joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529e58
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x529e74
call fcn.0052ae6c
jmp 0x529ee3
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x529e90
call fcn.0052ae6c
jmp 0x529ee3
cmp dword [0x59e350], 1
je 0x529ee1
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.00532044
pop ecx
cmp al, 0x41
jl 0x529ee1
cmp al, 0x5a
jg 0x529ee1
cmp byte [ebp - 0x107], 0x3a
jne 0x529ee1
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x529ee1
call fcn.0052ae6c
jmp 0x529ee3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x529ee8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x529f18
movsx edx, byte [ebp - 0x104]
sub edx, 0x61
inc edx
jmp 0x529f23
movsx edx, byte [ebp - 0x104]
sub edx, 0x41
inc edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x529f2c
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x529f92
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x529f92
call fcn.0052ae6c
jmp 0x529fcd
push edi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x529fa2
call fcn.0052ae6c
jmp 0x529fcd
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x529fc8
push edi
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x529fc6
cmp ebx, 1
je 0x529fc6
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x529fb3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52a8d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ebx, dword [0x593248]
jb 0x52a8f4
push 6
call fcn.0052ae00
pop ecx
jmp 0x52a98b
push ebx
call fcn.0052aa4c
pop ecx
mov esi, dword [ebx*4 + 0x59e050]
push 0x24
push 0
push edi
call fcn.00527dec
add esp, 0xc
push esi
call sub.KERNEL32.DLL_GetFileType
dec eax
je 0x52a928
dec eax
je 0x52a920
dec eax
je 0x52a97a
jmp 0x52a980
mov word [edi + 4], 0x2000
jmp 0x52a980
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push esi
call sub.KERNEL32.DLL_GetFileTime
dec eax
je 0x52a946
call fcn.0052ae6c
mov esi, eax
jmp 0x52a982
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
test byte [ebx*4 + 0x59324d], 1
je 0x52a969
xor eax, eax
jmp 0x52a96e
mov eax, 1
push eax
push edi
call fcn.00533cf8
add esp, 0x18
jmp 0x52a980
mov word [edi + 4], 0x1000
xor esi, esi
push ebx
call fcn.0052aae0
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52e55c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00527e90
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00527f20
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00527f20
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x594039
lea ecx, [ebp - 0x200]
push ecx
call fcn.00527e90
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00527f20
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0052f998
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x52e66d
push esi
call fcn.00527f20
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00527f20
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.005269a8
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x52e644
xor eax, eax
jmp 0x52e6f4
push esi
call fcn.00527f20
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00527f20
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00527dec
add esp, 0xc
jmp 0x52e6ad
mov edi, dword [ebx + 0x24]
push edi
call fcn.00527f20
pop ecx
push eax
push esi
call fcn.00527f20
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00527f20
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.005269c8
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x52e6ad
xor eax, eax
jmp 0x52e6f4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00527e90
add esp, 8
push 0x59403b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00527e90
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00527e90
add esp, 8
push 0x59403d
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00527e90
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53215c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x5321be
call fcn.0053210c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00527f20
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00527f20
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x53223c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x594708], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x532316
cmp dword [0x594704], 0
jne 0x532316
cmp dword [0x594930], 0
je 0x5322d0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00531fec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5322b6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00531fec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5322b6
lea ebx, [ebp - 0x84]
jmp 0x5322b7
inc ebx
call fcn.005321f8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x532351
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x59470c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00527f20
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x59470f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x532351
cmp dword [0x594704], 0
je 0x532330
cmp dword [0x594704], 0xffffffff
je 0x532351
push esi
call dword [0x594704]
pop ecx
mov eax, dword [0x594708]
test eax, eax
je 0x532351
cmp dword [0x594708], 0xffffffff
je 0x532351
cmp byte [eax], 0
je 0x532351
push esi
push eax
call fcn.0053215c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x532be8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x59e368], 0
jne 0x532c69
cmp dword [0x59e388], 0
jne 0x532c18
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x59e388], eax
test eax, eax
jne 0x532c18
push str.GetEnvironmentStrings_failed
call fcn.00532368
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x59e388]
jmp 0x532c2c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00527f20
pop ecx
mov edi, eax
test eax, eax
jne 0x532c24
lea edi, [ebp + 1]
push edi
call fcn.005269a8
pop ecx
mov ebx, eax
mov dword [0x59e36c], ebx
test ebx, ebx
jne 0x532c56
xor eax, eax
jmp 0x532d2c
push edi
mov edx, dword [0x59e388]
push edx
push ebx
call fcn.00527d7c
add esp, 0xc
jmp 0x532c89
xor esi, esi
mov ebx, dword [0x59e368]
jmp 0x532c83
push eax
call fcn.00527f20
pop ecx
test eax, eax
jne 0x532c7f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x532c73
lea ebx, [esi + 4]
push 4
mov dword [0x59e370], ebx
inc ebx
push ebx
call fcn.00526148
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x532cac
xor eax, eax
jmp 0x532d2c
cmp dword [0x59e368], 0
jne 0x532cdd
xor esi, esi
mov ebx, dword [0x59e36c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x532cce
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00527f20
pop ecx
mov edi, eax
test eax, eax
jne 0x532cc4
jmp 0x532d0e
xor esi, esi
mov ebx, dword [0x59e368]
mov eax, dword [esp]
mov edi, eax
jmp 0x532d08
push eax
call fcn.00527f20
pop ecx
test eax, eax
je 0x532cfd
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x532d01
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x532cec
mov eax, dword [0x59e368]
test eax, eax
je 0x532d1e
push eax
call fcn.005269b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x59e368], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x538448
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0052c018
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x5391c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x597258
call fcn.00528424
mov word [ebp - 0x14], 8
mov edx, 0x59746c
mov ecx, dword [ebx]
mov dword [ecx], edx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 8], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x10], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x18], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x1c], edx
mov ecx, dword [ebx]
add ecx, 0x20
push ecx
call fcn.0055e380
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x24], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x28], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x2c], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x30], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x34], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x38], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x3c], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebx]
add eax, 0x4c
push eax
call fcn.0045a67c
pop ecx
add dword [ebp - 8], 4
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53cb04
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x53cb2d
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x53cb2d
xor eax, eax
jmp 0x53cb30
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x53cb34
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov eax, 0x597d30
push ebx
mov ebx, dword [ebp + 8]
call fcn.00528424
mov dword [ebx], 0xffffffff
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
cmp dword [0x597d2c], 0
jne 0x53cb75
lea ecx, [ebp - 0x48]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x44]
mov dword [0x597d2c], eax
xor edx, edx
mov dword [ebx + 4], edx
cmp dword [0x597d2c], 0
ja 0x53cb8d
mov dword [0x597d2c], 0x1000
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53cc34
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile
test byte [esi + 8], 4
jne 0x53cd04
cmp dword [ebp - 4], 0
je 0x53cd04
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
jmp 0x53ccd9
mov al, byte [ebx]
movsx edx, al
cmp edx, 0xd
je 0x53cc8b
mov byte [edi], al
inc edi
jmp 0x53ccd8
cmp ebx, dword [ebp - 8]
jae 0x53cc9f
movsx ecx, byte [ebx + 1]
cmp ecx, 0xa
je 0x53ccd8
mov byte [edi], 0xd
inc edi
jmp 0x53ccd8
mov byte [ebp - 9], 0x20
lea eax, [ebp - 0x10]
push 0
push eax
lea edx, [ebp - 9]
push 1
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0x10], 0
je 0x53cccb
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SetFilePointer
movsx edx, byte [ebp - 9]
cmp edx, 0xa
je 0x53ccd8
mov byte [edi], 0xd
inc edi
inc ebx
cmp ebx, dword [ebp - 8]
ja 0x53cce6
movsx ecx, byte [ebx]
cmp ecx, 0x1a
jne 0x53cc7c
cmp ebx, dword [ebp - 8]
ja 0x53ccfe
push 1
push 0
mov eax, dword [ebp - 8]
inc eax
sub eax, ebx
push eax
mov edx, dword [esi]
push edx
call sub.KERNEL32.DLL_SetFilePointer
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53cd10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
test byte [eax + 8], 1
je 0x53cd39
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0053ce88
add esp, 0xc
mov ecx, dword [ebp + 8]
test byte [ecx + 8], 4
je 0x53cd63
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
jmp 0x53ce58
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], eax
lea ebx, [ebp - 0x102c]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x1000
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
jge 0x53cd8f
lea eax, [ebp - 0x10]
jmp 0x53cd92
lea eax, [ebp + 0x10]
mov edi, dword [eax]
jmp 0x53cde4
mov edi, dword [ebp - 0x14]
sub edi, esi
push edi
push esi
push ebx
call fcn.00527d7c
add ebx, edi
xor ecx, ecx
inc edi
add esp, 0xc
mov byte [ebx], 0xd
inc ebx
add esi, edi
mov byte [ebx], 0xa
inc ebx
mov edx, dword [ebp - 8]
sub edx, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jge 0x53cdcd
lea eax, [ebp - 0x18]
jmp 0x53cdd0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
sub edx, esi
mov dword [ebp - 0x20], edx
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jl 0x53cde2
lea eax, [ebp - 0x20]
mov edi, dword [eax]
test edi, edi
jle 0x53cdfb
push edi
push 0xa
push esi
call fcn.00528019
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x53cd96
test edi, edi
jle 0x53ce0e
push edi
push esi
push ebx
call fcn.00527d7c
add esp, 0xc
add ebx, edi
add esi, edi
lea eax, [ebp - 0x102c]
mov dword [ebp - 0x24], eax
sub ebx, eax
test ebx, ebx
je 0x53ce53
push 0
lea edx, [ebp - 0x28]
push edx
mov edi, ebx
push edi
mov eax, dword [ebp - 0x24]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_WriteFile
cmp edi, dword [ebp - 0x28]
je 0x53ce53
cmp dword [ebp - 0x28], 0
jne 0x53ce44
xor eax, eax
jmp 0x53ce7e
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x24], edx
sub edi, dword [ebp - 0x28]
mov ebx, edi
test ebx, ebx
jne 0x53ce1d
mov eax, esi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x53ce61
mov al, 1
jmp 0x53ce7e
test eax, eax
jle 0x53ce75
cmp eax, dword [ebp + 0x10]
jge 0x53ce75
sub dword [ebp + 0x10], eax
add dword [ebp + 0xc], eax
jmp 0x53cd20
xor eax, eax
jmp 0x53ce7e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53cf18
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x53cf84
mov eax, dword [ebp + 0x10]
mov edx, edi
and edx, 0xffffffff
push eax
mov eax, edi
push edx
cdq
mov eax, edx
xor edx, edx
push eax
push 4
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
je 0x53cf72
push 1
add edi, dword [ebp + 0x10]
push edi
push ebx
call fcn.0053ce88
add esp, 0xc
test eax, eax
jge 0x53cf86
mov edx, dword [ebp + 0x10]
push edx
push esi
push ebx
call fcn.0053cf90
add esp, 0xc
xor esi, esi
jmp 0x53cf86
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402530
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40257b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402574
test esi, esi
je 0x402574
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402550
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402760
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4027b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402888
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4027ee
cmp eax, 4
jne 0x402810
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4027fe
cmp edx, 4
je 0x4027fe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402760
Function at 0x404ab0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x404ae6
jmp 0x404b1e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404ae3
cmp al, 9
je 0x404ae3
cmp al, 0x22
jne 0x404b07
jmp 0x404b66
cmp al, 9
je 0x404b13
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x404b00
jmp 0x404b13
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404b10
cmp al, 9
je 0x404b10
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x404b2d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x404b72
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x404b62
cmp al, 0x22
jne 0x404b13
lea ebx, [edx + 2]
jmp 0x404b13