joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5254a0
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x118
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ecx
pop eax
mov edx, ecx
add al, 0x10
mov ecx, eax
or cl, bl
add cl, al
and cl, bl
movsx esi, cl
add esi, ebx
lea edi, [esi + ebx]
and edi, edx
lea eax, [ebp - 0xc4]
push eax
push 0x57
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
lea eax, [ebp - 0x6d]
push eax
push 0x41
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
or eax, edi
movsx eax, al
xor eax, esi
add eax, dword [ebp + 8]
cwde
mov dword [ebp - 0x14], eax
mov esi, ebx
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 4
call fcn.00528090
add esp, 4
movsx edi, al
mov ebx, dword [ebp + 0xc]
imul ebx, edi
mov dword [ebp - 0x10], ebx
sub ebx, edi
imul ebx, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [ebp - 0x18], ebx
movsx esi, bl
imul esi, eax
push esi
pop ebx
or ebx, 0x200
push edi
call fcn.00525960
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
movsx eax, bx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x124]
push eax
push 0x60
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1c], eax
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
call fcn.005292a0
add esp, 0xc
push eax
pop edi
mov ebx, eax
sub ebx, dword [ebp - 0x20]
movsx eax, bl
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x14]
mov dword [ebp - 0x14], esi
push esi
push edi
call fcn.005288a0
add esp, 0xc
cmp dword [ebp - 0x1c], edi
jne 0x5255d7
mov ecx, dword [ebp - 0x24]
movsx eax, bl
mov edx, dword [ebp - 0x14]
cmp edx, eax
mov esi, dword [ebp + 8]
jne 0x5255c1
cmp dword [ebp - 0x10], edi
je 0x5255dd
movsx eax, bl
cmp cx, ax
je 0x5255dd
mov dword [ebp - 0x18], 0
push edx
pop edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, edi
mov dword [ebp - 0x10], eax
jmp 0x5255dd
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp - 0x18]
cmp eax, edx
jle 0x5255f7
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x28]
movsx eax, bl
cmp ecx, eax
je 0x5255f7
cmp dword [ebp - 0x10], esi
je 0x525603
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul eax, esi
xor eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
add esi, ecx
add esi, eax
and esi, ecx
mov eax, esi
add esp, 0x118
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x525870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
pop esi
shl esi, 0xd
add esi, ecx
or esi, ecx
add esi, 0x4000
imul esi, ecx
or esi, eax
mov edi, esi
and edi, 0x40
lea eax, [ebp - 0x5d]
push eax
push 0x51
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
movsx ecx, byte [0x53e666]
push ecx
push edi
push esi
push eax
call fcn.00527040
add esp, 0x10
mov ecx, dword [0x53e7e0]
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.00524770
add esp, 0x10
imul eax, edi
mov edi, eax
or edi, dword [ebp + 0x14]
mov ebx, edi
sub ebx, dword [ebp + 8]
sub esp, 8
mov dword [esp + 4], eax
call fcn.00528f40
add esp, 8
mov esi, eax
push ebx
push edi
call fcn.005285b0
add esp, 8
mov edi, eax
cmp dword [ebp + 0x14], 0xfc3b63be
jne 0x525935
cmp ebx, esi
jne 0x525935
cmp ebx, 0xfc3b63bf
jge 0x525935
or edi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
mov ecx, dword [ebp + 8]
cmp edi, ecx
je 0x52594d
push ebx
pop edi
cmp eax, ecx
jle 0x525944
jmp 0x525951
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
mov ecx, dword [ebp + 8]
cmp eax, ecx
jg 0x525951
cmp eax, dword [ebp + 0xc]
je 0x52594d
cmp edi, ecx
jne 0x525951
add esi, esi
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x525960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x80]
xor eax, ebx
push ebx
push eax
call fcn.00526300
call fcn.00526b60
add esp, 8
lea eax, [ebp - 0x74]
push eax
push 0x60
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop edi
and edi, ebx
sub edi, 0xffffff80
push edi
pop eax
xor eax, ebx
push eax
call fcn.0052aa80
add esp, 4
push eax
pop ecx
xor ecx, ebx
movsx esi, cx
sub esi, eax
push 0
call fcn.0052a580
add esp, 4
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
push eax
pop ebx
cmp edx, 0xc22b286a
jne 0x5259e9
cmp edi, esi
je 0x5259e9
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x10], eax
push esi
call dword [sym.imp.USER32.dll_SetCapture]
push edi
pop edx
sub ecx, ecx
cmp ebx, edx
je 0x525a08
sub ebx, esi
test bx, bx
je 0x5259fa
test al, al
je 0x525a08
mov ecx, dword [ebp - 0x14]
neg ecx
xor ecx, dword [ebp - 0x10]
xor ecx, 0x400
mov eax, ecx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x526090
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x9c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00525220
push eax
pop esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov ebx, eax
call fcn.00524a50
imul ebx, esi
movsx ecx, bl
sub esp, 4
push ecx
push eax
call fcn.005254a0
add esp, 0xc
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0xa7]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x4c
call esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x5b]
push eax
push 0x47
call esi
push eax
pop ebx
call edi
mov esi, eax
xor esi, dword [ebp - 0x10]
or esi, ebx
call edi
push edi
pop ecx
mov edi, eax
call ecx
movsx ecx, byte [ebp - 0x14]
push eax
push ecx
push esi
push edi
call fcn.00524540
add esp, 0x10
lea ecx, [esi + esi]
cmp dword [0x53e844], 0x1ea6e704
push esi
pop edx
jne 0x52612b
sub eax, esi
add eax, 2
mov edx, eax
cmp esi, ecx
je 0x526131
mov esi, edx
push esi
pop eax
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x526140
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xd4
mov esi, dword [0x53e574]
add esi, esi
xor esi, 0x20
add esi, 0x10
lea eax, [ebp - 0x9a]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
pop ecx
or ecx, eax
mov edx, ecx
sub edx, esi
push dword [0x53e5c4]
push eax
push edx
push ecx
call fcn.00527040
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
mov ecx, eax
and ecx, 0x20
xor esi, ecx
push esi
pop edi
sub edi, ecx
imul edi, eax
add edi, edi
call ebx
mov dword [ebp - 0x10], eax
sub esp, 8
mov dword [esp + 4], edi
call fcn.00528f40
add esp, 8
call ebx
mov edi, eax
imul esi, eax
call ebx
call ebx
push edi
push esi
call fcn.005285b0
add esp, 8
lea eax, [ebp - 0xdd]
push eax
push 0x43
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop edi
movsx eax, di
xor eax, 0xffff8080
imul eax, dword [ebp - 0x10]
mov ecx, edi
xor ecx, 0x80
or ecx, eax
add ecx, eax
movsx esi, cx
add esi, ebx
lea eax, [ebp - 0x58]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop ebx
mov dword [ebp - 0x10], esi
xor ebx, esi
or ebx, edi
mov esi, ebx
mov ecx, dword [ebp - 0x18]
and esi, ecx
lea eax, [esi + ecx]
shl eax, 2
cwde
mov dword [ebp - 0x14], edi
or edi, eax
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp], edi
call fcn.00524770
add esp, 0x10
mov ecx, eax
cmp dword [0x53e670], 0xeb0e3302
jne 0x52626b
cmp esi, dword [ebp - 0x14]
jne 0x52626b
push edi
push dword [ebp - 0x10]
push ebx
push esi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov ecx, edi
and eax, esi
imul eax, dword [ebp - 0x14]
add eax, ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax*2 + 0x8000]
add esp, 0xd4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x526300
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x54
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x20
and eax, edx
mov edi, ecx
sub edi, edx
add edi, eax
imul edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x60]
push eax
push 0x50
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push esi
pop ebx
mov esi, eax
add esi, edi
sub esp, 4
call fcn.00528ee0
sub esp, 8
push esi
call fcn.0052b430
add esp, 0x10
call fcn.00528480
mov dword [ebp - 0x10], eax
push ebx
pop edi
call ebx
mov ebx, eax
mov esi, eax
sub esi, dword [ebp + 0xc]
call edi
push eax
pop edi
push esi
push eax
add edi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00528d40
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, eax
or ecx, dword [ebp - 0x10]
cmp eax, ebx
jg 0x526387
mov eax, ecx
mov ebx, dword [ebp - 0x10]
cmp ebx, esi
je 0x526390
push ecx
pop eax
add eax, edi
imul eax, ebx
cmp edi, dword [ebp + 8]
mov ecx, eax
je 0x52639e
mov ecx, esi
cmp ebx, dword [ebp + 0xc]
jne 0x5263a5
push ecx
pop eax
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x526a40
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push edi
push esi
sub esp, 0x58
mov edi, dword [ebp + 0xc]
mov esi, edi
xor esi, 0x1000
imul esi, edi
add esi, 4
lea eax, [ebp - 0x5e]
push eax
push 0x56
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xf79bb105
jne 0x526a89
cmp esi, edi
je 0x526a89
push 0xf79bb105
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, eax
or eax, 0xf79bb105
cmp eax, edi
jle 0x526a91
cmp esi, edi
jne 0x526a98
imul esi, eax
xor esi, eax
add esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, esi
add esp, 0x58
pop esi
pop edi
pop ebp
ret

Function at 0x526ab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x180
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + eax + 0x10]
push eax
call fcn.0053a590
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
call esi
lea eax, [ebp - 0x18c]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x5a
call edi
lea eax, [ebp - 0xe0]
push eax
push 0x4e
call edi
call fcn.0053a080
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add ebx, eax
and ebx, eax
sub esp, 4
call fcn.0053a860
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x800
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
call fcn.00525110
add esp, 0x10
lea eax, [ebp - 0x92]
push eax
push 0x44
call edi
lea eax, [ebp - 0x4e]
push eax
push 0x42
call edi
lea eax, [ebp - 0x132]
push eax
push 0x52
call edi
add esp, 0x180
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x526b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x160
mov esi, dword [0x53e364]
and esi, 4
mov ebx, esi
imul ebx, esi
or esi, ebx
imul esi, ebx
lea eax, [ebp - 0x109]
push eax
push 0x5b
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop edi
xor edi, esi
add ebx, edi
imul ebx, edi
lea eax, [ebp - 0x169]
push eax
push 0x60
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub edi, ebx
add edi, eax
mov esi, edi
shl esi, 7
and esi, ebx
imul ebx, esi
imul edi, ebx
add edi, ebx
lea eax, [ebp - 0x5d]
push eax
push 0x4d
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub eax, esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xae]
push eax
push 0x51
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop esi
xor esi, ebx
xor esi, edi
mov edi, esi
xor edi, dword [ebp - 0x10]
sub esp, 4
call fcn.00528ee0
add esp, 4
and esi, eax
or ebx, esi
add ebx, eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + ecx]
xor eax, ebx
movsx eax, al
push edi
pop ebx
add ebx, ecx
add ebx, eax
imul ebx, eax
call fcn.00528480
push eax
pop edi
sub esp, 0xc
push ebx
call fcn.0052b430
add esp, 0x10
or ebx, eax
movsx ecx, bl
xor eax, ecx
add edi, eax
push ecx
push edi
push eax
push esi
call fcn.00528d40
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x160
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x526d40
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x58
mov ecx, dword [ebp + 8]
mov ebx, ecx
shl ebx, 0xa
lea eax, [ecx + ebx]
lea ecx, [ebx + ecx*2]
push dword [0x53e780]
push ebx
push eax
push ecx
call fcn.00527040
add esp, 0x10
mov esi, eax
push eax
pop edi
and edi, dword [ebp + 8]
or edi, 2
lea eax, [ebp - 0x62]
push eax
push 0x56
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp], eax
push eax
pop esi
call fcn.00524770
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [esp + 4], eax
call fcn.00528f40
add esp, 8
push esi
push ebx
mov ebx, dword [ebp + 8]
call fcn.005285b0
add esp, 8
push eax
pop edi
cmp dword [ebp + 0x14], ebx
je 0x526dc7
cmp esi, ebx
jne 0x526dd6
cmp edi, ebx
jne 0x526dd6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
shl eax, 9
xor eax, dword [ebp + 0x14]
imul eax, edi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x527040
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xa8
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
lea esi, [eax + ebx*2 + 0x2000]
lea eax, [ebp - 0xb2]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x5f
call edi
sub esp, 4
push esi
call fcn.00524610
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
call esi
call fcn.00526090
sub esp, 4
push eax
call fcn.0052a120
add esp, 8
lea eax, [ebp - 0x53]
push eax
push 0x47
call edi
push eax
pop edi
add edi, dword [ebp + 0x14]
push edi
pop esi
or esi, ebx
call fcn.00528be0
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [ebp + 0x14]
je 0x5270b3
cmp esi, ebx
jg 0x5270be
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
pop ecx
xor ecx, 2
cmp esi, ebx
je 0x5270d5
cmp edi, eax
jg 0x5270d5
cmp ebx, dword [ebp + 8]
je 0x5270d5
cmp eax, esi
jne 0x5270d5
xor ecx, edi
add ecx, edi
mov eax, ecx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x527230
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xe4
mov eax, dword [ebp + 8]
lea esi, [eax + eax + 1]
push eax
pop edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 8
mov dword [esp + 4], esi
call fcn.00528f40
add esp, 8
movsx ecx, al
xor ecx, edi
push ecx
pop edx
sub edx, eax
movsx edi, dl
add ecx, edi
mov eax, dword [0x53e574]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], ecx
call fcn.00524770
add esp, 0x10
mov esi, eax
add esi, 0x400
push esi
push edi
call fcn.005285b0
add esp, 8
movsx edi, al
or edi, esi
lea eax, [ebp - 0x5c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x44
call ebx
push eax
pop esi
mov eax, dword [ebp + 8]
add esi, eax
lea eax, [ebp - 0xef]
push eax
push 0x4a
call ebx
lea ebx, [eax - 0x80]
mov dword [ebp - 0x14], ebx
xor ebx, dword [ebp + 8]
movsx ecx, bl
push eax
push ecx
mov dword [ebp - 0x10], esi
push esi
mov dword [ebp - 0x18], edi
push edi
call fcn.00527040
mov ecx, dword [ebp + 8]
add esp, 0x10
cmp ecx, 0x610b4ec
jne 0x52730f
movsx eax, bl
cmp eax, ecx
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
je 0x527315
lea eax, [ebp - 0xa5]
push eax
push 0x49
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
jmp 0x527315
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
cmp ebx, esi
mov eax, esi
je 0x52732a
push edi
pop edx
movsx eax, dl
imul eax, edi
add eax, 0x40
imul eax, dword [ebp - 0x10]
cmp ecx, 0x2fe3a8e6
jne 0x527334
mov esi, eax
mov eax, esi
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x527ac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
shl eax, 0x10
mov edi, eax
and edi, esi
mov ebx, edi
xor ebx, esi
sub ebx, edi
or ebx, eax
or edi, 0x400
lea eax, [ebp - 0x7c]
push eax
push 0x5c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
add eax, 0xfffff800
imul eax, ebx
mov dword [ebp - 0x14], eax
mov ecx, esi
sub ecx, dword [ebp + 0xc]
add ecx, eax
push edi
push ecx
call fcn.005285b0
add esp, 8
mov dword [ebp - 0x18], eax
lea edi, [eax + esi*2]
or esi, edi
movsx esi, si
push edi
push edi
push 0
push esi
call fcn.00527040
add esp, 0x10
movsx ebx, al
sub ebx, edi
or ebx, 2
sub ebx, esi
movsx eax, al
and eax, ebx
cwde
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, dword [ebp - 0x14]
movsx eax, al
and eax, esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, edi
mov dword [ebp - 0x14], eax
add esi, eax
push esi
pop edi
xor edi, 0x200
movsx eax, bx
sub esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword [esp + 8], ecx
mov dword [ebp - 0x20], eax
mov dword [esp], eax
mov dword [esp + 0xc], edi
call fcn.00524770
add esp, 0x10
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [ebp + 0xc]
add eax, ebx
and eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
sub esp, 8
mov dword [esp + 4], eax
call fcn.00528f40
add esp, 8
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
xor eax, edx
add eax, edx
movsx eax, al
add eax, edi
or eax, ebx
cmp ecx, edi
jne 0x527bdd
cmp eax, edi
jne 0x527bdd
cmp eax, dword [ebp - 0x20]
jne 0x527bdd
imul esi, dword [ebp - 0x18]
shl esi, 8
jmp 0x527bf0
xor esi, dword [ebp - 0x1c]
xor esi, eax
and esi, ecx
shl esi, 0x18
add esi, 0x1000000
sar esi, 0x18
push esi
pop eax
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x528090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x118
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
lea eax, [ebp - 0x124]
push eax
push 0x56
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call esi
push eax
pop ebx
and eax, 1
lea ecx, [eax + 0x8000]
imul eax, ecx
movsx edi, ax
imul edi, ecx
or ebx, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add ebx, eax
xor ebx, edi
push ebx
pop esi
sub esi, edi
mov ecx, esi
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x7b]
push eax
push 0x53
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, eax
add edi, esi
push edi
call fcn.0052a580
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
imul ebx, eax
movsx ecx, bl
or ecx, 1
mov ebx, dword [ebp - 0x10]
add ecx, ebx
mov dword [ebp - 0x1c], ecx
push eax
push edi
call fcn.00526300
add esp, 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add eax, edi
not eax
and eax, 4
mov ecx, ebx
push ebx
pop edi
imul ecx, eax
movsx ebx, cl
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
imul eax, ebx
mov dword [ebp - 0x24], eax
cwde
mov dword [ebp - 0x18], eax
lea esi, [edi + eax]
sub esp, 8
call fcn.00526b60
add esp, 8
mov dword [ebp - 0x14], eax
push edi
call fcn.0052aa80
add esp, 4
mov dword [ebp - 0x20], eax
cwde
mov edx, esi
mov dword [ebp - 0x28], eax
cmp eax, esi
mov esi, dword [ebp - 0x1c]
jle 0x528182
movsx ecx, bx
movsx eax, bl
imul eax, ecx
cmp esi, eax
jle 0x528182
mov ecx, ebx
push edx
pop ebx
jmp 0x528195
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop ebx
mov ecx, dword [ebp - 0x18]
imul ecx, eax
movsx eax, cl
and eax, ebx
cmp eax, esi
movsx edi, cl
jne 0x5281be
cmp ebx, edi
je 0x5281be
cmp dword [ebp - 0x14], ebx
jle 0x5281a9
cmp ebx, edi
jl 0x5281be
lea eax, [ebp - 0xce]
push eax
push 0x53
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x20]
cmp word [ebp - 0x24], ax
je 0x5281cc
cmp dword [ebp - 0x10], edi
je 0x5281d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, ebx
imul eax, dword [ebp - 0x28]
add esp, 0x118
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5285b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x58]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
or eax, esi
add eax, esi
and eax, dword [ebp + 8]
imul eax, esi
sub esp, 4
push eax
call fcn.0052a120
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push eax
pop edi
sub edi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
and edi, eax
or edi, ebx
imul edi, eax
shl edi, 6
lea eax, [ebp - 0xdf]
push eax
push 0x45
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x135]
push eax
push 0x56
call esi
mov dword [ebp - 0x10], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
mov esi, eax
call fcn.00526090
call ebx
call fcn.00528be0
push eax
pop ebx
and ebx, edi
lea eax, [ebx + ebx]
mov dword [ebp - 0x14], eax
sub esp, 4
mov dword [ebp - 0x18], esi
push esi
call fcn.00524610
add esp, 8
push eax
pop esi
mov eax, dword [ebp + 0xc]
cmp eax, 0x10795c18
jne 0x528680
mov ecx, dword [ebp - 0x10]
imul ecx, eax
cmp ecx, eax
jne 0x528680
and esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, esi
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x52868c
cmp ebx, eax
jg 0x5286a1
lea eax, [ebp - 0x9a]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call eax
call esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret