joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dcd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 0x2c], 0x7e435c
mov dword [esp + 0x28], str.PureBasic.exe_shellopencommand
mov eax, dword [esp + 0x5c]
mov dword [0x7eaa00], eax
mov dword [esp + 4], str.PureBasic.exe_shellopencommand
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0058d310
sub esp, 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.0058d310
sub esp, 8
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [0x7e42ec], 0x800008
mov dword [0x7e42ec], 0x800009
mov dword [esp + 0x30], 0
mov dword [0x7e42ec], 0x800009
mov dword [esp + 0x34], 0
mov dword [0x7e42ec], 0x800009
mov dword [esp + 0x38], 0x400
mov dword [0x7e42ec], 0x800009
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.0058c160
sub esp, 4
mov dword [0x7e42ec], 0x80000a
test eax, eax
jne 0x45de10
mov dword [0x7e42ec], 0x800015
mov dword [0x7e42ec], 0x800016
call fcn.0058d210
mov dword [esp], 0x6999e0
call fcn.0058d230
sub esp, 4
call fcn.0058d1f0
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0058d2e0
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0058d2e0
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0058d2e0
sub esp, 4
mov eax, ebx
add esp, 0x48
pop ebx
ret 0x10
mov ebx, eax
mov dword [0x7e42ec], 0x80000b
lea eax, [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], closesocket
call sub.ADVAPI32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x45de6b
mov dword [0x7e42ec], 0x80000c
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x45deb8
mov dword [0x7e42ec], 0x800011
mov dword [0x7e42ec], 0x800012
mov dword [0x7e42ec], 0x800013
mov dword [esp], ebx
call fcn.0058c040
sub esp, 4
mov dword [0x7e42ec], 0x800014
call fcn.0058d210
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0058d230
sub esp, 4
call fcn.0058d1f0
mov ebx, eax
jmp 0x45ddd1
mov dword [0x7e42ec], 0x80000d
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x38]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x34]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x45df28
mov dword [0x7e42ec], 0x80000f
mov dword [0x7e42ec], 0x800010
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegCloseKey
sub esp, 4
jmp 0x45de61
mov dword [0x7e42ec], 0x80000e
call fcn.0058d210
call fcn.0058d210
call fcn.0058d170
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0058c060
sub esp, 8
call fcn.0058d170
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.0058d280
sub esp, 8
jmp 0x45def9
Function at 0x51ada5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51ade4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51ade4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51ade4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51ade4
cmp dword [ecx + 0x74], 0xe
jbe 0x51ade4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x51f8a5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x69a7d4
push 0x69a7cc
push 0x69a7d4
push 0x1f
call fcn.0051f710
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51f8d9
push dword [ebp + 8]
mov ecx, esi
call dword [0x699930]
call esi
jmp 0x51f8df
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x51f923
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x69a7f8
push 0x69a7f0
push 0x69a7f8
push 0x21
call fcn.0051f710
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51f95a
push dword [ebp + 8]
mov ecx, esi
call dword [0x699930]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x51f962
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x69a80c
push 0x69a804
push 0x69a80c
push 0x22
call fcn.0051f710
mov esi, eax
add esp, 0x10
test esi, esi
je 0x51f99c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x699930]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x52148b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x521528
push ebx
push esi
call fcn.00521454
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005213e8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5214d5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x521527
push edi
push eax
call fcn.0051e613
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5214f5
call fcn.0051e5d9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x521526
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005213e8
add esp, 0x20
test eax, eax
jne 0x521514
push edi
call fcn.0051e5d9
jmp 0x52151c
push ebx
call fcn.0051e5d9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x52152b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x52153c
pop esi
ret
push ebx
push edi
push esi
call fcn.00521454
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0051e613
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x521564
push ebx
push esi
push edi
call fcn.0052d690
add esp, 0xc
push 0
call fcn.0051e5d9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x521cbe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005217d9

Function at 0x524ea5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0051f0c9
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x524f14
cmp esi, dword [ebp - 4]
je 0x524f0f
cmp dword [ebp + 0xc], 0
je 0x524f0f
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x524eec
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.005249f7
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x524f16
xor eax, eax
inc eax
jmp 0x524f16
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x524f7b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x7de194]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0051f0c9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0051f0c9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x524ff2
cmp word [ecx], dx
je 0x524ff2
mov eax, dword [0x69baac]
push edi
dec eax
push eax
push 0x69b998
call fcn.00524f1a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x525065
cmp word [eax], dx
je 0x525065
mov eax, dword [edi]
test eax, eax
je 0x525016
cmp word [eax], dx
je 0x525016
lea eax, [ebp - 0x10]
push eax
call fcn.005248fd
jmp 0x52501f
lea eax, [ebp - 0x10]
push eax
call fcn.00524998
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x52508f
mov eax, dword [0x69b994]
push dword [ebp - 0x14]
dec eax
push eax
push 0x69b688
call fcn.00524f1a
add esp, 0xc
test al, al
je 0x52508f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x52505a
cmp word [eax], di
je 0x52505a
lea eax, [ebp - 0x10]
push eax
call fcn.005248fd
pop ecx
jmp 0x525091
lea eax, [ebp - 0x10]
push eax
call fcn.00524998
jmp 0x525057
mov eax, dword [edi]
test eax, eax
je 0x52507c
cmp word [eax], dx
je 0x52507c
lea eax, [ebp - 0x10]
push eax
call fcn.005248b2
pop ecx
jmp 0x52508f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x52515a
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00524d9f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x52515a
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x52515a
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x52515a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5250e7
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0051fb3e
test ebx, ebx
je 0x525155
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0051fb3e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x52515a
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x52515a
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.005274a0
add esp, 0x10
xor eax, eax
inc eax
jmp 0x52515c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b0d5
leave
ret
Function at 0x52a81c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x7e4ac0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x52a85c
cmp byte [ebx], 0xa
jne 0x52a85c
or byte [edi + eax + 0x28], 4
jmp 0x52a861
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x52a960
mov dl, byte [eax]
cmp dl, 0x1a
je 0x52a943
inc eax
cmp dl, 0xd
je 0x52a88d
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x52a8b3
cmp eax, ecx
jae 0x52a8c1
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x52a875
jmp 0x52a960
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x52a93e
cmp dword [ebp - 0x10], 0
je 0x52a93e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x7e4ac0]
test byte [eax + edi + 0x28], 0x48
je 0x52a918
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x52a903
mov byte [esi], dl
jmp 0x52a914
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x7e4ac0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x52a960
cmp byte [ebp - 1], 0xa
jne 0x52a927
cmp esi, ebx
jne 0x52a927
mov byte [esi], 0xa
jmp 0x52a95f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0052a621
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x52a960
mov byte [esi], 0xd
jmp 0x52a95f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x7e4ac0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x52a95d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x52a960
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x52a969
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x7e4ac0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x52a9af
cmp word [ebx], dx
jne 0x52a9af
or byte [eax + edi + 0x28], 4
jmp 0x52a9b4
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x52ab17
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x52aaf7
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x52a9f5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x52aa2b
cmp eax, edx
jae 0x52aa39
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x52a9d0
jmp 0x52ab17
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x52aaf2
cmp dword [ebp - 0x18], 0
je 0x52aaf2
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x7e4ac0]
test byte [eax + edi + 0x28], 0x48
je 0x52aac8
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x52aa8c
mov word [esi], cx
jmp 0x52aac3
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x7e4ac0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x7e4ac0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x7e4ac0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x52ab17
pop eax
cmp word [ebp - 4], ax
jne 0x52aad8
cmp esi, ebx
jne 0x52aad8
mov word [esi], ax
jmp 0x52ab14
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0052a621
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x52ab17
push 0xd
pop eax
jmp 0x52aad3
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x7e4ac0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x52ab11
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x52ab17
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x52f7bc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push edi
xor edi, edi
test eax, eax
je 0x52f989
cmp word [eax], di
je 0x52f989
push edi
push 0x80
push 3
push edi
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x52f985
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x52f97b
push ebx
push ebp
call fcn.0052ff16
mov ebx, eax
test ebx, ebx
je 0x52f97a
push esi
push 2
pop eax
cmp ebp, 0xffffffff
cmovne eax, ebp
push eax
push dword [esp + 0x20]
call fcn.0053039d
mov esi, eax
test esi, esi
je 0x52f970
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
mov dword [esi + 0x2c], ebx
cmove eax, esi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
add eax, 8
mov dword [esi + 0x40], edi
push eax
push edi
mov dword [esi + 0x14], edi
push dword [0x7e42f8]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x28], eax
test eax, eax
je 0x52f896
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x28]
mov dword [eax], edi
mov eax, dword [esi + 0x28]
add eax, 8
mov dword [esi + 0x44], eax
cmp ebp, 0xffffffff
je 0x52f8a2
mov dword [esi + 0x34], 1
push esi
push ebx
call fcn.00593320
mov edx, dword [esp + 0x2c]
mov ebp, 0x4000
pop ecx
pop ecx
mov ecx, edi
mov dword [esp + 0x1c], ecx
lea eax, [ecx + ebp]
cmp eax, edx
jle 0x52f8c5
mov ebp, edx
sub ebp, ecx
push ebp
push ebx
call fcn.00592920
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x52f95f
push edi
lea ecx, [esp + 0x24]
push ecx
push ebp
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x20]
cmp ecx, ebp
jne 0x52f94f
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x14], edi
jne 0x52f918
push ecx
push dword [esp + 0x18]
call fcn.0052ffc1
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x24]
jl 0x52f922
push 1
jmp 0x52f923
push edi
push ecx
push ebx
call fcn.00592f10
add esp, 0xc
test eax, eax
je 0x52f943
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x52f8ba
jmp 0x52f96d
push ebx
call fcn.00592c30
pop ecx
mov dword [esi + 0x18], eax
jmp 0x52f966
mov dword [esi + 0x18], 0x100
mov dword [esi + 0x24], str.file_read_error
jmp 0x52f96d
mov dword [esi + 0x18], 1
push ebx
push esi
call fcn.0053006d
mov dword [esi + 0x2c], edi
push ebx
call fcn.00593050
pop ecx
mov edi, esi
pop esi
pop ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x52f98b
xor eax, eax
pop edi
pop ebp
pop ecx
pop ecx
ret 0xc
Function at 0x5351bd
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x535212
push dword [esp + 0x10]
push 0x53513c
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x7e514c]
test edi, edi
je 0x53526b
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x53520a
cmp byte [edi + 0x10], 0
je 0x53520a
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x5351e6
jmp 0x53526b
mov edi, dword [0x7e514c]
test edi, edi
je 0x53526b
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x535264
cmp byte [edi + 0x11], 0
je 0x53523d
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x535254
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x7e514c
call fcn.0058cfab
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x53521f
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x550764
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push dword [0x7ea718]
call fcn.0058c83f
mov esi, eax
or ebx, 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, dword [esp + 0x28]
mov edx, eax
movzx ecx, word [edx]
test cx, cx
je 0x5508a1
mov eax, dword [esi]
mov edi, ecx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x20
push 0x22
pop ecx
movzx eax, di
cmp di, word [esp + 0x18]
jne 0x5507ca
push 0x20
pop edi
add edx, 2
movzx eax, word [edx]
cmp ax, di
je 0x5507bf
mov dword [esp + 0x14], 1
cmp ax, cx
jne 0x550804
add edx, 2
mov edi, edx
movzx eax, word [edx]
mov ebx, eax
test ax, ax
je 0x55085e
push 0x22
mov ecx, eax
pop esi
movzx ebx, cx
cmp cx, si
je 0x55085e
add edx, 2
movzx eax, word [edx]
mov ecx, eax
mov ebx, eax
test ax, ax
jne 0x5507eb
jmp 0x55085e
test ax, ax
je 0x550871
push 0x20
mov edi, edx
movzx eax, ax
pop ebp
movzx ebx, ax
cmp ax, bp
je 0x55085a
add edx, 2
push 0x22
pop ebx
movzx eax, word [edx]
mov ecx, eax
cmp ax, bx
jne 0x55084f
add edx, 2
movzx eax, word [edx]
mov ecx, eax
test ax, ax
je 0x55084f
mov esi, eax
movzx ecx, si
cmp si, bx
je 0x55084f
add edx, 2
movzx eax, word [edx]
mov esi, eax
mov ecx, eax
test ax, ax
jne 0x550838
movzx eax, cx
movzx ebx, cx
test cx, cx
jne 0x550811
mov ebp, dword [esp + 0x28]
test bx, bx
lea eax, [edx + 2]
mov ebx, dword [esp + 0x10]
mov esi, edx
cmove eax, edx
mov edx, eax
jmp 0x550878
and dword [esp + 0x14], 0
xor edi, edi
cmp dword [esp + 0x1c], ebx
jne 0x550882
test ebp, ebp
jne 0x5508a9
cmp dword [esp + 0x14], 0
lea eax, [ebx + 1]
movzx ecx, word [edx]
cmove eax, ebx
mov edi, ecx
mov ebx, eax
mov dword [esp + 0x10], ebx
test cx, cx
jne 0x5507af
test ebp, ebp
jne 0x5508be
mov eax, ebx
jmp 0x5508c4
test edi, edi
je 0x5508be
mov eax, dword [esp + 0x20]
sub esi, edi
sar esi, 1
mov dword [ebp], esi
inc dword [eax]
mov eax, edi
jmp 0x5508c4
and dword [ebp], 0
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x55094c
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x550a0b
cmp dword [esp + 0x24], 2
je 0x550a0b
push 0x2000
push ebp
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x5509da
cmp dword [esp + 0x18], 2
jne 0x5509f6
cmp dword [esp + 0x28], 0xffffffff
je 0x55099e
cmp ebp, dword [esp + 0x28]
jae 0x5509f6
add ebp, 2
test ebx, ebx
jne 0x5509c3
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x5509f6
cmp ax, 0xd
je 0x5509da
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x55098a
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00677b50
jmp 0x550a9d
push eax
push 0
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x550a29
cmp ebp, dword [esp + 0x28]
jae 0x550a81
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x550a81
cmp dword [esp + 0x18], 1
jne 0x550a81
inc ebp
test ebx, ebx
jne 0x550a6e
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x550a81
cmp al, 0xd
je 0x550a1c
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x550a1c
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x550a98
call fcn.006779d0
jmp 0x550a9d
call fcn.00677970
push esi
push 0
push dword [0x7e42f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10