joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515120
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35e4
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x35e0], eax
cmp dword [0x58c8e0], 0xffffffff
push ebx
mov ebx, dword [esp + 0x35f8]
push esi
mov esi, dword [esp + 0x35f0]
push edi
mov edi, dword [esp + 0x35f8]
jne 0x5151c7
push 0x4001
push 0x2b4
lea eax, [esp + 0x8c]
push eax
push 0
push 0x558b90
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x88]
mov dword [0x604498], eax
lea eax, [esp + 0x25ec]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x8c]
push eax
push 0
lea eax, [esp + 0x25fc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x88]
mov dword [0x58c8e0], eax
push ebp
push 0x800
push edi
lea eax, [esp + 0x5f8]
push eax
call fcn.004bdae0
push 0x800
lea eax, [esp + 0x5f4]
push eax
push eax
call fcn.004a3940
movzx eax, word [esi]
lea ecx, [esp + 0x5f0]
mov ebp, eax
mov dword [esp + 0x10], 3
test ax, ax
mov dword [esp + 0x14], 0x40000000
mov dword [esp + 0x18], 0
lea eax, [esp + 0x33c]
mov dword [esp + 0x24], ecx
je 0x515262
push 0x4011
push 0x2b4
push eax
movzx eax, byte [esp + 0x360c]
shl eax, 4
push eax
mov eax, ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x340]
push 0x800
mov dword [esp + 0x30], eax
lea eax, [esp + 0x15f4]
push esi
push eax
call fcn.004bdae0
jmp 0x5152c0
push 0x4001
push 0x2b4
push eax
push 0
lea eax, [esp + 0x600]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x340]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x5f0]
push 0x800
push eax
lea eax, [esp + 0x15f8]
push eax
call fcn.004bdae0
lea eax, [esp + 0x15f0]
push eax
call fcn.004a37e0
lea eax, [esp + 0x5f0]
push eax
call fcn.004a3770
mov dword [esp + 0x24], eax
push 0x66
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x104d
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [esp + 0x10], 3
lea eax, [esp + 0x15f0]
mov dword [esp + 0x14], edi
test bp, bp
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], eax
pop ebp
je 0x515316
mov ecx, dword [0x58c8e0]
mov dword [esp + 0x28], ecx
jmp 0x51531f
mov eax, dword [0x604498]
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x104c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x48]
mov dword [esp + 0x50], 2
push eax
push edi
push 0x1074
push esi
mov dword [esp + 0x6c], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
jne 0x515376
lea eax, [esp + 0x48]
mov dword [esp + 0x58], 1
push eax
push edi
push 0x102b
push esi
mov dword [esp + 0x64], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x60097c]
pop edi
inc eax
mov dword [0x60097c], eax
pop esi
pop ebx
cmp eax, 1
jne 0x5153a2
push 0x4f5
call fcn.004b7300
push eax
push 2
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esp + 0x35e0]
xor ecx, esp
call fcn.00530218
add esp, 0x35e4
ret 0x10
Function at 0x517810
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1028
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x61800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea eax, [esp + 0xc]
push eax
push str.VerInfo
push 0x558ad0
call fcn.004d0040
push 1
push 0x800
lea eax, [esp + 0x30]
push eax
call fcn.004a2900
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.004a1860
push 0x800
push str.version.dat
lea eax, [esp + 0x30]
push eax
call fcn.004bda80
push 0x55ba0c
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
push eax
call fcn.004928f0
mov esi, eax
test esi, esi
je 0x5178bd
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0053c895
push esi
call fcn.005391cd
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x517986
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x517952
lea eax, [esp + 0x20]
push eax
push str.VerInfo
push 0x558ad0
call fcn.004d0ee0
call fcn.004d0b20
test al, al
jne 0x517921
push 0x558d34
lea eax, [esp + 0x2c]
push eax
call fcn.004928f0
mov esi, eax
test esi, esi
je 0x517921
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.00539653
push esi
call fcn.005391cd
add esp, 0x14
call fcn.004d0b30
movzx eax, al
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffe98
add eax, 0x168
mov dword [0x59440c], eax
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.00530218
add esp, 0x1028
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push str.VerInfo
push 0x558ad0
mov dword [esp + 0x14], ecx
call fcn.004d0ee0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x5179d6
cmp dword [esp + 0x10], eax
je 0x5179d6
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
call fcn.004d0b20
test al, al
jne 0x5179d6
push 0x558d34
lea eax, [esp + 0x2c]
push eax
call fcn.004928f0
mov esi, eax
test esi, esi
je 0x5179d6
push esi
push 0xc
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00539653
push esi
call fcn.005391cd
add esp, 0x14
mov eax, dword [esp + 0x24]
xor ecx, ecx
sub ecx, ecx
push 0xc9
sbb eax, dword [esp + 0x10]
sub ecx, dword [esp + 0xc]
push 0x2a69c000
sbb eax, 0
add ecx, dword [esp + 0x28]
adc eax, 0
push eax
push ecx
call fcn.00530260
mov dword [0x59440c], eax
test eax, eax
jns 0x517a14
mov dword [0x59440c], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.00530218
add esp, 0x1028
ret
Function at 0x51a340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5551c1
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.0051b180
test al, al
je 0x51a3a4
push 0x65
call fcn.004b7300
push 0x596
mov esi, eax
call fcn.004b7300
push 0x30
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
jmp 0x51a4b0
cmp byte [0x5943f4], 0
jne 0x51a3e0
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.0051b9c0
test al, al
jne 0x51a4b0
push esi
push 0x201
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 8
jmp 0x51a4b0
push 1
call fcn.004f8320
push 1
push 0x800
push 0x5a6eee
push str.Rar_EX
call fcn.004fd650
test al, al
je 0x51a4b0
push 0x800
push 0x5b332a
mov ecx, 0x5c3bd0
call fcn.004099c0
mov eax, dword [0x5c3bd4]
mov ecx, 0x5b432c
push 0x5588cc
mov dword [0x5ae2c8], eax
call fcn.004bdbd0
push 0x800
lea eax, [ebp - 0x1010]
mov dword [0x5ad2b4], 2
push eax
push esi
push 0x5a6eee
call fcn.004a2fb0
push 0
push 0
mov ecx, 0x5c3bd0
call fcn.00409480
cmp byte [0x5943f7], 0
jne 0x51a4b0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6355f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x610a64]
cmp eax, dword [ecx + 4]
jg 0x51a4cc
push 0
lea eax, [ebp - 0x1010]
mov ecx, 0x60ca30
push eax
call fcn.0051a8b0
push 0x60ca30
push 0x10000
push 0x519360
call fcn.00539c1c
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530218
mov esp, ebp
pop ebp
ret 4
push 0x610a64
call fcn.00530ada
add esp, 4
cmp dword [0x610a64], 0xffffffff
jne 0x51a486
mov dword [ebp - 4], 0
mov ecx, 0x60ca30
call fcn.00518790
push 0x555fd0
call fcn.005308d4
mov dword [ebp - 4], 0xffffffff
push 0x610a64
call fcn.00530a90
add esp, 8
jmp 0x51a486
Function at 0x51a6c0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x6060]
mov eax, 0x6060
call fcn.00530230
push 0xffffffffffffffff
push 0x555205
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp + 0x605c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x6070]
mov edi, dword [ebp + 0x6068]
mov esi, dword [ebp + 0x606c]
push eax
call fcn.004a3770
mov edx, esi
mov ebx, eax
lea eax, [edx + 2]
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x51a720
mov ecx, ebx
sub edx, eax
sar edx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x51a737
sub ecx, dword [ebp - 0x10]
sar ecx, 1
lea eax, [ecx + 1]
add eax, edx
cmp eax, 0x1000
jb 0x51a75a
xor al, al
jmp 0x51a885
push 0x1000
lea eax, [ebp + 0x5c]
push eax
push ebx
push esi
call fcn.004a2fb0
lea ecx, [ebp]
call fcn.004bdb30
mov dword [ebp - 4], 0
lea eax, [ebp + 0x205c]
push 0x1000
push 0x558718
push eax
push str.ViewerIgnoreModifications
push 0x55925c
call fcn.004d0210
cmp word [ebp + 0x205c], 0
je 0x51a7b7
push 0
push 0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x205c]
push eax
call fcn.004d9390
push 0x800
lea eax, [ebp + 0x405c]
push eax
lea ecx, [ebp]
call fcn.004bdcd0
test al, al
je 0x51a86a
push 0x800
lea eax, [ebp + 0x505c]
push eax
lea eax, [ebp + 0x405c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x51a84e
cmp eax, 0x800
jae 0x51a84e
lea eax, [ebp + 0x505e]
push 0x56dd54
push eax
call fcn.00532adb
mov esi, eax
add esp, 8
test esi, esi
je 0x51a838
xor eax, eax
mov word [esi], ax
add esi, 4
cmp word [esi], ax
jne 0x51a823
mov esi, 0x5588cc
push 5
push edi
lea eax, [ebp + 0x505c]
push eax
call fcn.004969c0
test al, al
je 0x51a84e
jmp 0x51a83e
lea esi, [ebp + 0x505c]
push 5
lea eax, [ebp + 0x5c]
push eax
push esi
call fcn.004969c0
test al, al
jne 0x51a8aa
push 0x800
lea eax, [ebp + 0x405c]
push eax
lea ecx, [ebp]
call fcn.004bdcd0
test al, al
jne 0x51a7d3
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp]
test eax, eax
je 0x51a883
push eax
call fcn.0053867f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x605c]
xor ecx, ebp
call fcn.00530218
lea esp, [ebp + 0x6060]
pop ebp
ret 0xc
mov bl, 1
jmp 0x51a86c
Function at 0x51c050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5553ab
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x58cb30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
jne 0x51c1d0
push 2
push 0x559250
push 0x55925c
call fcn.004cffa0
mov esi, eax
cmp esi, 3
jne 0x51c0c4
push edi
push 0x51b380
push dword [0x5933dc]
push 0x56dd7c
push dword [0x5d3758]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
cmp esi, 0xffffffff
je 0x51c1db
test esi, esi
je 0x51c108
push edi
call fcn.0051b180
test al, al
je 0x51c108
push 0x65
call fcn.004b7300
push 0x596
mov esi, eax
call fcn.004b7300
push 0x30
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub esi, 0
je 0x51c1d0
sub esi, 1
je 0x51c238
sub esi, 1
jne 0x51c1db
push str.rarreg.key
push edi
call fcn.004a3770
push eax
call fcn.004c1ba0
test eax, eax
je 0x51c1db
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6355f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x60ca2c]
cmp eax, dword [ecx + 4]
jg 0x51c24d
push 1
push edi
mov ecx, 0x6089f8
call fcn.0051a8b0
mov al, byte [ebp + 0xc]
push 0
push 0x6089f8
xor al, 1
movzx eax, al
push eax
push 0
push 0
push edi
push 0
call fcn.0051b9c0
test al, al
jne 0x51c1f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x608a00]
mov esi, eax
cmp edx, 0xffffffff
je 0x51c1ad
push edx
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x608a00], 0xffffffff
mov ecx, 0x60ca1c
call fcn.004baba0
cmp esi, 0x4c7
je 0x51c1db
push 0
push dword [ebp + 0xc]
mov ecx, ebx
push edi
call fcn.0051a020
test al, al
jne 0x51c1db
push dword [ebp + 0xc]
push edi
mov ecx, ebx
call fcn.0051aab0
mov byte [ebx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [ebp + 0xc], 0
je 0x51c211
push 0x6089f8
push 0x10000
push 0x519360
call fcn.00539c1c
add esp, 0xc
jmp 0x51c1db
mov eax, dword [0x608a00]
cmp eax, 0xffffffff
je 0x51c22c
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x608a00], 0xffffffff
mov ecx, 0x60ca1c
call fcn.004baba0
jmp 0x51c1db
mov esi, dword [ebp + 0xc]
mov ecx, ebx
push 0
push esi
push edi
call fcn.0051a020
test al, al
jne 0x51c1db
push esi
jmp 0x51c1d3
push 0x60ca2c
call fcn.00530ada
add esp, 4
cmp dword [0x60ca2c], 0xffffffff
jne 0x51c15c
mov dword [ebp - 4], 0
mov ecx, 0x60ca1c
call fcn.004ba930
mov byte [ebp - 4], 0
push 0x555f30
call fcn.005308d4
mov dword [ebp - 4], 0xffffffff
push 0x60ca2c
call fcn.00530a90
add esp, 8
jmp 0x51c15c
Function at 0x51c2a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x594410
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x51c2da
push 0x2bc
call fcn.004b7300
push 0x2bd
mov esi, eax
call fcn.004b7300
push 0x40
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
pop esi
ret
push 0
push 0x594410
mov ecx, esi
call fcn.0051aab0
pop esi
ret
Function at 0x5239f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push 0x634990
mov esi, ecx
call fcn.00483130
mov ebx, dword [esp + 0xc]
mov dword [esi + 0x1e0], 0x12345678
mov dword [esi + 0x1e4], 0x23456789
mov dword [esi + 0x1e8], 0x34567890
mov cl, byte [ebx]
test cl, cl
je 0x523a84
push edi
mov eax, 0x12345678
mov edi, 0x23456789
mov edx, 0x34567890
movsx ecx, cl
lea ebx, [ebx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x634990]
movzx ecx, al
add ecx, edi
mov dword [esi + 0x1e0], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [esi + 0x1e4], edi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x634990]
mov dword [esi + 0x1e8], edx
mov cl, byte [ebx]
test cl, cl
jne 0x523a36
pop edi
pop esi
pop ebx
ret 4

Function at 0x523a90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp byte [0x5b4504], 0
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, dword [esp + 0x10]
je 0x523b72
push ebx
mov ebx, ecx
imul ebx, eax
cmp byte [esi + 4], 0
je 0x523ade
push ebx
push edi
lea eax, [esi + 8]
push eax
call fcn.004ea6f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
pop ebx
push 0
push eax
push ecx
push edi
mov ecx, esi
call fcn.00522300
pop edi
pop esi
ret 0xc
push ebp
mov ebp, edi
test ebx, ebx
je 0x523b70
lea esp, [esp]
movsx eax, byte [ebp]
lea ebp, [ebp + 1]
mov ecx, dword [esi + 0x1e0]
xor eax, ecx
mov edx, dword [esi + 0x1e8]
mov edi, edx
movzx eax, al
and edi, 0xfffd
shr ecx, 8
or edi, 2
xor ecx, dword [eax*4 + 0x634990]
movzx eax, cl
add eax, dword [esi + 0x1e4]
imul eax, eax, 0x8088405
mov dword [esi + 0x1e0], ecx
inc eax
mov dword [esi + 0x1e4], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x634990]
mov eax, edi
xor eax, 1
mov dword [esi + 0x1e8], edx
imul eax, edi
shr eax, 8
xor byte [ebp - 1], al
sub ebx, 1
jne 0x523af0
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
pop ebp
pop ebx
push 0
push eax
push ecx
push edi
mov ecx, esi
call fcn.00522300
pop edi
pop esi
ret 0xc
Function at 0x52d4d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x50
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov esi, dword [esp + 0x58]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x52d51a
test al, 0x10
jne 0x52d505
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x52d51a
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00530218
add esp, 0x50
ret 4
xor eax, eax
mov dword [esp + 0x10], 0x558718
mov dword [esp + 0x28], eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x64b7ac]
mov dword [esp + 0x14], 0x558718
mov dword [esp + 0x18], 0x558718
mov dword [esp + 0x1c], 0x558718
mov dword [esp + 0x20], 0x558718
mov dword [esp + 0x24], 0x558718
mov dword [esp + 0x50], 0x11
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x48], 2
call fcn.004bf7b0
mov ecx, dword [esp + 0x54]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00530218
add esp, 0x50
ret 4

Function at 0x5312ca
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x531309
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x531309
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x531309
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x531309
cmp dword [ecx + 0x74], 0xe
jbe 0x531309
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x53ade9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x635858]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x53ae29
cmp byte [ebx], 0xa
jne 0x53ae29
or byte [eax + edi + 0x28], 4
jmp 0x53ae2e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x53af2c
mov al, byte [edx]
cmp al, 0x1a
je 0x53af0e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x53ae5d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x53ae82
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x53ae8c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x53ae3f
jmp 0x53af2c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53af09
cmp dword [ebp - 0xc], 0
je 0x53af09
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x635858]
test byte [eax + edi + 0x28], 0x48
je 0x53aee3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x53aece
mov byte [esi], dl
jmp 0x53aedf
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x635858]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x53af2c
cmp byte [ebp - 1], 0xa
jne 0x53aef2
cmp esi, ebx
jne 0x53aef2
mov byte [esi], 0xa
jmp 0x53af2b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0053ad8b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x53af2c
mov byte [esi], 0xd
jmp 0x53af2b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x635858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x53af28
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x53af2c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x53af35
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x635858]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x53af78
cmp word [esi], dx
jne 0x53af78
or byte [edi + eax + 0x28], 4
jmp 0x53af7d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x53b0d0
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x53b0b0
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x53afbf
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x53aff5
cmp eax, edx
jae 0x53b001
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x53af97
jmp 0x53b0d0
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x53b0ac
cmp dword [ebp - 0x14], 0
je 0x53b0ac
mov eax, dword [ebx*4 + 0x635858]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x53b084
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x53b04d
mov word [esi], cx
jmp 0x53b080
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x635858]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x635858]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x635858]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x53b0d0
pop ebx
cmp word [ebp - 4], bx
jne 0x53b095
cmp esi, dword [ebp + 0xc]
jne 0x53b095
mov word [esi], bx
jmp 0x53b0cd
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0053ad8b
add esp, 0x10
cmp word [ebp - 4], bx
je 0x53b0d0
push 0xd
jmp 0x53b0c9
mov ecx, dword [ebx*4 + 0x635858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x53b0c7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x53b0d0
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x541f5e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5722b4
push 0x5722ac
push str.FlsAlloc
push 0x1e
call fcn.00541ddf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x541f92
push dword [ebp + 8]
mov ecx, esi
call dword [0x55770c]
call esi
jmp 0x541f98
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x541fdc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5722c4
push 0x5722bc
push str.FlsGetValue
push 0x20
call fcn.00541ddf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x542013
push dword [ebp + 8]
mov ecx, esi
call dword [0x55770c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]