joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522c90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f80b
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x458], ecx
xor esi, esi
mov dword [ebp - 0x448], ebx
mov dword [ebp - method.WindowsFile.virtual_0], vtable.WindowsFile.0
mov dword [ebp - 0x444], 0xffffffff
mov dword [ebp - 0x440], ebx
mov byte [ebp - 0x438], bl
mov byte [ebp - 0x38], bl
push eax
push 0x5c7d4c
push 0x5cc214
lea edi, [ebp - 0x44c]
mov dword [ebp - 4], ebx
call fcn.00508fc0
add esp, 0xc
cmp dword [ebp - 0x43c], ebx
jne 0x522d94
mov eax, dword [ebp - 0x444]
lea edx, [ebp - 0x450]
push edx
push eax
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x454], edi
cmp edi, 0xffffffff
jne 0x522d5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x43c], eax
cmp eax, ebx
jne 0x522dc7
mov edi, dword [ebp - 0x454]
mov dword [ebp - 0x43c], ebx
mov ecx, dword [ebp - 0x458]
lea edx, [edi + 0x10]
push edx
mov dword [ecx], edi
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x522d89
push edi
push esi
lea ecx, [ebp - 0x44c]
call fcn.005097e0
lea ecx, [ebp - 0x44c]
call fcn.005096c0
lea ecx, [ebp - 0x44c]
mov dword [ebp - method.WindowsFile.virtual_0], vtable.WindowsFile.0
call fcn.005096c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
xor edi, edi
mov dword [ebp - 0x450], ebx
jmp 0x522d61
Function at 0x5241c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, str.local
mov eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x524200
test dl, dl
je 0x5241fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x524200
add eax, 2
add ecx, 2
test dl, dl
jne 0x5241e0
xor eax, eax
jmp 0x524205
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x524235
mov eax, dword [0x60dd58]
test eax, eax
jne 0x524224
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [0x60dd58], eax
mov dword [esi], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
push 0x610270
push 0x100
lea ecx, [ebp - 0x104]
push ecx
push 0x5bc564
push str.ipcname
push str.Indexer1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x104], 0
je 0x52426a
lea edi, [ebp - 0x104]
push edi
push 0x200000
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [esi + 0x114], 1
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 0
push reloc.zlibwapi.dll_Ordinal_4
push 6
push eax
mov dword [esi + 8], eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp dword [esi + 8], 0
jne 0x5242b5
push edi
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x5242e7
mov edx, dword [esi + 4]
push edx
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
test eax, eax
jne 0x5242e9
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x524e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c96e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.PDFBaseType.0
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov byte [esi], al
mov dword [ebp - 4], eax
mov dword [ebx + 8], eax
lea edi, [eax + 0xb]
mov eax, str.PDFBaseType
call fcn.00402fe0
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebp - 4], 1
mov dword [ebx], vtable.PDFArray.0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
lea edi, [eax + 8]
mov byte [ebp - 4], 2
mov eax, str.PDFArray
mov dword [ebx + 8], 0xe
call fcn.00402fe0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x526310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c7ae
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.PDFBaseType.0
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov byte [esi], al
mov dword [ebp - 4], eax
mov dword [ebx + 8], eax
lea edi, [eax + 0xb]
mov eax, str.PDFBaseType
call fcn.00402fe0
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebp - 4], 1
mov dword [ebx], vtable.PDFRefID.0
mov dword [ebx + 0x28], vtable.PDFObjID.0
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x2c], eax
lea edi, [eax + 8]
mov byte [ebp - 4], 2
mov eax, str.PDFRefID
mov dword [ebx + 8], 0x32
call fcn.00402fe0
mov ecx, dword [ebp + 0xc]
lea eax, [ebx + 0x28]
cmp eax, ecx
je 0x5263bc
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [ebx + 0x38], ecx
jmp 0x5263c3
mov dword [ebx + 0x38], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5263e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c7ae
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.PDFBaseType.0
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov byte [esi], al
mov dword [ebp - 4], eax
mov dword [ebx + 8], eax
lea edi, [eax + 0xb]
mov eax, str.PDFBaseType
call fcn.00402fe0
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebp - 4], 1
mov dword [ebx], vtable.PDFRefID.0
mov dword [ebx + 0x28], vtable.PDFObjID.0
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x2c], eax
lea edi, [eax + 8]
mov byte [ebp - 4], 2
mov eax, str.PDFRefID
mov dword [ebx + 8], 0x32
call fcn.00402fe0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x526f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c96e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.PDFBaseType.0
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov byte [esi], al
mov dword [ebp - 4], eax
mov dword [ebx + 8], eax
lea edi, [eax + 0xb]
mov eax, str.PDFBaseType
call fcn.00402fe0
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebp - 4], 1
mov dword [ebx], vtable.PDFDictionary.0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
lea edi, [eax + 0xd]
mov byte [ebp - 4], 2
mov eax, str.PDFDictionary
mov dword [ebx + 8], 0xf
call fcn.00402fe0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x528420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597aeb
mov eax, dword fs:[0]
push eax
sub esp, 0xc40
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0xc48], eax
mov dword [eax], ebx
mov byte [ebp - 0xc44], bl
mov byte [ebp - 0x82c], bl
mov dword [ebp - 0x83c], 1
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x840], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x420], ebx
push 0x10000
mov dword [ebp - 4], ebx
call fcn.00596073
add esp, 4
push ebx
push ebx
push 3
push ebx
push ebx
mov esi, eax
push closesocket
push edi
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x844], eax
mov dword [ebp - 0x840], ebx
cmp eax, 0xffffffff
je 0x528552
lea edx, [ebp - 0xc44]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x5284e0
cmp dword [ebp - 0x844], 0xffffffff
mov esi, dword [ebp - 0x42c]
mov dword [ebp - 0x83c], ebx
jne 0x52858a
cmp esi, ebx
je 0x528519
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor esi, esi
mov dword [ebp - 0x42c], esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push str.ERROR_:_failed_to_open_PDF_file____s___when_checking_LINEARIZED_status
mov ecx, 0x610240
mov dword [ebp - 0x844], ebx
call fcn.00504670
add esp, 8
cmp esi, ebx
je 0x528548
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
or eax, 0xffffffff
or edx, eax
jmp 0x528629
mov dword [ebp - 0x83c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x844], ebx
cmp dword [0x61025c], ebx
je 0x52858a
push eax
push edi
push str.ERROR_15113:_unable_to_open_file___s___GetLastError__d_
mov ecx, 0x610240
call fcn.00504670
add esp, 0xc
mov edx, dword [ebp - 0x844]
push ebx
lea eax, [ebp - 0xc4c]
push eax
push 0x3ff
lea ecx, [ebp - 0x414]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5285b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
je 0x5285c5
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor esi, esi
mov edi, dword [ebp - 0x844]
cmp edi, ebx
je 0x5285de
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x844], ebx
mov edi, ebx
mov ecx, dword [ebp - 0xc4c]
push 0xb
push str._Linearized
lea eax, [ebp - 0x414]
call fcn.00527a90
add esp, 8
test eax, eax
je 0x528609
mov eax, dword [ebp - 0xc48]
mov dword [eax], 1
cmp esi, ebx
je 0x528617
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp edi, ebx
je 0x528622
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x52fce0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59999c
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 0x24], vtable.PDFObjID.0
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], eax
mov ecx, 0xf
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x48], eax
mov byte [ebx + 0x38], al
mov dword [ebx + 0x68], ecx
mov dword [ebx + 0x64], eax
mov byte [ebx + 0x54], al
mov dword [ebx + 0x84], ecx
mov dword [ebx + 0x80], eax
mov byte [ebx + 0x70], al
mov dword [ebx + 0xa0], ecx
mov dword [ebx + 0x9c], eax
mov byte [ebx + 0x8c], al
mov edx, 1
mov dword [ebx + 0xa8], vtable.PDFPermission.0
mov dword [ebx + 0xac], edx
mov dword [ebx + 0xb0], edx
mov dword [ebx + 0xb4], edx
mov dword [ebx + 0xb8], edx
mov dword [ebx + 0xbc], 0xfffffffc
mov dword [ebx + 0xdc], ecx
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xc8], al
mov dword [ebx + 0xf8], ecx
mov dword [ebx + 0xf4], eax
mov byte [ebx + 0xe4], al
mov dword [ebx + 0x114], ecx
mov dword [ebx + 0x110], eax
mov byte [ebx + 0x100], al
mov dword [ebx + 0x130], ecx
mov dword [ebx + 0x12c], eax
mov byte [ebx + 0x11c], al
mov dword [ebx + 0x14c], ecx
mov dword [ebx + 0x148], eax
mov byte [ebx + 0x138], al
mov dword [ebx + 0x168], ecx
mov dword [ebx + 0x164], eax
mov byte [ebx + 0x154], al
mov byte [ebp - 4], 0xb
mov byte [ebx + 0x20], al
mov dword [ebx], 0x5e4ebf28
mov dword [ebx + 4], 0x418a754e
mov dword [ebx + 8], 0x564e0064
mov dword [ebx + 0xc], 0x801faff
mov dword [ebx + 0x10], 0xb6002e2e
mov dword [ebx + 0x14], 0x803e68d0
mov dword [ebx + 0x18], 0xfea90c2f
mov dword [ebx + 0x1c], 0x7a695364
call fcn.00530010
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53a680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59bdf6
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.PDFObjStream.0
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov byte [esi], al
mov dword [ebp - 4], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov byte [ebp - 4], 1
mov dword [ebx + 4], eax
xor edi, edi
mov eax, 0x5bc564
mov dword [ebx + 8], 0xffffffff
call fcn.00402fe0
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x28], edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x53bf10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597186
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.tagPageNode.0
xor ebx, ebx
mov dword [esi + 0xc], vtable.PDFObjID.0
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [ebp - 4], 1
mov byte [esi + 8], bl
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
cmp ecx, ebx
je 0x53bf74
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x10], ebx
or eax, 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x53c0e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59bd4f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [edi + 0x20]
push eax
mov dword [edi], vtable.PDFStructure.0
call fcn.0053ab70
lea ecx, [edi + 0xa8]
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
call fcn.0053c960
lea esi, [edi + 0x150]
mov dword [esi], vtable.tagPageNode.0
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], vtable.PDFObjID.0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [ebp - 4], 3
mov byte [esi + 8], bl
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
cmp ecx, ebx
je 0x53c16a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x10], ebx
or eax, 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x188], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x53e870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59798b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi], vtable.PDFStructureList.0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [ebp - 4], edi
push 0x28
mov dword [esi + 0x28], edi
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, edi
je 0x53e909
mov dword [esi + 0x24], eax
mov dword [eax], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x24]
mov al, 1
mov byte [ecx + 0x20], al
mov edx, dword [esi + 0x24]
mov byte [edx + 0x21], al
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x5f190c
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x54d2c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599178
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x54d3e2
cmp byte [edi + 0x49], bl
je 0x54d3e2
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x54d3d6
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x54d334
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x54d34c
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x54d373
dec eax
je 0x54d376
sub eax, 2
lea esi, [ebp - 0x2c]
jne 0x54d3d1
jmp 0x54d3dd
mov byte [edi + 0x49], bl
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x54d386
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x54d3b0
cmp edx, 0x10
jae 0x54d395
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x54d3ce
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], bl
je 0x54d3da
cmp esi, ebx
jne 0x54d340
push ebx
mov ebx, 8
lea esi, [ebp - 0x2c]
call fcn.0044ad40
xor ebx, ebx
jmp 0x54d33a
lea esi, [ebp - 0x2c]
call fcn.004542a0
xor al, al
jmp 0x54d3e4
lea esi, [ebp - 0x2c]
call fcn.004542a0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x5505c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], eax
je 0x550603
mov ecx, dword [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [edi + 8]
push edx
call esi
mov dword [edi], 0
mov esi, dword [ebp + 8]
mov dword [edi + 4], 0
xor edi, edi
mov byte [ebp - 0x404], 0
cmp dword [esi], edi
je 0x5506b5
mov edi, edi
test edi, edi
je 0x550664
lea eax, [ebp - 0x404]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x55063f
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x550630
jmp 0x550661
lea edx, [ebp - 5]
cmp eax, edx
jae 0x550661
mov edx, 0x5ccf88
sub edx, eax
lea ecx, [ecx]
mov cl, byte [edx + eax]
test cl, cl
je 0x550661
mov byte [eax], cl
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x550650
mov byte [eax], 0
mov esi, dword [esi]
test esi, esi
jne 0x550670
call dword [sym.imp.MSVCR100.dll_abort]
lea eax, [ebp - 0x404]
cmp byte [eax], 0
je 0x550685
inc eax
lea edx, [ebp - 5]
cmp eax, edx
jb 0x550676
jmp 0x5506a1
lea ecx, [ebp - 5]
cmp eax, ecx
jae 0x5506a1
mov edx, esi
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x5506a1
mov byte [eax], cl
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x550690
mov edx, dword [ebp + 8]
inc edi
cmp dword [edx + edi*4], 0
lea esi, [edx + edi*4]
mov byte [eax], 0
jne 0x550620
push 0x44
lea eax, [ebp - 0x450]
push 0
push eax
call sub.MSVCR100.dll_memset
mov esi, dword [ebp - 0x40c]
add esp, 0xc
lea eax, [esi + 8]
push eax
mov ecx, 6
mov word [ebp - 0x420], cx
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x408]
lea eax, [ebp - 0x450]
push eax
push ecx
push 0
push 0x8000020
push 0
push 0
lea edx, [ebp - 0x404]
push 0
push edx
push 0
mov dword [ebp - 0x450], 0x44
mov dword [ebp - 0x424], 0x19
mov dword [ebp - 0x430], 0xa0
mov dword [ebp - 0x42c], 0x270f
mov dword [ebp - 0x428], 0xf0
mov dword [ebp - 0x444], edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x550769
pop edi
mov dword [esi], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], eax
xor ecx, ebp
pop esi
call fcn.00596083
mov esp, ebp
pop ebp
ret 8