joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40496a
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404a0e
push esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4049ce
test dl, dl
je 0x4049ca
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4049ce
add eax, 2
add ecx, 2
test dl, dl
jne 0x4049ae
xor eax, eax
jmp 0x4049d3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4049fc
push dword [ebp - 0x124]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4049fc
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4049a5
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00404df4
leave
ret

Function at 0x404d93
Capabilities:
Hide graphical window

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4055f9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405638
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405638
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405638
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405638
cmp dword [ecx + 0x74], 0xe
jbe 0x405638
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40b44e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b4eb
push ebx
push esi
call fcn.0040b417
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b3ab
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b498
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b4ea
push edi
push eax
call fcn.0040c06b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b4b8
call fcn.00409f8e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b4e9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b3ab
add esp, 0x20
test eax, eax
jne 0x40b4d7
push edi
call fcn.00409f8e
jmp 0x40b4df
push ebx
call fcn.00409f8e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40c7e8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4166a0
push 0x416698
push str.FlsAlloc
push 0x1f
call fcn.0040c6a7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c81c
push dword [ebp + 8]
mov ecx, esi
call dword [0x41314c]
call esi
jmp 0x40c822
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40c866
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4166b0
push 0x4166a8
push str.FlsGetValue
push 0x21
call fcn.0040c6a7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c89d
push dword [ebp + 8]
mov ecx, esi
call dword [0x41314c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40c8a5
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4166b8
push 0x4166b0
push str.FlsSetValue
push 0x22
call fcn.0040c6a7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40c8df
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41314c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x411c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411cad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411cad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x449559
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ddf80]
jne 0x449563
repz ret
jmp fcn.0044bbfe

Function at 0x453288
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ddf80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0044eb02
and dword [ebp - 0x14], 0
cmp dword [0x5dfcf4], 0
mov dword [ebp - 0x18], eax
jne 0x45333b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4533e3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4533e3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5dfcf4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5dfcf8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5dfcfc], eax
call edi
push eax
call esi
mov dword [0x5dfd04], eax
test eax, eax
je 0x45333b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5dfd00], eax
mov eax, dword [0x5dfd00]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x453394
cmp dword [0x5dfd04], ecx
je 0x453394
push eax
call esi
push dword [0x5dfd04]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x453394
test ebx, ebx
je 0x453394
call edi
test eax, eax
je 0x45338b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45338b
test byte [ebp - 8], 1
jne 0x453394
or dword [ebp + 0x10], 0x200000
jmp 0x4533c7
mov eax, dword [0x5dfcf8]
cmp eax, dword [ebp - 0x18]
je 0x4533c7
push eax
call esi
test eax, eax
je 0x4533c7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4533c7
mov eax, dword [0x5dfcfc]
cmp eax, dword [ebp - 0x18]
je 0x4533c7
push eax
call esi
test eax, eax
je 0x4533c7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5dfcf4]
call esi
test eax, eax
je 0x4533e3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4533e5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449559
leave
ret
Function at 0x402a20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00402a80

Function at 0x402a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x467068]
test eax, eax
jle 0x402b83
mov edx, dword [0x46706c]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x402ab1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x402b26
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x402aa0
mov dword [esp], esi
call fcn.004033c0
test eax, eax
mov edi, eax
je 0x402baa
lea esi, [ebx + ebx*2]
mov ebx, dword [0x46706c]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.004034b0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x46706c]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402b8a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x402b30
add dword [0x467068], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x402b1f
cmp eax, 0x80
je 0x402b1f
cmp eax, 8
je 0x402b1f
mov eax, dword [ebp - 0x28]
add esi, dword [0x46706c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x402b1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402a20
xor ebx, ebx
jmp 0x402abb
mov eax, dword [0x46706c]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402a20
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402a20
lea esi, [esi]

Function at 0x4032e0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x403318
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40330e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40331a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x403300
xor eax, eax
pop ebx
pop esi
ret
Function at 0x407d98
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x407dce
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x407db5
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x407dc6
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x407dd0
inc edi
add eax, 0x28
cmp edi, esi
jb 0x407dab
xor eax, eax
pop edi
pop esi
ret

Function at 0x407fb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], pe_nt_image_headers32
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
scasd eax, dword es:[edi]
hlt
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00407d53
mov ecx, 0x8d518ac4
inc ebp
test al, 0x50
invalid
Function at 0x408c6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00407d31
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c

Function at 0x4090ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cld
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x409ee6
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00407cc4
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x409160
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4091a9
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x409153
invalid
call fcn.00407d53
add al, 0xb6
jecxz 0x40916d
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58

Function at 0x409d53
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x409d9d
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x409da2
jmp 0x4096f5
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x409de9
lea eax, [ebp - 0x714]
push eax
call fcn.00407d63
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
jne 0x409def
Function at 0x40a17a
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x4016ac
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x40a1cc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401718
push edi
call esi
push 0x40170c
push edi
mov dword [0x4172a4], eax
call esi
push 0x401700
push edi
mov dword [0x4172a8], eax
call esi
push 0x4016f8
push edi
mov dword [0x4172ac], eax
call esi
mov dword [0x4172b0], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x4172a4], ebx
je 0x40a1f2
cmp dword [0x4172a8], ebx
je 0x40a1f2
cmp dword [0x4172ac], ebx
je 0x40a1f2
cmp dword [0x4172b0], ebx
jne 0x40a216
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4172a8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4172a4], 0x409dcb
mov dword [0x4172ac], esi
mov dword [0x4172b0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x41616c], eax
cmp eax, 0xffffffff
je 0x40a289
push dword [0x4172a8]
push eax
call esi
test eax, eax
je 0x40a289
call 0x409c86
push dword [0x4172a4]
call fcn.00409ccd
push dword [0x4172a8]
mov dword [0x4172a4], eax
call fcn.00409ccd
push dword [0x4172ac]
mov dword [0x4172a8], eax
call fcn.00409ccd
push dword [0x4172b0]
mov dword [0x4172ac], eax
call fcn.00409ccd
add esp, 0x10
mov dword [0x4172b0], eax
call fcn.0040d8bc
test eax, eax
jne 0x40a28f
call fcn.00409e08
xor eax, eax
pop edi
pop esi
pop ebx
ret
push fcn.00409fb7
push dword [0x4172a4]
call fcn.00409d53
pop ecx
call eax
mov dword [0x416170], eax
cmp eax, 0xffffffff
je 0x40a284
push 0x214
push 1
call fcn.0040ef9d
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x40a284
push esi
push dword [0x416170]
push dword [0x4172ac]
call fcn.00409d53
pop ecx
call eax
test eax, eax
jne 0x40a2e2
push esi
call fcn.00408ab7
pop ecx
jmp 0x40a284
push ebx
push esi
call fcn.00409e4a
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x40a28b
Function at 0x419201
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46d9bc
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4976a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea edi, [ebx + 0x44]
mov eax, edi
lea esi, [esp + 0xc]
call fcn.00436ce2
mov dword [esp + 0x20], edi
and dword [esp + 0x30], 0
mov eax, dword [ebp + 8]
push 0
mov dword [ebx + 0x50], eax
push dword [edi + 8]
call fcn.00437089
or dword [esp + 0x30], 0xffffffff
mov ecx, esi
call fcn.00436d2c
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41a0a6
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x41a0bd
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x41a0d0
and dword [eax + 8], 0
call fcn.0041c445
mov eax, dword [esi + 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 4]
and dword [eax + 4], 0
pop esi
pop ebx
ret

Function at 0x422c45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x469fe2
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4976a0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x4976a0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x422ce9
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.Destination_buffer_cant_be_NULL
call fcn.0044aa7c
mov dword [esp + 0x20], vtable.std::invalid_argument.0
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_common_share_tstrings.cpp
mov dword [esp + 0x1c], str.tstrings::unsafe_format
mov dword [esp + 0x20], 0x1b
call fcn.00423578
lea eax, [esp + 0x4c]
mov dword [esp], 0x4879ec
push eax
call fcn.00452134
push 0xf
pop esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x80], 1
mov eax, dword [esp + 0x3c]
add eax, 0x100
lea ecx, [esp + 0x2c]
call fcn.00418a90
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
jae 0x422d24
lea eax, [esp + 0x2c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esp + 0x48]
push eax
call fcn.0044fe58
add esp, 0x14
cmp eax, 0xffffffff
je 0x422d03
lea ecx, [esp + 0x2c]
call fcn.00418a90
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
lea esi, [esp + 0x2c]
mov byte [edi], bl
call fcn.00403068
push ebx
push 1
mov ecx, esi
call fcn.0040321f
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0044a628
mov esp, ebp
pop ebp
ret
Function at 0x443f5d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46a314
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4976a0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.004407e3
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [esp + 0x10], cl
mov dword [esp + 0x1c], edi
mov byte [eax + 4], bl
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], cl
mov dword [esp + 0x50], ebx
cmp byte [esp + 0x18], bl
je 0x443fc8
push dword [esp + 0x14]
mov byte [esp + 0x1c], bl
call fcn.00449397
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov esi, 0x100001
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
call fcn.0042a4d0
push edi
mov edi, dword [esp + 0x38]
dec esi
push esi
push 1
push edi
call fcn.00451946
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x44401c
push 0xc8
lea esi, [esp + 0x20]
call fcn.00411486
push 0x487864
mov eax, esi
push eax
call fcn.00452134
push dword [esp + 0x1c]
call fcn.004516d4
pop ecx
test eax, eax
je 0x444041
push 0x133
lea esi, [esp + 0x20]
call fcn.00411486
push 0x487864
mov eax, esi
jmp 0x444016
push dword [esp + 0x1c]
call fcn.004516ac
pop ecx
test eax, eax
jne 0x444066
push 0x13b
lea esi, [esp + 0x20]
call fcn.00411486
push 0x487864
mov eax, esi
jmp 0x444016
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, edi
call fcn.00443f29
lea eax, [edi + esi]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp edi, eax
je 0x444094
sub eax, edi
push eax
push edi
mov ecx, esi
call fcn.004036d6
cmp edi, ebx
je 0x44409f
push edi
call fcn.0044a61d
pop ecx
cmp byte [esp + 0x10], bl
je 0x4440af
push dword [esp + 0x1c]
call fcn.00449397
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x444307
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4976a0]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4699d5
call fcn.00452564
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x44435d
push 0xc8
lea esi, [ebp - 0x20]
call fcn.00411486
push 0x487864
mov eax, esi
push eax
call fcn.00452134
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.0041dfc8
push 0x482424
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0043ac0c
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00443078
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.0041a86e
push 1
lea esi, [ebp]
call fcn.0041a86e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0044a628
add ebp, 0x244
leave
ret
Function at 0x4455e9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, eax
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jl 0x445669
jg 0x445615
cmp esi, ecx
jbe 0x445669
cmp dword [ebp + 0x14], ecx
jg 0x445615
jl 0x445611
cmp esi, 0x7fffffff
jae 0x445615
mov eax, esi
jmp 0x44561a
mov eax, SysReAllocString
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], ecx
je 0x44565a
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x445644
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x445664
jmp 0x44565a
mov eax, dword [ebp - 4]
test eax, eax
jle 0x445655
add ebx, eax
cdq
sub esi, eax
sbb dword [ebp + 0x14], edx
jmp 0x4455f5
cmp eax, 0xffffffff
jne 0x445664
call fcn.00450875
cmp dword [eax], 4
je 0x4455f5
or eax, 0xffffffff
jmp 0x44566b
xor eax, eax
pop esi
pop ebx
leave
ret