041205e
mov ecx, eax
call fcn.0041233c
test al, al
je 0x40bd3b
push 1
lea ecx, [ebp - 0xac]
call fcn.00403308
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 1
push str.finish_waiting_for_mutex:
push eax
call fcn.00402636
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0xac]
call fcn.00403d97
lea eax, [ebp - 0xac]
push eax
push str.msi::waitForInstallationCompletion
push 0x1c8
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_MsiUtils.cpp
push 1
call fcn.0041205e
mov ecx, eax
call fcn.0040712f
lea ecx, [ebp - 0xac]
call fcn.00404073
cmp edi, 0x102
je 0x40bd45
mov bl, 1
push esi
mov dword [ebp - 4], 3
call fcn.00418377
pop ecx
mov al, bl
call fcn.0042a4bc
ret
Function at 0x40c713
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x44f4a6
call fcn.0042a521
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00404453
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x3c], ebx
jb 0x40c75c
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x40c822
lea ecx, [ebp - 0x35]
push ecx
push eax
mov ecx, edi
call fcn.004075be
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x40c789
mov ecx, dword [esi]
push dword [edi]
push eax
push dword [ebp - 0x3c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40c818
push 0x487
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.004036cc
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push sub.VERSION.dll_GetFileVersionInfoA
push 0x455064
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.004033cf
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.00403810
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.00402621
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00402805
mov ecx, eax
call fcn.00402621
push eax
lea ecx, [ebp - 0x50]
call fcn.0041863a
mov byte [ebp - 4], 9
jmp 0x40c89c
mov eax, esi
call fcn.0042a4d0
ret 4
push 0x47e
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u411_893_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.004036cc
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push sub.VERSION.dll_GetFileVersionInfoSizeA
push 0x455064
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.004033cf
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.00403810
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.00402621
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00402805
mov ecx, eax
call fcn.00402621
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041863a
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004073ff
add esp, 0xc
lea eax, [ebp - 0x34]
push 0x469fa8
push eax
call fcn.0042d29c
int3