joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52bc80
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [0x53e77c]
or esi, 1
shl esi, 0x14
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
pop edi
add edi, esi
or edi, 8
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
imul ebx, edi
lea edi, [ebx + ebx*8]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call fcn.0053a590
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
add ebx, eax
add esi, ebx
mov edi, esi
imul edi, eax
add esi, edi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x1c]
and ecx, esi
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov esi, ecx
mov dword [esp + 4], ecx
call fcn.00525110
add esp, 0x10
mov ecx, edi
mov dword [ebp - 0x24], eax
xor ecx, eax
mov dword [ebp - 0x1c], esi
add ecx, esi
imul ecx, edi
sub ecx, 0xffffff80
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0xc4]
push eax
push 0x5d
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x20], eax
call fcn.0053a080
mov esi, eax
sub esp, 4
call fcn.0053a860
add esp, 4
mov ecx, eax
push ebx
pop eax
mov dword [ebp - 0x18], 0
cmp esi, ebx
jg 0x52bdbe
cmp eax, edi
je 0x52bdbe
cmp dword [0x53e4c0], 0xbf062cfb
jne 0x52bdbe
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
push ecx
pop ebx
call dword [sym.imp.USER32.dll_EndDialog]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push ebx
pop ecx
movsx edx, al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
add esi, edx
push esi
pop ebx
mov edx, dword [ebp - 0x10]
sub ebx, edx
mov dword [ebp - 0x20], esi
cmp ebx, edi
jg 0x52bdc5
cmp eax, ecx
jg 0x52bdc5
cmp ebx, dword [ebp - 0x1c]
je 0x52bdc5
cmp dword [0x53e360], 0xeddc076a
jne 0x52bdc5
mov esi, eax
lea eax, [ebp - 0x67]
push eax
push 0x43
push ecx
pop edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, edi
mov edx, eax
push esi
pop eax
cmp ebx, ecx
je 0x52bdc9
jmp 0x52bdf3
mov edx, dword [ebp - 0x10]
cmp ebx, edi
jle 0x52bd8d
cmp ebx, ecx
jne 0x52bdf3
cmp dword [ebp - 0x20], eax
jne 0x52bdf3
cmp edx, dword [ebp - 0x24]
je 0x52bdf3
cmp dword [0x53e844], 0x7cbb4317
jne 0x52bdf3
push dword [ebp - 0x18]
push edx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, esi
add edx, dword [ebp - 0x18]
add edx, eax
mov eax, edx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52dd80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
movsx ebx, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
lea esi, [ebx + ecx]
cmp eax, 0xe6d71490
je 0x52ddf3
mov dword [ebp - 0x10], esi
movsx ecx, bl
xor ecx, 0x10
sub ecx, eax
push ecx
pop edx
xor edx, eax
and edx, ebx
movsx esi, dl
mov edi, esi
mov eax, dword [ebp + 8]
imul edi, eax
cmp dword [ebp + 0x10], 0x2f342662
jne 0x52ddee
cmp si, bx
jne 0x52ddee
movsx eax, di
add ecx, eax
mov esi, dword [ebp - 0x10]
movsx eax, si
cmp ecx, eax
jg 0x52ddf5
movsx edx, dl
cmp ecx, edx
je 0x52ddf5
mov ecx, dword [ebp + 8]
movsx ecx, cx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x52ddf5
mov esi, dword [ebp - 0x10]
jmp 0x52ddf5
mov edi, esi
add edi, edi
or edi, 8
lea eax, [ebx + edi]
movsx eax, al
mov dword [ebp - 0x14], eax
push esi
pop eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x530280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
pop esi
and esi, ebx
mov dword [ebp - 0x10], 0
cmp ebx, 0xe9273a9b
jne 0x5302e8
cmp eax, 0xe9273a9b
mov edi, 0xe9273a9b
je 0x5302ea
or esi, esi
jne 0x5302ea
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 0x10]
movsx ecx, dl
add ecx, eax
mov dword [ebp - 0x10], ecx
add ecx, ebx
movsx ecx, cl
cmp ecx, eax
je 0x5302ea
cmp edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
jne 0x5302dd
cmp ecx, edx
jle 0x5302dd
cmp eax, ebx
je 0x5302ea
add eax, ecx
mov dword [ebp - 0x10], eax
xor eax, edx
push eax
pop edi
jmp 0x5302ea
push ebx
pop edi
mov dword [ebp - 0x10], edi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x530aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
push eax
mov eax, dword [0x53e3e8]
lea ecx, [eax + 4]
or ecx, 1
add ecx, eax
mov edi, 0xfffffffc
sub edi, ecx
mov eax, edi
neg eax
sub esp, 4
push 0
push 0xc414b77a
push eax
call fcn.0052b8b0
add esp, 0x10
add eax, 8
push 0
push 0xc414b77a
push eax
call fcn.0052b1f0
add esp, 0xc
mov esi, eax
sub esi, edi
mov ecx, esi
imul ecx, eax
mov dword [ebp - 0x10], ecx
cmp dword [0x53e43c], 0x5eb51a09
jne 0x530b15
cmp eax, esi
jg 0x530b15
shl ecx, 0xb
lea edx, [ecx + esi]
mov dword [ebp - 0x10], edx
push eax
push edx
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esi + eax - 0x7eaa4113]
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x8155beed
call fcn.0052ee30
add esp, 0x14
push eax
pop esi
add esi, 0x200
imul esi, dword [ebp - 0x10]
mov bl, byte [0x53e438]
push 0x1b
push 0x7c
call fcn.00528e90
add esp, 8
movzx eax, al
push 0
push 0x80
push eax
call fcn.0052c770
add esp, 0xc
xor al, bl
xor al, 0x1b
add esi, 0x24
movsx ecx, al
imul ecx, esi
mov dword [ebp - 0x10], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x531d00
Capabilities:
Get graphical window text

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push eax
mov ebx, dword [str._Mw]
push ebx
pop ecx
and ecx, 1
movsx edx, byte [0x53e395]
xor edx, 0xffffffe0
mov eax, dword [0x53e370]
cmp ecx, edx
je 0x531d53
mov ebx, ecx
shl ebx, 0x10
push ebx
pop ecx
xor ecx, edx
cmp eax, 0xa001c681
jne 0x531d63
cmp ebx, edx
jle 0x531d63
and ebx, ecx
push ecx
push edx
push ecx
mov esi, edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, esi
or ebx, eax
mov byte [ebp - 9], bl
movsx ecx, bl
xor ecx, eax
jmp 0x531d63
or ebx, 0x100
imul ebx, ecx
cmp eax, 0xa001c681
je 0x531d34
mov byte [ebp - 9], cl
mov eax, edx
add esp, 4
pop esi
pop ebx
pop ebp
ret

Function at 0x535060
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x53e410]
push eax
pop esi
xor esi, 8
and eax, 8
push 0
push 0
push 0xffffffffffffffff
push eax
call fcn.0052d1b0
add esp, 0x10
or eax, esi
movsx edi, al
mov esi, 0x3dd69f6d
xor esi, dword [0x53e40c]
mov dword [ebp - 0x10], edi
push 0
push edi
push 0
call fcn.0052b1f0
add esp, 0xc
lea ebx, [edi + eax + 8]
lea ecx, [edi + 8]
cmp esi, ecx
je 0x5350bd
movsx eax, bl
mov edi, dword [ebp - 0x10]
add edi, eax
mov dword [ebp - 0x10], edi
xor edi, eax
cmp dword [0x53e3e8], 0xea9245a0
jne 0x5350fc
movsx eax, bl
cmp ecx, eax
jne 0x5350fc
shl ebx, 0x18
imul ebx, edi
sar ebx, 0x18
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push eax
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebp - 0x14]
push eax
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
imul eax, edi
mov dword [ebp - 0x10], eax
push esi
pop eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x536c50
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
push eax
mov eax, dword [0x53e4c0]
lea edi, [eax + eax + 1]
add eax, eax
mov ebx, dword [0x53e510]
mov esi, ebx
xor esi, 0x321b791e
xor eax, 0xfffffffe
push 0
push eax
push 0x45ef6f40
call fcn.00530280
add esp, 0xc
push edi
pop ecx
and ecx, 0xba1090bf
or ecx, eax
xor ecx, ebx
xor ecx, 0x77f4165e
imul ecx, edi
push ecx
pop edi
imul edi, esi
cmp ecx, esi
jne 0x536caf
and edi, 0x400
mov ecx, edi
add edi, 0x400
sub eax, eax
cmp dword [0x53e410], 0x4d6e25eb
jne 0x536cdc
cmp ecx, esi
je 0x536cdc
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movsx ecx, al
add ecx, esi
push esi
pop eax
imul eax, ecx
movsx eax, al
cmp eax, ecx
je 0x536d00
cmp ecx, esi
je 0x536ce8
cmp ecx, edi
jg 0x536d00
add eax, esi
mov dword [ebp - 0x10], eax
sub eax, edi
movsx eax, al
push 0
push edi
push eax
call fcn.0052e990
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x10], edi
push esi
pop eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x537a00
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
shl eax, 6
cmp ecx, edx
mov esi, 0x3e7
jg 0x537a1f
xor esi, esi
and eax, ecx
movsx eax, al
add eax, esi
push esi
pop ecx
mov dword [ebp - 0x18], eax
movsx esi, al
push esi
pop edi
not edi
and edi, ecx
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [ebp - 0x14], ecx
push ecx
call fcn.0052d970
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x10], esi
and ebx, esi
or ebx, edi
imul ebx, dword [ebp + 0xc]
and ebx, dword [ebp + 8]
push 0
push 0
push 1
push 0
call fcn.0052ca90
add esp, 0x10
mov ecx, ebx
sub cl, al
movsx eax, cl
cmp eax, dword [ebp + 8]
je 0x537a9e
mov esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0x10]
je 0x537aa6
cmp esi, eax
je 0x537aa6
push eax
pop ebx
mov ecx, dword [ebp - 0x18]
add bl, cl
mov eax, ebx
mul cl
movsx edi, al
call fcn.0052e440
mov dword [ebp - 0x10], edi
imul eax, edi
movsx edi, ax
jmp 0x537aa9
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x14]
jmp 0x537aa9
mov dword [ebp - 0x10], eax
call fcn.0052f850
mov ecx, dword [ebp + 8]
cmp eax, ecx
jne 0x537ae6
movsx eax, bl
mov edx, dword [ebp - 0x10]
cmp dx, ax
je 0x537ae6
cmp eax, ecx
jg 0x537ae6
push esi
pop edi
movsx esi, dx
push dword [ebp + 0xc]
push esi
push esi
push ecx
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, edi
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push eax
pop edi
mov dword [ebp - 0x1c], edi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x539e30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
movsx eax, byte [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov bh, byte [ebp + 8]
mov bl, al
add bl, al
sub esp, 4
push 0
push eax
push eax
call fcn.0052b8b0
add esp, 0x10
xor bl, byte [ebp - 0x18]
movsx eax, bh
mov dword [ebp - 0x14], eax
add bl, bh
inc bl
movsx edi, bl
push ebx
pop eax
mul bh
mov byte [ebp - 0xd], al
movsx ebx, al
push edi
push 0
call fcn.0052e730
add esp, 8
push eax
pop esi
add esi, ebx
sub esp, 0x14
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.0052ee30
add esp, 0x14
mov edi, dword [str._Mw]
call fcn.00530c90
mov dh, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x18]
mov dl, byte [ebp + 8]
cmp dh, cl
jg 0x539ef4
cmp cl, dl
jne 0x539ef4
cmp dh, dl
je 0x539ef4
cmp edi, eax
jne 0x539ef4
push ecx
pop edi
push edx
pop ebx
call fcn.00529120
push 0x901d6211
push eax
call fcn.005278d0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, eax
mov eax, dword [ebp - 0x14]
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, ebx
push edi
pop ecx
xor ebx, ebx
cmp cl, dl
mov edi, 0x2ed
je 0x539f01
sub edi, edi
push 0
push 0xffffffffffffffff
push edi
call fcn.00530280
add esp, 0xc
cwde
cmp eax, esi
je 0x539f33
imul esi, eax
cmp esi, eax
jne 0x539f33
or esi, eax
mov eax, dword [ebp - 0x14]
and eax, esi
push 0xffffffffffffffff
push eax
call fcn.0052f3f0
add esp, 8
not eax
and eax, esi
movsx ebx, al
mov dword [ebp - 0x1c], ebx
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x539f40
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x114
mov ebx, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, dword [ebp + 8]
cwde
mov dword [esp + 4], eax
call fcn.0053a9a0
mov ecx, dword [0x53e5c4]
mov dword [esp + 8], ecx
mov dword [ebp - 0x18], eax
mov dword [esp + 4], eax
call fcn.0053a4e0
mov dword [ebp - 0x14], eax
push ebx
pop esi
shl esi, 0x10
lea eax, [ebp - 0x111]
mov dword [esp + 4], eax
mov dword [esp], 0x5b
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
push eax
pop edi
imul edi, ebx
push edi
pop eax
or eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [esp], edi
call fcn.0053a730
mov dword [ebp - 0x10], esi
imul eax, esi
sar eax, 0x10
mov ecx, dword [ebp + 0x10]
lea ebx, [edi + ecx]
add ebx, eax
mov esi, ebx
add ebx, dword [ebp - 0x1c]
xor esi, 0x10000
lea eax, [ebp - 0xb6]
mov dword [esp + 4], eax
mov dword [esp], 0x56
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0x44
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
call fcn.0053a680
push eax
pop edx
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], eax
je 0x53a031
cmp esi, edi
push esi
pop edi
jne 0x53a026
push edx
pop esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, esi
push eax
pop ebx
add ebx, 0x40
cmp dword [ebp + 8], 0x335d0650
je 0x53a03c
jmp 0x53a06e
mov edi, esi
cmp dword [ebp + 8], 0x335d0650
jne 0x53a06e
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], eax
jg 0x53a06e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
imul ecx, eax
sar ecx, 0x10
imul ecx, eax
sar ecx, 0x10
and ecx, dword [ebp - 0x14]
movsx eax, bx
cmp ecx, eax
jne 0x53a06e
mov dword [esp], edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
sub esp, 4
mov edi, eax
mov eax, edi
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x53a080
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, 0x4000
add eax, dword [0x53e504]
push eax
pop ecx
shl ecx, 9
imul eax, ecx
lea edx, [eax + ecx]
imul ecx, edx
sub ecx, edx
mov esi, ecx
sub esi, eax
imul esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov eax, esi
xor eax, edi
movsx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x200
mov dword [ebp - 0x18], eax
mov ecx, esi
imul ecx, eax
push ecx
push edi
push esi
call fcn.0053a240
add esp, 0xc
or ebx, eax
push eax
pop ecx
xor ecx, ebx
xor ecx, esi
movsx ecx, cx
xor ebx, ecx
lea edi, [ebx + 0x80]
mov dword [ebp - 0x10], edi
xor edi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
and edi, eax
add esi, edi
mov dword [ebp - 0x1c], esi
push esi
push dword [ebp - 0x18]
push eax
mov esi, ecx
push ecx
call fcn.00539f40
add esp, 0x10
lea ebx, [ebx + eax + 0x80]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x10]
push ebx
mov dword [ebp - 0x28], edi
push edi
call fcn.0053a450
add esp, 0xc
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
call edi
push eax
pop edi
imul ebx, eax
lea ecx, [esi + ebx + 4]
add esi, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
or eax, ecx
sub esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [esp + 4], esi
mov esi, dword [ebp - 0x2c]
mov dword [esp], ebx
push eax
pop ebx
mov dword [esp + 0xc], eax
call fcn.00525ef0
add esp, 0x10
mov dword [ebp - 0x20], edi
cmp edi, esi
mov dword [ebp - 0x30], ebx
je 0x53a1bf
cmp dword [0x53e604], 0x92905ecb
jne 0x53a1bf
movsx esi, ax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x14], eax
push ebx
push esi
push dword [ebp - 0x1c]
push esi
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov edi, eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_CopyRect]
mov esi, eax
push dword [ebp - 0x20]
push ebx
push edi
mov ebx, dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_GetMessageW]
mov ecx, dword [ebp - 0x14]
jmp 0x53a1c8
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
cmp edi, ebx
mov ebx, dword [ebp - 0x30]
jne 0x53a20f
cmp ebx, edi
je 0x53a20f
cmp edi, dword [ebp - 0x10]
jle 0x53a20f
cmp ecx, dword [ebp - 0x20]
je 0x53a21e
cmp dword [0x53e360], 0xd96dbcff
jne 0x53a21e
cwde
push ecx
push eax
push edi
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
push dword [ebp - 0x20]
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetMessageA]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
movsx edi, ax
add edi, ecx
mov dword [ebp - 0x10], edi
or edi, ebx
cmp ecx, dword [ebp - 0x20]
jne 0x53a1dd
mov eax, dword [ebp - 0x28]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x53a2d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, edi
xor eax, dword [ebp + 0x14]
xor eax, 2
movsx esi, al
and esi, ebx
lea eax, [ebp - 0x63]
push eax
push 0x57
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, edi
push eax
pop edi
push eax
pop ecx
imul ecx, esi
cmp edx, 0xcd38faac
jne 0x53a32f
cmp dword [ebp + 0x14], ebx
je 0x53a32f
movsx eax, cl
add esi, ebx
add esi, eax
push edi
push ebx
push 0xcd38faac
mov eax, dword [ebp + 0x14]
push eax
push ebx
push edx
pop ebx
call dword [sym.imp.GDI32.dll_SetRectRgn]
push ebx
pop edx
mov ecx, esi
push eax
pop esi
mov eax, dword [ebp + 0x14]
cmp eax, edx
je 0x53a33a
cmp edi, eax
je 0x53a344
movsx eax, cl
or eax, esi
imul eax, edx
push eax
pop esi
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x53a590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd0
mov eax, dword [ebp + 8]
mov edi, eax
imul edi, eax
shl edi, 0xa
mov ebx, edi
and ebx, eax
imul edi, ebx
add ebx, edi
and edi, ebx
lea eax, [ebp - 0x92]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x10], eax
push dword [0x53e43c]
push eax
push edi
push ebx
call fcn.00539f40
add esp, 0x10
mov esi, eax
push eax
pop edi
not edi
and edi, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, dword [ebp - 0x10]
push eax
pop ebx
xor ebx, edi
or edi, eax
push esi
push edi
push eax
call fcn.0053a240
add esp, 0xc
push eax
pop ecx
mov esi, dword [ebp + 8]
xor ecx, esi
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00525ef0
add esp, 0x10
lea eax, [ebp - 0xdc]
push eax
push 0x4a
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call ebx
mov edi, eax
imul edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x50]
push eax
push 0x40
call ebx
push eax
pop ebx
mov esi, eax
imul esi, dword [ebp + 8]
push edi
add edi, 4
push eax
push esi
call fcn.0053a450
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp ebx, ecx
jne 0x53a664
cmp eax, ecx
je 0x53a65d
cmp ebx, esi
je 0x53a664
and eax, 2
add eax, ebx
mov edi, eax
push edi
pop eax
add esp, 0xd0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x53a680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov al, byte [0x53e4c8]
inc al
mov byte [ebp - 0xd], al
movsx ebx, al
lea eax, [ebp - 0x61]
mov dword [esp + 4], eax
mov dword [esp], 0x4d
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov esi, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x80
call fcn.00524fe0
mov edi, eax
add edi, 0x400
imul edi, esi
shl edi, 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop esi
mov dword [ebp - 0x14], eax
shl esi, 7
push esi
pop eax
and eax, ebx
mov dword [esp + 4], eax
call fcn.00526a40
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
call fcn.0053a2d0
lea ecx, [eax + edi + 0xf80]
mov edx, ecx
xor edx, ebx
xor ebx, esi
xor esi, eax
or esi, ebx
or esi, edx
mov dl, byte [ebp - 0xd]
je 0x53a723
add eax, 0xf80
xor ecx, eax
imul ecx, dword [ebp - 0x14]
push ecx
pop edx
movsx eax, dl
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x53a730
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x78
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop edi
mov eax, dword [0x53e81c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
add edi, 0x40
call fcn.00524fe0
imul edi, eax
mov ecx, dword [0x53e83c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call fcn.0053a2d0
push eax
pop ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsx esi, bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [eax + 0x20]
mov dword [ebp - 0x14], esi
and ecx, esi
add ecx, eax
movsx ebx, cl
push ebx
pop edi
xor edi, 0x1000
add edi, ebx
xor ebx, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
add edi, eax
mov dword [esp + 4], edi
call fcn.00526a40
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
or esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 0x10]
push esi
pop ecx
add edi, eax
movsx esi, bl
cmp esi, dword [ebp + 8]
jle 0x53a7eb
cmp ecx, edx
je 0x53a7ef
cmp edx, dword [ebp + 8]
je 0x53a7eb
cmp ecx, dword [ebp - 0x14]
jg 0x53a7ef
sub ebx, ebx
mov edx, edi
cmp edx, ecx
jne 0x53a7f7
test edx, edx
js 0x53a81e
lea esi, [ebp - 0x71]
mov dword [esp + 4], esi
mov dword [esp], 0x55
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
push edx
pop esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov edx, esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
movsx esi, bl
cmp edx, esi
jne 0x53a845
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
or ecx, edx
push ecx
pop edx
shl edx, 0x18
imul edx, edi
sar edx, 0x18
cmp eax, edx
jne 0x53a845
movsx eax, cl
imul eax, dword [ebp + 8]
jmp 0x53a84b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x78
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x53a860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov ebx, dword [0x53e4f8]
shl ebx, 0xd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
pop esi
or ebx, eax
or ebx, 1
lea eax, [ebp - 0xaf]
push eax
push 0x4e
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop edi
push dword [0x53e568]
push ebx
push esi
push eax
call fcn.00539f40
add esp, 0x10
mov esi, eax
imul esi, ebx
lea eax, [esi + 0x1000]
push edi
push esi
push eax
call fcn.0053a450
add esp, 0xc
lea eax, [esi + eax + 0x1000]
imul eax, esi
mov edi, eax
imul edi, esi
and edi, eax
imul edi, esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop esi
lea eax, [ebp - 0x10f]
push eax
push 0x60
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, eax
xor ebx, esi
mov dword [ebp - 0x20], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
mov ecx, esi
push eax
pop esi
xor esi, ebx
imul esi, edi
call ecx
mov ebx, eax
mov eax, edi
mov dword [ebp - 0x10], esi
imul eax, esi
cwde
sub esp, 0x10
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0xc], eax
call fcn.00525ef0
add esp, 0x10
mov esi, eax
push eax
mov dword [ebp - 0x1c], ebx
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
call fcn.0053a240
add esp, 0xc
mov dword [ebp - 0x14], esi
cmp ebx, esi
jg 0x53a96f
cmp dword [0x53e83c], 0x94fda61d
jne 0x53a96f
cmp ebx, dword [ebp - 0x10]
jne 0x53a96f
mov dword [ebp - 0x18], eax
movsx edi, ax
add edi, ebx
lea eax, [ebp - 0x61]
push eax
push 0x41
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, eax
cmp edi, dword [ebp - 0x1c]
je 0x53a982
imul ebx, esi
mov eax, dword [ebp - 0x18]
jmp 0x53a96f
cwde
mov ecx, dword [ebp - 0x14]
xor ebx, ecx
cmp edi, ecx
je 0x53a97b
mov esi, ebx
cmp dword [ebp - 0x10], eax
jg 0x53a982
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, eax
add esi, dword [ebp - 0x14]
imul eax, esi
add esp, 0x104
pop esi
pop edi
pop ebx
pop ebp
ret