joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51da6b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00548bf0
add esp, 0xc
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x1c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x51daa9
xor eax, eax
jmp 0x51db01
push esi
push str.TencentQQBrowserUser_DataDefault_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00567315
push 1
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push str.preferences
push eax
call fcn.0051d8bf
push edi
mov esi, eax
lea eax, [ebp - 4]
push 2
push eax
lea eax, [ebp - 0x20c]
push str.bookmarks
push eax
call fcn.0051d8bf
sub esi, 2
add esp, 0x34
add eax, esi
neg eax
sbb eax, eax
inc eax
pop esi
pop edi
leave
ret

Function at 0x51dd9d
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x51ddb2
xor eax, eax
jmp 0x51def6
push ebx
push esi
push edi
lea ecx, [ebp - 0x24]
call fcn.0040921d
mov esi, 0x6015dc
push esi
call fcn.00553a47
pop ecx
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.00409b94
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x51deea
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
test eax, eax
je 0x51de13
inc eax
push eax
mov dword [ebp + 8], eax
call fcn.0056728d
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x51de1f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x51deea
push dword [ebp + 8]
push esi
push ebx
call fcn.00548bf0
add esp, 0xc
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x51de4c
push ebx
call fcn.00553d2a
pop ecx
jmp 0x51de13
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0044114c
push ebx
call fcn.00553d2a
cmp byte [ebp + 0xc], 0
pop ecx
je 0x51de73
lea eax, [ebp - 0x3c]
push eax
call fcn.0051cfba
pop ecx
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push esi
cmovae eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004573b1
mov ecx, eax
call fcn.0045732b
test al, al
je 0x51dee2
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push esi
cmovae eax, dword [ebp - 0x24]
push esi
push 2
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x51dee2
cmp dword [ebp - 0x28], 0x10
lea eax, [ebp - 0xc]
push esi
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
cmovae ecx, dword [ebp - 0x3c]
inc eax
push eax
push ecx
push edi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.00404062
lea ecx, [ebp - 0x24]
call fcn.00403f80
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret
Function at 0x51e17a
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push edi
mov edi, ecx
call fcn.0051e3a9
mov ecx, dword [edi + 0x5c]
test ecx, ecx
je 0x51e28c
cmp dword [ebp + 0xc], 0xffffffff
jne 0x51e1af
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x51e1a4
mov eax, dword [eax]
push eax
call ecx
pop ecx
xor eax, eax
jmp 0x51e299
push ebx
push esi
push 0x1c
call fcn.00415ffa
mov ebx, eax
xor esi, esi
pop ecx
test ebx, ebx
je 0x51e1d0
mov dword [ebx + 4], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], 7
jmp 0x51e1d2
mov ebx, esi
push dword [ebp + 8]
mov eax, dword [edi + 0x5c]
mov dword [ebx], eax
lea eax, [edi + 0x18]
push 0x608bd0
push eax
lea eax, [ebp - 0x48]
push 0x5ff8ec
push eax
call fcn.0044a28b
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0044a32b
add esp, 0xc
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004ba2bc
add esp, 0xc
lea ecx, [ebx + 4]
push eax
call fcn.00446faf
lea ecx, [ebp - 0x18]
call fcn.00403f80
lea ecx, [ebp - 0x30]
call fcn.00403f80
lea ecx, [ebp - 0x48]
call fcn.00403f80
push esi
push esi
push ebx
push 0x51e2dc
push esi
push esi
call fcn.00577219
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x51e286
cmp ebx, 0xffffffff
je 0x51e286
cmp dword [ebp + 0xc], 0
je 0x51e27b
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x51e283
cmp eax, 0x102
je 0x51e271
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x51e286
push ebx
mov ecx, edi
call fcn.0051e150
jmp 0x51e286
push ebx
mov ecx, edi
call fcn.0051e150
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebx
jmp 0x51e299
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0051e29e
pop edi
leave
ret 8

Function at 0x51e458
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x44]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
je 0x51e49c
mov esi, eax
mov edi, dword [ebx]
push 0x1d4c0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
add ebx, 4
cmp ebx, esi
jne 0x51e47b
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51fa29
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa78
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x51fa40
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x51fc3b
push ebx
push edi
lea eax, [ebp + 8]
xor edi, edi
push eax
push 0x5d5a1c
inc edi
xor ebx, ebx
push edi
push ebx
push 0x5da66c
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp + 8]
js 0x51fc2b
test eax, eax
je 0x51fc2b
lea edx, [ebp - 4]
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
push edx
push 0x5ff944
push eax
call dword [ecx]
mov ecx, dword [ebp - 4]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x51fc1a
cmp dword [esi + 0x14], 8
jb 0x51fab0
mov esi, dword [esi]
mov eax, dword [ecx]
push 2
push esi
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x51fc17
mov esi, 0x208
lea eax, [ebp - 0x210]
push esi
push ebx
push eax
call fcn.00548bf0
push 0x250
lea eax, [ebp - 0xa78]
push ebx
push eax
call fcn.00548bf0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xa78]
add esp, 0x18
mov ecx, dword [eax]
push 6
push edx
push 0x104
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x51fc17
push esi
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.00548bf0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x418]
add esp, 0xc
mov ecx, dword [eax]
push 0x104
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x51fc17
push esi
lea eax, [ebp - 0x620]
push ebx
push eax
call fcn.00548bf0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x620]
add esp, 0xc
mov ecx, dword [eax]
push 0x104
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x51fc17
push esi
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.00548bf0
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
add esp, 0xc
mov dword [ebp - 8], ebx
mov ecx, dword [eax]
push edx
push 0x104
lea edx, [ebp - 0x828]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
js 0x51fc17
lea eax, [ebp - 0x210]
push eax
call fcn.00553a47
mov esi, dword [ebp + 0xc]
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00407f20
lea eax, [ebp - 0x418]
push eax
call fcn.00553a47
pop ecx
push eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [esi + 0x18]
call fcn.00407f20
lea eax, [ebp - 0x620]
push eax
call fcn.00553a47
pop ecx
push eax
lea eax, [ebp - 0x620]
push eax
lea ecx, [esi + 0x30]
call fcn.00407f20
lea eax, [ebp - 0x828]
push eax
call fcn.00553a47
pop ecx
push eax
lea eax, [ebp - 0x828]
push eax
lea ecx, [esi + 0x48]
call fcn.00407f20
mov ecx, dword [ebp - 4]
jmp 0x51fc1c
mov ecx, dword [ebp - 4]
mov edi, ebx
test ecx, ecx
je 0x51fc26
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp + 8]
jmp 0x51fc2d
mov edi, ebx
test eax, eax
je 0x51fc37
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret
Function at 0x5200fd
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0051f97a
cmp dword [ebp - 8], 0
je 0x52012e
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52012e
xor esi, esi
inc esi
jmp 0x520130
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.00403f80
mov eax, esi
pop esi
leave
ret
Function at 0x5206fe
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 8], eax
cmp dword [edi + 0x34], eax
je 0x520742
lea eax, [ebp - 0x20]
mov dword [ebp - 8], ebx
push eax
lea ecx, [edi + 0x3c]
call fcn.0051f97a
cmp dword [eax + 0x10], 0
je 0x52073f
cmp dword [edi + 0x80], 0
mov eax, ebx
je 0x520742
mov byte [ebp - 1], 0
jmp 0x520745
mov eax, dword [ebp - 8]
mov byte [ebp - 1], bl
test al, 1
je 0x520751
lea ecx, [ebp - 0x20]
call fcn.00403f80
cmp byte [ebp - 1], 0
jne 0x52084b
lea esi, [edi + 0x24]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x520768
mov eax, dword [esi]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push 0x208
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.00548bf0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x52078d
mov esi, dword [esi]
xor ecx, ecx
lea eax, [ebp - 0x260]
push ecx
push ecx
push 0x104
push eax
push esi
push ecx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x52084b
push 0
lea ecx, [ebp - 0x58]
call fcn.005afd80
lea eax, [edi + 0x3c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], eax
push ecx
mov ecx, eax
call fcn.0051f97a
cmp dword [eax + 0x14], 8
jb 0x5207cf
mov eax, dword [eax]
push ebx
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0040921d
sub esp, 0x18
lea eax, [ebp - 0x260]
mov ecx, esp
push eax
call fcn.0040921d
lea ecx, [ebp - 0x58]
call fcn.005add90
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00403f80
test esi, esi
je 0x52083d
lea eax, [edi + 0x70]
mov edi, dword [ebp - 8]
push eax
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0051f97a
push eax
call fcn.0052102c
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00403f80
test esi, esi
jne 0x52083f
sub esp, 0x18
mov ecx, edi
push esp
call fcn.0051f97a
lea ecx, [ebp - 0x58]
call fcn.005adc60
xor ebx, ebx
lea ecx, [ebp - 0x58]
call fcn.005afd10
mov eax, ebx
jmp 0x52084d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x520980
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov edi, ecx
xor esi, esi
push esi
lea eax, [edi + 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005ac890
mov ecx, eax
call fcn.005abdc0
cmp dword [ebp - 4], 8
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5209fb
push 1
lea eax, [edi + 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.005ac890
mov ecx, eax
call fcn.005abdc0
cmp dword [ebp - 0x20], esi
je 0x5209f3
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x18]
cmovae ecx, dword [ebp - 0x30]
cmp dword [ebp - 4], 8
push ecx
cmovae eax, dword [ebp - 0x18]
push eax
call fcn.00455ca2
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x30]
call fcn.00403f80
lea ecx, [ebp - 0x18]
call fcn.00403f80
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x52102c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 0x10], 0
je 0x5210a3
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x52104d
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5210a3
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00548bf0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x521076
mov edi, dword [edi]
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.00456ab6
cmp dword [esi + 0x14], 8
pop ecx
pop ecx
jb 0x52108d
mov esi, dword [esi]
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00577501
pop ecx
pop ecx
test eax, eax
jne 0x5210a3
inc eax
jmp 0x5210a5
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x522621
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
push edi
push 0x60
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
jne 0x522669
push 2
push ebx
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
jne 0x522669
call fcn.00521c31
mov esi, eax
jmp 0x522701
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x522683
call fcn.00521c31
jmp 0x5226f4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x52267c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x5226a9
mov esi, 0x8007000e
jmp 0x5226f6
push eax
lea ecx, [ebp - 0x40c]
call fcn.00521aa8
cmp dword [ebp - 0x40c], 0
je 0x5226a2
push esi
push dword [ebp - 0x40c]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x52267c
mov eax, dword [ebp - 0x40c]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 8]
push dword [ebp - 0x40c]
call fcn.0052250c
mov esi, eax
test edi, edi
je 0x522701
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x52271a
lea ecx, [ebp - 0x40c]
call fcn.00521e52
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x52357a
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push esi
call fcn.004ff23c
push 1
push dword [ebp + 8]
call fcn.0044cf0f
add esp, 0x14
push 0x5f9b70
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00521c5d
pop ecx
push esi
push dword [ebp + 8]
mov edi, 0x6314d8
push esi
mov ecx, edi
call fcn.00521f09
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00522daf
add esp, 0xc
mov ecx, edi
mov esi, eax
call fcn.00523022
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x5235f3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea ecx, [ebp - 0x18]
push esi
push dword [ebp + 0x14]
call fcn.0040921d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 1
push eax
push dword [ebp + 0x10]
push esi
call fcn.005ad360
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.00403f80
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x52362c
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x52366f
push dword [ebp + 0x14]
lea ecx, [ebp - 0x18]
call fcn.0040921d
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call fcn.005ad360
add esp, 0x10
mov ecx, esi
push eax
call fcn.00446faf
lea ecx, [ebp - 0x30]
call fcn.00403f80
lea ecx, [ebp - 0x18]
call fcn.00403f80
mov eax, esi
pop esi
leave
ret

Function at 0x524259
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push str._sogouexplorer.exe
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0044a2d9
add esp, 0xc
lea eax, [ebp - 0x18]
cmp dword [ebp - 4], 8
cmovae eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea ecx, [ebp - 0x18]
neg ebx
sbb bl, bl
inc bl
call fcn.00403f80
lea ecx, [ebp + 8]
call fcn.00403f80
mov al, bl
pop ebx
leave
ret 0x18
Function at 0x5265ee
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.0052643b
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x526605
mov eax, dword [eax]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push eax
push edi
push 2
push edi
push dword [esi + 0x3c]
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp + 0xc]
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.004065d3
mov ecx, esi
call fcn.005267eb
pop edi
pop esi
pop ebp
ret 8
Function at 0x598e80
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059883e

Function at 0x5992a6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059917a

Function at 0x59d10c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059cd04

Function at 0x59d117
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059ce8e

Function at 0x5a51a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.005a5370
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x5a527d
mov edx, dword [ebp - 4]
cmp edx, dword [0x62ae24]
jb 0x5a51ea
mov eax, dword [ebp - 4]
cmp eax, dword [0x62ae28]
ja 0x5a51ea
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x5a51ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00548bf0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x5a520f
jmp 0x5a527d
cmp dword [ebp - 0x14], 0x10000
jne 0x5a5263
cmp dword [ebp - 0x18], 0x10000
jb 0x5a5263
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5a5246
mov eax, dword [ebp - 8]
jmp 0x5a527f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x5a5256
xor eax, eax
jmp 0x5a527f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x5a5278
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.005a5370
add esp, 4
mov dword [ebp - 4], eax
jmp 0x5a51ba
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5a5290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.005a53a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x5a5365
mov edx, dword [ebp - 4]
cmp edx, dword [0x62ae24]
jb 0x5a52d5
mov eax, dword [ebp - 4]
cmp eax, dword [0x62ae28]
ja 0x5a52d5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x5a52a5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00548bf0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x5a52fa
jmp 0x5a5365
cmp dword [ebp - 0x14], 0x10000
jne 0x5a534e
cmp dword [ebp - 0x18], 0x10000
jb 0x5a534e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5a5331
mov eax, dword [ebp - 8]
jmp 0x5a5367
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x5a5341
xor eax, eax
jmp 0x5a5367
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x5a5360
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.005a53a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x5a52a5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5a53d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005a57c0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x632d18], 0
jne 0x5a540d
cmp dword [0x632d14], 0
je 0x5a540d
mov eax, dword [0x632d14]
mov dword [0x632d18], eax
cmp dword [0x632d18], 0
je 0x5a548a
mov ecx, dword [0x632d18]
cmp dword [ecx + 8], 0
je 0x5a548a
mov edx, dword [0x632d18]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x5a548a
mov ecx, dword [0x632d18]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x5a548a
mov eax, dword [0x632d18]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x5a5459
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x5a5460
xor eax, eax
jmp 0x5a55a9
mov ecx, dword [0x632d18]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.00548bf0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x5a55a9
mov edx, dword [0x632d14]
mov dword [0x632d18], edx
jmp 0x5a54a6
mov eax, dword [0x632d18]
mov ecx, dword [eax + 4]
mov dword [0x632d18], ecx
cmp dword [0x632d18], 0
je 0x5a54e6
cmp dword [0x632d18], 0
je 0x5a54e4
mov edx, dword [0x632d18]
cmp dword [edx + 8], 0
je 0x5a54e4
mov eax, dword [0x632d18]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x5a54e4
mov edx, dword [0x632d18]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x5a54e4
jmp 0x5a543e
jmp 0x5a5498
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005a55b0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5a55a7
mov eax, dword [ebp - 0x18]
mov dword [0x632d18], eax
mov ecx, dword [0x632d18]
mov dword [ecx], 0x52727464
mov edx, dword [0x632d18]
mov dword [edx + 8], 0
mov eax, dword [0x632d18]
mov ecx, dword [0x632d14]
mov dword [eax + 4], ecx
mov edx, dword [0x632d18]
mov dword [0x632d14], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x632d18]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x5a5577
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x5a5597
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x5a556e
mov eax, dword [0x632d18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x5a543e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5a62f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x632d14]
mov dword [ebp - 4], eax
jmp 0x5a6309
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x5a6330
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x5a632e
call sub.KERNEL32.dll_GetLastError
jmp 0x5a6332
jmp 0x5a6300
xor eax, eax
mov esp, ebp
pop ebp
ret