joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a999
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x459398
call fcn.00441e9a
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.0041a97b
mov edi, eax
test edi, edi
jne 0x41aa51
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.0041a8c6
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.00416c53
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0042a9c6
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.0041ac4a
lea eax, [ebp - 0x58]
mov dword [esp], 0x46d798
push eax
call fcn.00441a01
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x41aad5
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00405b5f
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0041a8c6
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.00416c53
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0042a9c6
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x41aa30
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x41ab05
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x41aaf6
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x41aaec
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x41ab14
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.00441f1d
ret 4
Function at 0x420e82
Capabilities:
Check http status code

Disassembly:
push 0x94
mov eax, 0x459247
call fcn.00441e9a
mov esi, ecx
push esi
push 0x13
pop ecx
call fcn.004208e0
mov dword [ebp - 0x8c], eax
cmp eax, 0xc8
je 0x420fc9
cmp eax, 0xce
je 0x420fc9
cmp eax, 0x193
jne 0x420f7c
push 0x4634c6
lea ecx, [ebp - 0x4c]
call fcn.00405b5f
push 0x14
xor edi, edi
push esi
lea ecx, [ebp - 0x4c]
lea ebx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.00420a6a
push edi
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00405e43
mov esi, str.Export_Denied
push esi
call fcn.0043b2e0
pop ecx
push eax
push esi
mov eax, ebx
push eax
xor eax, eax
call fcn.00415e07
cmp eax, 0xffffffff
je 0x420f6d
mov edi, 0x193
lea ecx, [ebp - 0xa0]
call fcn.0041eb44
mov dword [ebp - 0xa0], vtable.HttpConnection::export_compliance_error.0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x7c]
push eax
lea esi, [ebp - 0x88]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2cb
call fcn.0042332d
mov dword [esp], 0x46dae8
lea eax, [ebp - 0x7c]
push eax
call fcn.00441a01
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.00405e43
mov edi, dword [ebp - 0x8c]
lea ecx, [ebp - 0xa0]
call fcn.0041eb44
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 4
push ecx
lea esi, [ebp - 0x88]
mov ecx, eax
mov dword [ebp - 0x88], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_NetUtils.cpp
mov dword [ebp - 0x84], str.HttpConnection::Response::checkStatus
mov dword [ebp - 0x80], 0x2ce
call fcn.004232ce
mov dword [esp], 0x46da84
jmp 0x420f64
call fcn.00441f1d
ret

Function at 0x4212bf
Capabilities:
Parse url

Disassembly:
push 0x5c
mov eax, 0x4558bc
call fcn.00441e9a
push 0x38
lea eax, [ebp - 0x64]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.0043b830
xor ebx, ebx
inc ebx
add esp, 0xc
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x54], ebx
jb 0x4212f4
mov esi, dword [esi]
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x42130b
xor al, al
jmp 0x42134f
mov eax, dword [ebp - 0x5c]
push 3
pop ecx
sub eax, ecx
je 0x421320
dec eax
je 0x42131c
mov dword [edi], ebx
jmp 0x421326
mov dword [edi], ecx
jmp 0x421326
mov dword [edi], 2
push dword [ebp - 0x54]
lea esi, [ebp - 0x2c]
push dword [ebp - 0x58]
call fcn.0040aa1b
and dword [ebp - 4], 0
add edi, 4
mov esi, eax
call fcn.00405cea
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00405e43
mov al, bl
call fcn.00441f1d
ret

Function at 0x423bed
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0043b830
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x42428b
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x454e26
call fcn.00441e9a
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.00415db7
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x4242e7
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.00415db7
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405b5f
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00425869
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e43
test esi, esi
je 0x424316
push esi
call fcn.0043a3d6
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.00441f1d
ret

Function at 0x42496a
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x454537
call fcn.00441e31
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.0042493e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0042493e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0042493e
mov eax, esi
mov dword [esp], 0x409
call fcn.0042493e
pop ecx
mov eax, esi
call fcn.00441f09
ret

Function at 0x4255fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x425605
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x425615
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x42561d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x425631
test al, 0x10
je 0x425631
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x425923
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x459130
call fcn.00441e9a
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406ed3
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x42595f
mov eax, dword [ebx]
jmp 0x425961
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x425a19
push str.System_error
mov dword [ebp - 0x4c], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x461
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ed3
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.0040954f
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040b5a2
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b3c5
mov esi, eax
push 0x466a70
push esi
call fcn.0040b5a2
pop ecx
pop ecx
mov ecx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042a9c6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.0041ac4a
lea eax, [ebp - 0x3c]
mov dword [esp], 0x46d798
push eax
call fcn.00441a01
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.00410435
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x425a35
mov edx, dword [ebx]
jmp 0x425a37
mov edx, ebx
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x425ad5
push str.System_error
mov dword [ebp - 0x4c], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ed3
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.0040954f
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040b5a2
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b3c5
mov esi, eax
push 0x466a70
push esi
call fcn.0040b5a2
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042a9c6
mov byte [ebp - 4], 9
jmp 0x4259fb
mov eax, ebx
call fcn.00441f1d
ret 4
Function at 0x426c69
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45988c
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x479630]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
mov eax, dword [0x479630]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x108]
mov ebx, ecx
push eax
mov edi, esi
mov dword [esp + 0x18], ebx
call fcn.00425634
pop ecx
xor edi, edi
push esi
lea eax, [esp + 0x128]
mov dword [esp + 0x1a4], edi
call fcn.004256e8
pop ecx
xor eax, eax
inc eax
mov dword [esp + 0x1a0], eax
cmp dword [esp + 0x118], edi
je 0x426d2f
push eax
lea eax, [esp + 0x10c]
push eax
lea edi, [esp + 0x148]
call fcn.00426178
mov byte [esp + 0x1a0], 2
push dword [ebp + 0xc]
lea ecx, [esp + 0x128]
push ecx
mov ecx, eax
call fcn.00426c69
mov esi, edi
mov byte [esp + 0x1a0], 1
call fcn.004261fc
jmp 0x426e9d
cmp dword [esi + 0x14], 0x10
jb 0x426d39
mov ecx, dword [esi]
jmp 0x426d3b
mov ecx, esi
mov eax, dword [ebx]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push edi
push ecx
push eax
call ebx
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x426e29
push str.set_dword_value
lea ecx, [esp + 0xf0]
call fcn.00405b5f
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], edi
mov byte [esp + 0xd0], 0
push esi
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 4
call fcn.0042767d
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x1a0], 5
call fcn.00416c53
push str.System_error
push dword [esp + 0x1c]
mov eax, esi
push eax
mov ecx, ebx
lea edi, [esp + 0x34]
mov byte [esp + 0x1ac], 6
call fcn.0042a9c6
lea ecx, [esp + 0x168]
mov byte [esp + 0x1a0], 7
push ecx
lea esi, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x20], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Registry.cpp
mov dword [esp + 0x24], str.Registry::setDword
mov dword [esp + 0x28], 0x181
call fcn.0041ac4a
lea eax, [esp + 0x16c]
mov dword [esp], 0x46d798
push eax
call fcn.00441a01
cmp dword [0x47d500], edi
jg 0x426e9d
mov eax, dword [esp + 0x14]
mov ecx, esi
lea esi, [esp + 0xd0]
call fcn.00426434
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [esp + 0xf4]
push eax
mov byte [esp + 0x1ac], 8
call fcn.004277f5
add esp, 0xc
push str.Registry::setDword
push 0x184
push str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Registry.cpp
push edi
mov edx, eax
mov ecx, 0x47d500
mov byte [esp + 0x1b0], 9
call fcn.0041467b
push edi
push 1
lea ecx, [esp + 0xf4]
call fcn.00405e43
push edi
push 1
mov ecx, esi
call fcn.00405e43
lea esi, [esp + 0x108]
call fcn.0041e183
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0043a3e1
mov esp, ebp
pop ebp
ret 8
Function at 0x426ecf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45988c
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x479630]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
mov eax, dword [0x479630]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x108]
mov ebx, ecx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call fcn.00425634
pop ecx
and dword [esp + 0x1a0], 0
push edi
lea eax, [esp + 0x128]
call fcn.004256e8
pop ecx
xor edx, edx
inc edx
mov dword [esp + 0x1a0], edx
cmp dword [esp + 0x118], 0
je 0x426f98
push edx
lea eax, [esp + 0x10c]
push eax
lea edi, [esp + 0x148]
call fcn.00426178
push esi
lea ecx, [esp + 0x128]
push ecx
mov ecx, eax
mov byte [esp + 0x1a8], 2
call fcn.00426ecf
mov esi, edi
mov byte [esp + 0x1a0], 1
call fcn.004261fc
jmp 0x427125
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x426fa9
mov eax, dword [esi]
mov dword [esp + 0x10], eax
jmp 0x426fad
mov dword [esp + 0x10], esi
cmp dword [edi + 0x14], 0x10
jb 0x426fb7
mov esi, dword [edi]
jmp 0x426fb9
mov esi, edi
mov eax, dword [ebx]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc ecx
push ecx
push dword [esp + 0x14]
push edx
push 0
push esi
push eax
call ebx
mov dword [esp + 0x10], eax
test eax, eax
je 0x4270a8
push str.set_string_value
lea ecx, [esp + 0xf0]
call fcn.00405b5f
and dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0xf
mov byte [esp + 0xd0], 0
push edi
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 4
call fcn.0042767d
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x1a0], 5
call fcn.00416c53
push str.System_error
push dword [esp + 0x14]
mov eax, esi
push eax
mov ecx, ebx
lea edi, [esp + 0x34]
mov byte [esp + 0x1ac], 6
call fcn.0042a9c6
lea ecx, [esp + 0x168]
mov byte [esp + 0x1a0], 7
push ecx
lea esi, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x20], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Registry.cpp
mov dword [esp + 0x24], str.Registry::setString
mov dword [esp + 0x28], 0x190
call fcn.0041ac4a
lea eax, [esp + 0x16c]
mov dword [esp], 0x46d798
push eax
call fcn.00441a01
cmp dword [0x47d500], 0
jg 0x427125
mov eax, dword [esp + 0x14]
mov ecx, edi
lea esi, [esp + 0xd0]
call fcn.00426434
xor esi, esi
push esi
push dword [esp + 0x1c]
mov byte [esp + 0x1a8], 8
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.004278ce
add esp, 0x10
push str.Registry::setString
push 0x193
push str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Registry.cpp
push esi
mov edx, eax
mov ecx, 0x47d500
mov byte [esp + 0x1b0], 9
call fcn.0041467b
push esi
push 1
lea ecx, [esp + 0xf4]
call fcn.00405e43
push esi
push 1
lea ecx, [esp + 0xd8]
call fcn.00405e43
lea esi, [esp + 0x108]
call fcn.0041e183
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0043a3e1
mov esp, ebp
pop ebp
ret 8
Function at 0x427514
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x3c]
push eax
mov edi, esi
mov ebx, ecx
call fcn.00425634
pop ecx
push esi
lea eax, [ebp - 0x20]
call fcn.004256e8
xor edi, edi
pop ecx
cmp dword [ebp - 0x2c], edi
je 0x4275e2
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
push edi
or ecx, 0x2001f
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00425f6c
add esp, 0x14
cmp dword [ebp - 0x6c], edi
je 0x4275a4
mov edi, dword [ebp - 0x6c]
cmp byte [ebp - 0x70], 0
je 0x427589
push dword [ebp - 0x74]
mov byte [ebp - 0x70], 0
call fcn.0042b14d
pop ecx
lea esi, [ebp - 0x3c]
call fcn.0041e183
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a3e1
leave
ret 8
push 0x47c2a9
lea eax, [ebp - 0x20]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x74]
mov eax, esp
mov dword [eax], ecx
mov cl, byte [ebp - 0x70]
mov byte [eax + 4], cl
mov dword [ebp - 0x78], esp
push ebx
lea ecx, [ebp - 0x3c]
lea edi, [ebp - 0x64]
mov byte [ebp - 0x70], 0
call fcn.004260f5
mov ecx, eax
call fcn.00427514
lea esi, [ebp - 0x64]
mov edi, eax
call fcn.004261fc
jmp 0x427576
cmp dword [esi + 0x14], 0x10
jb 0x4275ec
mov ecx, dword [esi]
jmp 0x4275ee
mov ecx, esi
mov eax, dword [ebx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x78], eax
cmp eax, edi
jne 0x427675
cmp dword [0x47d500], edi
jg 0x427675
lea eax, [ebp - 0x118]
push eax
call fcn.0040954f
lea eax, [ebp - 0x118]
push str.Deleted__
push eax
call fcn.0040b5a2
sub esp, 0x14
mov ecx, esi
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x7c], esp
call fcn.00426434
lea esi, [ebp - 0x118]
call fcn.0040b3c5
mov esi, eax
push str.__value
push esi
call fcn.0040b5a2
pop ecx
pop ecx
push esi
push 0x1d2
push edi
mov ebx, str.Registry::deleteValue
mov edi, str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_Registry.cpp
mov esi, 0x47d500
call fcn.004078c3
lea eax, [ebp - 0x118]
call fcn.004078a9
mov edi, dword [ebp - 0x78]
jmp 0x427589
Function at 0x428c48
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f25
call fcn.00441e31
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428d1a
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428cfa
cmp dword [0x47d500], 1
jg 0x428cfa
lea eax, [ebp - 0xb4]
push eax
call fcn.0040954f
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b5a2
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.00415006
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u212_12974_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078c3
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.004078a9
cmp dword [ebp - 0x14], 0x102
jne 0x428d1a
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0042af9a
pop ecx
mov al, bl
call fcn.00441f09
ret
mov bl, 1
jmp 0x428d05
Function at 0x4303be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x458149
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x479630]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x479630]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
cmp byte [ecx + 0x38], bl
je 0x43041e
push esi
mov ebx, ecx
call fcn.004300c3
mov eax, esi
jmp 0x430607
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x14]
mov dword [esp + 0xc0], ebx
call fcn.004301fa
test al, al
jne 0x4304eb
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
lea ebx, [esp + 0x58]
mov byte [esp + 0xc0], 1
call fcn.00433112
push 0xc8
lea edx, [esp + 0x28]
mov ecx, eax
mov byte [esp + 0xc4], 2
call fcn.004301fa
movzx eax, al
push eax
call fcn.004308d9
pop ecx
pop ecx
push 0
push 1
mov ecx, ebx
mov byte [esp + 0xc8], 1
call fcn.00405e43
push dword [esp + 0x34]
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x34]
lea ecx, [esp + 0x34]
call fcn.0040f36a
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], esi
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0xc0], 0
call fcn.0040d6d3
xor ebx, ebx
mov edi, dword [esp + 0x14]
mov esi, edi
cmp edi, dword [esp + 0x18]
je 0x430551
push 0x466840
call fcn.0040ef6d
pop ecx
test al, al
jne 0x43050f
add esi, 0x1c
cmp esi, dword [esp + 0x18]
jne 0x4304f7
cmp dword [esp + 0x18], esi
je 0x43054d
cmp edi, esi
je 0x430532
lea eax, [esi + 0x1c]
push eax
add esi, 0xffffffe4
push esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040d50b
jmp 0x4304eb
push 0x137
lea esi, [esp + 0x28]
call fcn.0040bf6e
push 0x46d630
mov eax, esi
push eax
call fcn.00441a01
cmp edi, dword [esp + 0x18]
sete al
movzx eax, al
push eax
call fcn.004308b1
pop ecx
push dword [esp + 0x14]
lea esi, [esp + 0x40]
add edi, 0x1c
call fcn.00406ed3
mov byte [esp + 0xc0], 4
jmp 0x4305b6
lea eax, [esp + 0x58]
push 0x466a38
push eax
call fcn.0041295c
pop ecx
pop ecx
push ebx
push eax
or eax, 0xffffffff
lea esi, [esp + 0x44]
mov byte [esp + 0xc8], 5
call fcn.004062ba
push ebx
push 1
lea ecx, [esp + 0x60]
mov byte [esp + 0xc8], 4
call fcn.00405e43
add edi, 0x1c
cmp edi, dword [esp + 0x18]
jne 0x430578
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.0043007a
push dword [esp + 0x38]
mov byte [esp + 0xc4], 6
lea ebx, [esp + 0x78]
mov byte [esp + 0xb0], 1
call fcn.004300c3
call fcn.0042ca2c
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.00405e43
lea esi, [esp + 0x14]
call fcn.0040d6d3
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0043a3e1
mov esp, ebp
pop ebp
ret