joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421858
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4368f0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42189e
cmp word [ebx], dx
jne 0x42189e
or byte [eax + edi + 0x28], 4
jmp 0x4218a3
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x421a06
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4219e6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4218e4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x42191a
cmp eax, edx
jae 0x421928
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4218bf
jmp 0x421a06
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4219e1
cmp dword [ebp - 0x18], 0
je 0x4219e1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4368f0]
test byte [eax + edi + 0x28], 0x48
je 0x4219b7
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x42197b
mov word [esi], cx
jmp 0x4219b2
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4368f0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4368f0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4368f0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x421a06
pop eax
cmp word [ebp - 4], ax
jne 0x4219c7
cmp esi, ebx
jne 0x4219c7
mov word [esi], ax
jmp 0x421a03
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041986d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x421a06
push 0xd
pop eax
jmp 0x4219c2
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4368f0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x421a00
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x421a06
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4244d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4244fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4244fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x4260483
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x64de17f3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x77f90119
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3674a73
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x409bc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x451008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [ebp - 0x218], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x21c], edx
test esi, esi
je 0x409d4d
test edx, edx
je 0x409d4d
test eax, eax
je 0x409d4d
lea eax, [ebp - 0x210]
push eax
push 0x20006
push 0
push 0x449b00
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409d4d
push ebx
lea ebx, [eax + 1]
push edi
push 0x5c
push esi
call fcn.0041bc05
push 0x104
mov edi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041c390
add esp, 0x14
test edi, edi
je 0x409c54
mov eax, edi
sub eax, esi
and eax, 0xfffffffe
jmp 0x409c72
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409c60
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0041df80
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x409cca
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x409cca
xor ebx, ebx
jmp 0x409ce2
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
test edi, edi
je 0x409cf5
lea esi, [edi + 2]
test esi, esi
je 0x409cf5
test ebx, ebx
jne 0x409c27
mov esi, dword [ebp - 0x218]
mov ecx, esi
pop edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d01
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp - 0x21c]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ab17
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0041ab17
mov esp, ebp
pop ebp
ret

Function at 0x409d60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test edx, edx
je 0x409d9a
cmp dword [ebp + 8], 0
je 0x409d9a
lea eax, [ebp - 4]
push eax
push 0x2001b
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409d9a
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x409da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x451008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x409e26
test edi, edi
je 0x409e26
lea eax, [ebp - 0x110]
push eax
push 0x20019
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e26
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409e1a
cmp dword [ebp - 0x10c], esi
mov eax, 1
cmova esi, eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0041ab17
mov esp, ebp
pop ebp
ret
Function at 0x40f950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x451008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor bl, bl
cmp dword [edi], 0
je 0x40fa31
mov ecx, dword [ebp + 8]
call fcn.0040e6a0
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], eax
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fa26
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x40f9b6
cmp eax, 2
jne 0x40fa26
mov eax, dword [ebp + 8]
mov bl, 1
add eax, 2
push eax
call fcn.0041b26a
mov esi, eax
add esp, 4
test esi, esi
je 0x40fa24
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 0x14]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fa26
mov eax, dword [ebp + 8]
cmp word [esi + eax - 2], 0
je 0x40f9f8
xor ecx, ecx
mov word [esi + eax], cx
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040d2b0
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], 0
call fcn.0040d430
lea ecx, [ebp - 0x1c]
call fcn.0040d4b0
push esi
call fcn.0041b273
add esp, 4
jmp 0x40fa26
xor bl, bl
push dword [ebp - 0x14]
call fcn.0041b273
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40fa50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
xor cl, cl
mov dword [ebp - 4], eax
cmp dword [eax], 0
je 0x40fab4
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
call fcn.0040e6a0
mov esi, dword [ebp + 0xc]
mov ebx, eax
mov ecx, esi
call fcn.0040e6a0
mov edi, eax
mov eax, dword [esi + 4]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebp - 4]
push edi
push 1
push 0
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.0041b273
push edi
call fcn.0041b273
add esp, 8
test esi, esi
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, cl
mov esp, ebp
pop ebp
ret 8

Function at 0x40fac0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437028
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x451008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
cmp dword [ecx + 4], 0
je 0x40fb4f
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x20219
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.0040fc00
mov esi, eax
add esp, 4
test esi, esi
je 0x40fb3d
lea ecx, [ebp - 0x18]
call fcn.0040e6a0
mov edi, eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edi
mov esi, eax
call fcn.0041b273
add esp, 4
test esi, esi
sete bl
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40fb4f
push 2
push ecx
call fcn.0041aef0
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410510
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x451008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x80
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0
push eax
push str.Client_SID
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x410582
lea eax, [ebp - 0x108]
or esi, 0x20006
push eax
push esi
push 0
lea eax, [ebp - 0x104]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x108]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ab17
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x80000001
xor ecx, ebp
pop esi
call fcn.0041ab17
mov esp, ebp
pop ebp
ret
Function at 0x410960
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437208
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x451008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movzx esi, dl
lea edx, [ebp - 0x34]
shl esi, 8
add esi, 0x20119
mov dword [ebp - 4], 0
push esi
call fcn.0040fc00
add esp, 4
test eax, eax
jne 0x4109c0
xor bl, bl
jmp 0x410b5a
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], esi
call fcn.0040fb70
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x34]
call fcn.004103e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test al, al
jne 0x410a0f
xor bl, bl
jmp 0x410afb
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x20119
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040f780
test al, al
jne 0x410a38
xor bl, bl
jmp 0x410ac0
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040f3b0
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f020
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x410a87
cmp eax, 0x80000000
je 0x410a87
cmp eax, 0x80000005
je 0x410a87
cmp eax, 0x80000001
je 0x410a87
cmp eax, 0x80000002
je 0x410a87
cmp eax, 0x80000004
je 0x410a87
cmp eax, 0x80000003
je 0x410a87
push eax
call esi
mov eax, dword [ebp - 0x14]
xor bl, bl
test eax, eax
je 0x410afb
cmp dword [ebp - 0x18], 0
je 0x410ac3
lea ecx, [ebp - 0x1c]
call fcn.0040e6a0
mov edi, eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
mov esi, eax
call fcn.0041b273
add esp, 4
test esi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sete bl
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x410afb
cmp eax, 0x80000000
je 0x410af4
cmp eax, 0x80000005
je 0x410af4
cmp eax, 0x80000001
je 0x410af4
cmp eax, 0x80000002
je 0x410af4
cmp eax, 0x80000004
je 0x410af4
cmp eax, 0x80000003
je 0x410af4
push eax
call esi
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410b0d
push 2
push eax
call fcn.0041aef0
add esp, 8
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x410b1f
push 2
push eax
call fcn.0041aef0
add esp, 8
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x410b5a
cmp eax, 0x80000000
je 0x410b53
cmp eax, 0x80000005
je 0x410b53
cmp eax, 0x80000001
je 0x410b53
cmp eax, 0x80000002
je 0x410b53
cmp eax, 0x80000004
je 0x410b53
cmp eax, 0x80000003
je 0x410b53
push eax
call esi
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x410b6c
push 2
push eax
call fcn.0041aef0
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
lea eax, [ebp - 8]
mov byte [ebp - 1], 0
push eax
mov esi, ecx
mov dword [ebp - 8], 0
push 1
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
add dword [esi + 8], eax
mov al, byte [ebp - 1]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
mov esi, ecx
mov dword [ebp - 4], 0
push 2
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
mov ax, word [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
mov esi, ecx
mov dword [ebp - 4], 0
push 4
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
lea eax, [ebp - 0xc]
push 8
push eax
xorps xmm0, xmm0
push dword [esi + 4]
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410d10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x410d4a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x410d4a
push 0
lea edx, [ebp - 4]
push edx
push eax
push ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x410e90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor bl, bl
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x410fd8
mov edx, dword [ecx + 4]
cmp edx, 1
jbe 0x410fd8
push esi
mov esi, dword [ecx]
cmp word [esi + 2], 0x3a
jne 0x410fd0
cmp edx, 2
jbe 0x410fd0
cmp word [esi + 4], 0x5c
jne 0x410fd0
mov edx, 3
push edi
mov dword [ebp - 8], edx
nop dword [eax + eax]
xor edi, edi
or esi, 0xffffffff
test edx, edx
mov eax, edx
mov edx, dword [ecx]
cmovs eax, edi
test edx, edx
je 0x410fa0
mov ebx, dword [ecx + 4]
test ebx, ebx
je 0x410fa0
cmp eax, ebx
jae 0x410fa0
lea edx, [edx + eax*2]
nop dword [eax]
mov edi, eax
cmp esi, 0xffffffff
jne 0x410f2f
movzx ecx, word [edx]
inc eax
add edx, 2
mov esi, edi
cmp ecx, 0x5c
mov ecx, 0xffffffff
cmovne esi, ecx
cmp eax, ebx
jb 0x410f10
mov ecx, dword [ebp - 4]
cmp esi, 0xffffffff
je 0x410fa0
push esi
push 0
call fcn.0040e4d0
mov ecx, dword [ebp - 4]
mov edi, eax
mov edx, dword [ebp - 8]
test edi, edi
je 0x410ee0
mov ecx, edi
call fcn.0040e6a0
mov ebx, eax
test ebx, ebx
je 0x410f6c
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
push ebx
call fcn.0041aef0
add esp, 8
mov eax, dword [edi]
test eax, eax
je 0x410f83
push 2
push eax
call fcn.0041aef0
add esp, 8
mov dword [edi], 0
push 8
push edi
mov dword [edi + 4], 0
call fcn.0041aef0
mov ecx, dword [ebp - 4]
lea edx, [esi + 1]
add esp, 8
jmp 0x410ed8
mov eax, dword [ebp - 8]
pop edi
cmp eax, dword [ecx + 4]
jge 0x410fc8
call fcn.0040e6a0
mov esi, eax
test esi, esi
je 0x410fc8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
push esi
call fcn.0041aef0
add esp, 8
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x451008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov byte [ebp - 0xd], 0
call fcn.0040e6a0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov ebx, eax
call fcn.0041aef0
add esp, 8
cmp ebx, 0xffffffff
jne 0x4110cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jb 0x411044
cmp esi, 3
jbe 0x4110b9
push 0x98
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x4b
call fcn.0041b26a
mov ecx, dword [ebp - 0x18]
push 0xffffffffffffffff
push str.DoesFolderExist_INVALID_FILE_ATTRIBUTES_and_GetLastError_returned__I_for__s
inc ecx
mov dword [ebp - 0x1c], eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00426d70
mov ecx, dword [ebp - 0x18]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x18], ecx
push edi
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], edx
push eax
push 0x5c
push str.OFileManager::doesFolderExist
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcofilemanager.cpp
push edx
call fcn.00416c20
mov eax, dword [ebp - 0x1c]
add esp, 0x34
test eax, eax
je 0x4110b9
push 2
push eax
call fcn.0041aef0
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [ebp - 0xd]
test bl, 0x10
mov ecx, 1
cmovne eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4110f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
call fcn.0040e6a0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0041aef0
add esp, 8
cmp edi, 0xffffffff
setne al
pop edi
pop esi
ret