joyce8/EMBER2024-capa huggingface dataset:
Function at 0x520815
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x5c
mov eax, 0x56a842
call fcn.0054f7e3
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x52082d
mov eax, dword [esi]
jmp 0x52082f
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
je 0x520843
mov al, 1
jmp 0x5209ae
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
push esi
call fcn.0040764c
mov byte [ebp - 4], 1
xor edi, edi
push edi
mov edx, esi
lea ecx, [ebp - 0x5c]
call fcn.00520194
pop ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x520970
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x52089d
lea eax, [ecx - 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00439a86
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x52092a
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
call fcn.0040a573
test al, al
jne 0x52092a
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x52092a
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00407855
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.005203cf
mov byte [ebp - 4], 3
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.0040a573
test al, al
jne 0x52091b
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401eb3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
push edi
push 1
call fcn.00401c9b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x52087b
jmp 0x52092a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
push edi
push 1
call fcn.00401c9b
mov edi, dword [ebp - 0x64]
jmp 0x52096b
add edi, 0xffffffe8
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x520945
push 0xffffffffffffffff
push 0
push edi
mov ecx, eax
call fcn.00401eb3
push 0
push 1
mov ecx, edi
call fcn.00401c9b
mov dword [ebp - 0x64], edi
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5209b4
cmp dword [ebp - 0x68], edi
jne 0x52092f
cmp dword [esi + 0x14], 8
jb 0x520978
mov esi, dword [esi]
push esi
call ebx
test eax, eax
setne bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
push 0
push 1
call fcn.00401c9b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0
push 1
call fcn.00401c9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00408fd1
mov al, bl
call fcn.0054f792
ret
xor bl, bl
jmp 0x520980

Function at 0x520e95
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov eax, ecx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x525cd7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
xor edx, edx
mov dword [ebp - 8], edi
inc edx
call fcn.00525dfb
test al, al
je 0x525d56
xor edx, edx
mov ecx, edi
inc edx
call fcn.00525dfb
test al, al
je 0x525d56
mov esi, dword [ebp + 8]
xor edx, edx
inc edx
mov ecx, esi
call fcn.00525dfb
mov ecx, dword [ebp + 0xc]
test al, al
je 0x525d5c
mov edx, ecx
xor eax, eax
shr edx, 2
test edx, edx
je 0x525d47
sub edi, esi
mov dword [ebp - 0xc], edx
mov eax, ebx
mov ecx, esi
sub eax, esi
mov esi, eax
mov eax, dword [edi + ecx]
xor eax, dword [ecx]
mov dword [esi + ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x525d2d
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
sub ecx, eax
je 0x525d70
add ebx, eax
add edi, eax
add esi, eax
jmp 0x525d5c
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x525d70
sub edi, esi
sub ebx, esi
mov al, byte [esi + edi]
xor al, byte [esi]
mov byte [esi + ebx], al
inc esi
dec ecx
jne 0x525d64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5269e8
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x10]
push 0x78
call fcn.0051d755
mov edx, dword [ebp - 8]
mov edi, str.91__
mov esi, dword [ebp + 0xc]
sub edi, edx
push 0x38
pop ebx
movzx ecx, byte [edi + edx]
dec ecx
mov eax, ecx
and ecx, 7
sar eax, 3
mov al, byte [eax + esi]
test byte [ecx*4 + 0x57cd90], al
setne al
mov byte [edx], al
inc edx
dec ebx
jne 0x526a0e
mov esi, dword [ebp - 8]
xor edi, edi
mov edx, edi
push 0x1c
mov dword [ebp + 0xc], edx
pop eax
movzx edx, byte [edx + 0x57cd20]
mov ebx, edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea edi, [edx - 0x1c]
cmp ebx, eax
push 0x38
pop ecx
cmovl ecx, eax
mov eax, edi
cmp edx, ecx
push 0x1c
cmovl eax, edx
mov al, byte [eax + esi]
mov byte [ebx + esi + 0x38], al
inc ebx
inc edx
inc edi
pop eax
cmp ebx, 0x38
jl 0x526a4d
xor edi, edi
mov ebx, edi
movzx eax, byte [ebx + 0x57cdb0]
cmp byte [eax + esi + 0x37], 0
je 0x526a96
mov eax, ebx
push 6
pop ecx
cdq
idiv ecx
mov ecx, dword [edx*4 + 0x57cd90]
sar ecx, 2
or byte [eax + esi + 0x70], cl
inc ebx
cmp ebx, 0x30
jl 0x526a72
movzx ecx, byte [esi + 0x70]
movzx eax, byte [esi + 0x72]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x74]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x76]
shl ecx, 8
or ecx, eax
mov eax, dword [ebx + 0x8c]
push 0x1c
mov dword [eax + edx*8], ecx
movzx ecx, byte [esi + 0x71]
movzx eax, byte [esi + 0x73]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x75]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x77]
shl ecx, 8
or ecx, eax
mov eax, dword [ebx + 0x8c]
mov dword [eax + edx*8 + 4], ecx
inc edx
mov dword [ebp + 0xc], edx
pop eax
cmp edx, 0x10
jl 0x526a3b
cmp dword [ebp + 8], 1
jne 0x526b45
mov esi, dword [ebp - 4]
push 0x7c
pop ebx
mov edx, dword [esi + 0x8c]
mov ecx, dword [edi + edx]
mov eax, dword [ebx + edx - 4]
mov dword [edi + edx], eax
lea edi, [edi + 8]
mov dword [ebx + edx - 4], ecx
mov edx, dword [esi + 0x8c]
mov ecx, dword [edi + edx - 4]
mov eax, dword [ebx + edx]
mov dword [edi + edx - 4], eax
mov dword [ebx + edx], ecx
sub ebx, 8
cmp ebx, 0x3c
jg 0x526b0f
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor al, al
mov edi, esi
rep stosb byte es:[edi], al
push esi
call dword [sym.imp.MSVCR120.dll_free]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x526b5f
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx]
mov ebx, dword [ecx + 0x8c]
add ebx, 8
mov dword [ebp - 4], 8
mov edi, dword [edi]
mov edx, edi
ror edx, 4
xor edx, dword [ebx - 8]
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x57d170]
xor ecx, dword [eax*4 + 0x57d370]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
xor ecx, dword [eax*4 + 0x57d570]
xor ecx, dword [edx*4 + 0x57d770]
mov edx, dword [ebx - 4]
xor esi, ecx
xor edx, edi
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x57d270]
xor ecx, dword [eax*4 + 0x57d470]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
xor ecx, dword [eax*4 + 0x57d670]
xor ecx, dword [edx*4 + 0x57d870]
xor esi, ecx
mov edx, esi
ror edx, 4
xor edx, dword [ebx]
lea ebx, [ebx + 0x10]
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x57d170]
xor ecx, dword [eax*4 + 0x57d370]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
xor ecx, dword [eax*4 + 0x57d570]
xor ecx, dword [edx*4 + 0x57d770]
mov edx, dword [ebx - 0xc]
xor edi, ecx
xor edx, esi
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x57d270]
xor ecx, dword [eax*4 + 0x57d470]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
xor ecx, dword [eax*4 + 0x57d670]
xor ecx, dword [edx*4 + 0x57d870]
xor edi, ecx
dec dword [ebp - 4]
jne 0x526b80
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ebx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52cfd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x14], 8
jb 0x52cffa
mov ebx, dword [edi]
jmp 0x52cffc
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x52d03c
test al, 0x10
je 0x52d01f
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x52d029
mov dword [esi], 0xfffffff7
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0052de80
cmp dword [edi + 0x14], 8
jb 0x52d051
mov eax, dword [edi]
jmp 0x52d053
mov eax, edi
push dword [edi + 0x10]
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
push 0
call fcn.0040b8e1
test eax, eax
jne 0x52d076
test esi, esi
je 0x52d0c0
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x52d0c6
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0052cfd0
add esp, 8
test al, al
je 0x52d0c0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x52d0c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x52d0b1
push edi
call fcn.0052d2e0
add esp, 4
test al, al
jne 0x52d0c4
test esi, esi
je 0x52d0c0
push ebx
call fcn.0053ab20
add esp, 4
mov dword [esi], eax
xor bl, bl
jmp 0x52d0c6
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0052d8d0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
Function at 0x52d0f0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
cmp eax, 0x104
jb 0x52d122
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x52d137
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
push ebx
mov bl, byte [ebp + 0xc]
test bl, bl
jne 0x52d1dc
lea ecx, [ebp - 0x258]
call fcn.0052fa40
lea eax, [ebp - 0x258]
push eax
push esi
call fcn.0052d3e0
add esp, 8
test al, al
je 0x52d19b
cmp byte [ebp - 0x250], bl
je 0x52d19b
cmp dword [esi + 0x14], 8
jb 0x52d172
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
lea ecx, [ebp - 0x258]
setne bl
call fcn.00401510
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x52d1a5
mov eax, dword [esi]
jmp 0x52d1a7
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x52d1d1
lea ecx, [ebp - 0x258]
mov bl, 1
call fcn.00401510
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x258]
call fcn.00401510
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x52d202
mov esi, dword [esi]
lea ecx, [ebp - 0x210]
jmp 0x52d210
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x52d210
mov word [ebp - 0x214], ax
xorps xmm0, xmm0
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x210]
movq qword [ebp - 0x21c], xmm0
movdqu xmmword [ebp - 0x22c], xmm0
mov dword [ebp - 0x228], eax
mov eax, 0x414
mov dword [ebp - 0x22c], 3
mov word [ebp - 0x220], ax
test bl, bl
jne 0x52d277
mov eax, 0x1494
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x21e], 0
je 0x52d29f
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x52d2c6
cmp eax, 2
je 0x52d2c6
cmp eax, 0x402
je 0x52d2c6
cmp eax, 0x7c
je 0x52d2c6
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop ebx
xor ecx, ebp
pop esi
call fcn.0054e63c
mov esp, ebp
pop ebp
ret

Function at 0x52d2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x52d2ee
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x52d302
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x52d310
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x52d3c5
cmp eax, 0x104
ja 0x52d3c5
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00407674
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x254]
call fcn.0052d860
mov ecx, eax
call fcn.0052ed50
push eax
mov ecx, esi
call fcn.0052d980
lea ecx, [ebp - 0x23c]
call fcn.0052d8d0
lea ecx, [ebp - 0x254]
call fcn.0052d8d0
cmp dword [ebp - 0x210], 8
jb 0x52d3b4
push dword [ebp - 0x224]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0054e63c
mov esp, ebp
pop ebp
ret

Function at 0x52d4a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x52d526
cmp word [ebp - 0x20c], 0
je 0x52d526
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00407674
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.0052d860
cmp dword [ebp - 0x210], 8
jb 0x52d5b1
push dword [ebp - 0x224]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x23c]
call fcn.0052d8b0
lea eax, [ebp - 0x23c]
push eax
call fcn.0052d5d0
add esp, 4
test al, al
je 0x52d554
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
call fcn.0052d830
jmp 0x52d5a6
push 0x56cc38
lea ecx, [ebp - 0x224]
call fcn.00407674
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.0052d860
cmp dword [ebp - 0x210], 8
jb 0x52d589
push dword [ebp - 0x224]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp - 0x210], 7
mov dword [ebp - 0x214], 0
mov word [ebp - 0x224], ax
lea ecx, [ebp - 0x23c]
call fcn.0052d8d0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
Function at 0x52d5d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x52d679
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00407674
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x258]
call fcn.0052d860
mov ecx, eax
call fcn.0052ed50
push eax
mov ecx, esi
call fcn.0052d980
lea ecx, [ebp - 0x240]
call fcn.0052d8d0
lea ecx, [ebp - 0x258]
call fcn.0052d8d0
cmp dword [ebp - 0x214], 8
jb 0x52d668
push dword [ebp - 0x228]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0054e63c
mov esp, ebp
pop ebp
ret

Function at 0x52d770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x52d77e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x5323c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5ba2c8], 0
je 0x5323e9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.0054e7ae
add esp, 4
test eax, eax
je 0x532407
push 0
mov ecx, eax
call fcn.00531b10
mov dword [0x5ba2c8], eax
jmp 0x532411
mov dword [0x5ba2c8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407674
mov ecx, dword [0x5ba2c8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00532950
cmp dword [ebp - 8], 8
jb 0x532440
push dword [ebp - 0x1c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret

Function at 0x532950
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b31c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], cx
lea ecx, [ebp - 0x1c]
push ecx
push 3
push eax
mov dword [ebp - 0xc], 0
call fcn.00539420
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x5329c9
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [ebp - 0x20]
call fcn.005325a0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
cmp dword [ebp - 8], 8
pop edi
jb 0x5329db
push dword [ebp - 0x1c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054e63c
mov esp, ebp
pop ebp
ret 4
Function at 0x533410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0x533438
call fcn.00540000
cmp eax, 1
jl 0x533438
mov dword [ebp - 4], 0x10000
jmp 0x53343a
xor esi, esi
push 8
call fcn.0054e7ae
mov ecx, dword [ebp + 0xc]
add esp, 4
mov edi, dword [ebp + 0x10]
mov ebx, eax
test edi, edi
push 0
push dword [ebp - 4]
mov dword [ebx], ecx
setne cl
push ebx
push 0x533740
push esi
push 0
mov byte [ebx + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x533480
push ebx
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x533496
mov dword [edi], eax
mov al, 1
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x533a10
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], 0xffffffff
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x533a64
push str.slot_____DWORD_0xFFFFFFFF_
lea eax, [ebp + 8]
push eax
push ecx
call fcn.0052bbe0
add esp, 0xc
test eax, eax
je 0x533a64
push eax
push 0x11
push str.threading_thread_local_win.cc
lea ecx, [ebp - 0xb0]
call fcn.0052be60
lea ecx, [ebp - 0xb0]
call fcn.0052bfb0
mov esp, ebp
pop ebp
ret

Function at 0x533a70
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x533ad3
call fcn.0052c840
cmp eax, 3
jg 0x533ac3
push 3
push 0x23
push str.threading_thread_local_win.cc
lea ecx, [ebp - 0xb4]
mov ebx, 1
call fcn.0052bdc0
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.00409e6d
add esp, 8
test bl, 1
je 0x533ad3
lea ecx, [ebp - 0xb4]
call fcn.0052bfb0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53a970
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
test bl, 1
push esi
mov esi, ecx
mov ecx, 3
cmovne eax, ecx
test bl, 2
mov ecx, 1
cmovne eax, ecx
mov ecx, ebx
and ecx, 4
mov dword [ebp - 4], ecx
mov ecx, 4
cmovne eax, ecx
test bl, 8
mov ecx, 2
cmovne eax, ecx
mov dword [ebp + 0xc], eax
test bl, 0x10
je 0x53a9c6
mov dword [ebp + 0xc], 5
jmp 0x53a9ce
test eax, eax
je 0x53aaed
xor edx, edx
mov eax, 4
test bl, 0x40
push edi
mov edi, 0x40000000
cmovne edx, edi
test bl, 0x80
cmovne edx, eax
test bl, 0x20
je 0x53a9f2
or edx, 0x80000000
test ebx, 0x4000
je 0x53aa00
or edx, 0x100
test ebx, 0x40000
je 0x53aa0e
or edx, 0x20000000
mov ecx, ebx
shr ecx, 8
not ecx
and ecx, 1
test ebx, 0x200
jne 0x53aa23
or ecx, 2
test ebx, 0x8000
je 0x53aa2d
or ecx, eax
xor eax, eax
test ebx, 0x400
cmovne eax, edi
test ebx, 0x800
je 0x53aa45
or eax, 0x100
test ebx, 0x1000
je 0x53aa50
or eax, 2
test ebx, 0x2000
je 0x53aa5d
or eax, 0x4000000
test ebx, 0x20000
je 0x53aa6a
or eax, 0x2000000
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x53aa75
mov edi, dword [edi]
push 0
push eax
push dword [ebp + 0xc]
push 0
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ecx, esi
call fcn.0051e636
mov eax, dword [esi]
pop edi
test eax, eax
je 0x53aadb
cmp eax, 0xffffffff
je 0x53aadb
mov eax, ebx
mov dword [esi + 4], 0
shr eax, 0xa
and al, 1
cmp dword [ebp - 4], 0
mov byte [esi + 9], al
je 0x53aaca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
mov byte [esi + 8], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test bl, 0xa
je 0x53aaed
mov byte [esi + 8], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0053ab20
add esp, 4
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8