joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5288a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x104
mov eax, dword [ebp + 0xc]
mov edi, eax
push eax
pop edx
or edi, 0x400
xor edi, 0x800
mov eax, edi
xor eax, dword [ebp + 0x10]
imul edi, dword [ebp + 8]
imul edi, eax
push edi
pop eax
imul eax, edx
add edi, eax
imul edi, eax
lea eax, [ebp - 0x61]
push eax
push 0x41
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov esi, eax
call ebx
add esi, dword [ebp + 0x10]
neg esi
lea esi, [eax + esi + 0x800]
call ebx
movsx eax, si
push edi
push eax
call fcn.00526300
add esp, 8
mov edi, eax
mov eax, dword [ebp + 0xc]
imul edi, eax
imul edi, eax
shl edi, 0x10
add edi, 0x20000000
sar edi, 0x10
lea eax, [edi - 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xb5]
push eax
push 0x54
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, eax
push eax
call fcn.0052aa80
add esp, 4
imul eax, ebx
movsx esi, ax
mov eax, esi
imul eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
xor eax, esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
and ebx, esi
lea eax, [ebp - 0x110]
push eax
push 0x5b
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
call fcn.0052a580
add esp, 4
mov esi, eax
sub esp, 8
call fcn.00526b60
add esp, 8
lea ecx, [eax + ebx]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], ecx
add ecx, esi
movsx edx, cx
mov ecx, edx
sub ecx, eax
cmp dword [ebp + 0x10], 0x9edaa147
jne 0x5289d0
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x5289d0
or edi, eax
mov eax, dword [ebp + 0xc]
imul ebx, eax
imul ebx, edi
cmp dword [ebp - 0x14], ebx
je 0x5289d0
push eax
pop esi
cmp edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
je 0x5289d3
mov eax, dword [ebp - 0x18]
lea eax, [ecx + eax*2]
and eax, esi
xor eax, 8
jmp 0x5289d3
mov eax, dword [ebp - 0x10]
add eax, ecx
imul eax, dword [ebp - 0x20]
add esp, 0x104
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x528c70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x53e370]
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.0052ee30
add esp, 0x14
sub esi, eax
and esi, 4
push 0
push 0xfffffffffffffffc
push esi
call fcn.0052b1f0
add esp, 0xc
mov edi, eax
mov ebx, dword [0x53e38c]
push 0
push 0
push 0xffffffffffffffff
push ebx
call fcn.0052df60
add esp, 0x10
and eax, 0x7a61f3d8
and ebx, 0x859e0c27
sub esp, 0x14
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.005311a0
add esp, 0x14
mov ebx, eax
cmp edi, eax
je 0x528d20
cmp dword [0x53e364], 0x5bdf4040
jne 0x528d20
mov eax, ebx
xor eax, edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
pop esi
xor edi, eax
cmp edi, esi
lea eax, [edi + edi + 0x8000]
je 0x528d2d
push eax
pop edi
cmp ebx, esi
jne 0x528d33
push eax
pop edi
mov dword [ebp - 0x10], edi
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x528d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
lea eax, [ebp - 0x5e]
mov dword [esp + 4], eax
mov dword [esp], 0x46
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
call fcn.0052b370
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call esi
mov esi, eax
mov dword [esp + 8], eax
add esi, dword [ebp + 0x10]
call fcn.0052bfa0
mov dword [ebp - 0x10], eax
lea ebx, [eax - 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call fcn.0052ba20
mov dword [ebp - 0x14], eax
call fcn.0052b710
cmp dword [ebp + 0x14], 0x6dadbb6a
mov dword [ebp - 0x18], eax
jne 0x528e04
cmp esi, ebx
je 0x528e04
mov ebx, dword [ebp + 8]
xor edi, ebx
lea ecx, [edi + 0x100]
xor ecx, edi
add ecx, dword [ebp + 0x10]
and ecx, dword [ebp + 0xc]
imul ecx, dword [ebp - 0x14]
mov edi, eax
sub edi, esi
add edi, ecx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
sub esp, 8
mov esi, edi
mov eax, dword [ebp - 0x10]
add eax, edi
cmp ebx, 0x2e5e75e2
jne 0x528e0f
cmp dword [ebp - 0x18], eax
jg 0x528e0f
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsZoomed]
sub esp, 4
mov esi, eax
jmp 0x528e0f
mov ebx, dword [ebp + 8]
cmp ebx, 0x2e5e75e2
je 0x528dec
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x528ee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x60
movsx esi, byte [0x53e77c]
call fcn.0052b370
mov dword [esp + 8], eax
call fcn.0052bfa0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call fcn.0052ba20
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x52]
mov dword [esp + 4], eax
mov dword [esp], 0x4e
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
movsx esi, al
imul esi, eax
call fcn.0052b710
sub eax, esi
add eax, eax
sub eax, esi
movsx eax, al
add esp, 0x60
pop esi
pop ebp
ret
Function at 0x528f40
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x98
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
call fcn.00526090
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call ebx
lea eax, [ebp - 0xa3]
push eax
push 0x4d
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, eax
call ebx
push eax
pop ebx
shl al, 6
push edi
pop ecx
push ecx
pop edx
xor dl, al
mov byte [ebp - 0x14], dl
movsx edi, dl
sub esp, 4
push ecx
call fcn.0052a120
add esp, 8
xor eax, esi
movsx eax, al
add eax, esi
sub esp, 4
push eax
call fcn.00524610
add esp, 8
push eax
pop ecx
mov al, byte [ebp - 0x14]
mul cl
movsx esi, al
imul esi, edi
add ebx, esi
add bl, al
movsx ecx, bl
mov dword [ebp - 0x14], ecx
or bl, al
lea eax, [ebp - 0x56]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
add esi, eax
imul esi, dword [ebp - 0x14]
call fcn.00528be0
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x866f80cd
je 0x52900d
cmp ecx, 0x74293ca5
jne 0x52901f
movsx ecx, bl
cmp esi, ecx
mov ecx, dword [ebp - 0x10]
jg 0x529022
movsx ecx, al
sub ecx, esi
jmp 0x529022
movsx ecx, bl
xor ecx, esi
xor edi, esi
sub eax, eax
or edi, ecx
je 0x529024
mov eax, dword [ebp - 0x10]
jmp 0x529024
mov ecx, dword [ebp - 0x10]
push ecx
pop eax
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x529030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xf4
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0xa9]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x53
call esi
lea eax, [ebp - 0xfd]
push eax
push 0x54
call esi
mov edi, eax
xor edi, ebx
add edi, eax
add ebx, edi
push ebx
pop eax
xor eax, edi
or ebx, edi
push dword [ebp + 8]
push edi
push ebx
push eax
call fcn.00527040
add esp, 0x10
lea eax, [ebp - 0x56]
push eax
push 0x4a
call esi
mov esi, eax
sub esp, 8
mov dword [esp + 4], ebx
call fcn.00528f40
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, edi
imul ecx, eax
imul ecx, esi
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edi
call fcn.00524770
add esp, 0x10
push eax
pop ebx
push eax
push dword [ebp + 8]
call fcn.005285b0
mov ecx, dword [ebp + 0x10]
add esp, 8
mov esi, eax
cmp eax, ecx
jne 0x5290da
mov edi, ebx
mov eax, dword [ebp + 8]
cmp ecx, 0xb89099c5
jne 0x5290ec
jmp 0x5290ee
mov edi, esi
mov eax, dword [ebp + 8]
imul edi, eax
xor edi, esi
cmp ecx, 0xb89099c5
je 0x5290ee
push ebx
pop edi
cmp ebx, eax
jne 0x5290f4
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
imul ecx, esi
and eax, ecx
cmp eax, esi
jne 0x529109
cmp ecx, edi
je 0x52910f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0xf4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x529350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 0x14]
mov bl, byte [ebp + 0xc]
mov bh, byte [ebp + 8]
push edx
pop ecx
or cl, bl
add cl, dl
xor cl, 1
mov eax, ebx
mul bh
mul cl
push eax
pop ecx
movsx eax, al
cmp dword [ebp + 0x10], 0x8d4efafb
movsx esi, bh
jne 0x5293a1
cmp cl, bl
je 0x5293a1
movsx edi, bl
push esi
push edx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
movsx eax, al
push eax
push edi
push 0x8d4efafb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor bl, bh
mov ecx, eax
xor ecx, esi
imul ecx, eax
or ecx, esi
movsx eax, cx
mov dword [ebp - 0x10], eax
push ebx
pop eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5294f0
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x168
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x114]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x5c
call ebx
push eax
pop esi
or esi, edi
lea eax, [ebp - 0x173]
push eax
push 0x5f
call ebx
push eax
pop ebx
imul edi, eax
imul edi, esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [ebp - 0x1c], ebx
add eax, ebx
imul eax, esi
movsx eax, al
xor edi, eax
imul edi, dword [ebp + 8]
add edi, 0x2000
mov ecx, edi
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x63]
push eax
push 0x47
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call esi
push edi
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.005285b0
add esp, 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
pop eax
movsx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
movsx eax, byte [ebp - 0x10]
sub esp, 8
mov dword [esp + 4], eax
call fcn.00528f40
add esp, 8
lea eax, [ebp - 0xb8]
push eax
push 0x55
call esi
push eax
pop esi
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp], ebx
mov dword [esp + 8], 0
call fcn.00524770
add esp, 0x10
mov dword [ebp - 0x10], eax
push edi
push esi
push 0
push 0
call fcn.00527040
add esp, 0x10
sub edx, edx
cmp dword [ebp + 8], 0xaba57a08
jne 0x5295f8
mov ebx, eax
cmp eax, esi
push 0
pop eax
pushal
popal
jne 0x529617
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
xor edi, eax
cmp dword [ebp - 0x14], edi
je 0x5295fc
sub ebx, ebx
cmp esi, eax
jg 0x529604
jmp 0x529606
xor eax, eax
jmp 0x529617
and ebx, eax
xor ebx, edi
cmp esi, eax
jle 0x529606
sub ebx, ebx
add ebx, edi
call dword [sym.imp.USER32.dll_ReleaseCapture]
call dword [sym.imp.KERNEL32.dll_GetLastError]
movsx edx, bl
movsx ecx, byte [ebp - 0x10]
imul ecx, eax
sub ecx, edx
push ecx
pop eax
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x529da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov ebx, dword [ebp + 0xc]
movsx edi, bl
push dword [0x53e4c8]
push dword [0x53e838]
push 0
push edi
call fcn.00527040
add esp, 0x10
push eax
pop esi
push edi
push eax
call fcn.005285b0
mov dword [esp + 4], esi
call fcn.00528f40
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
call esi
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
pop edi
imul edi, ebx
push edi
pop ebx
xor ebx, eax
and ebx, dword [ebp + 0x10]
and ebx, dword [ebp - 0x14]
movsx esi, bl
mov ecx, esi
mov dword [ebp - 0x1c], eax
xor ecx, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0xbe]
push eax
push 0x55
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x14], ebx
and ebx, eax
movsx ecx, bl
sub esp, 0x10
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [ebp - 0x18], ecx
mov dword [esp + 0xc], ecx
call fcn.00524770
add esp, 0x10
cmp dword [ebp + 8], 0x2725d8d3
jne 0x529e9e
mov ecx, eax
mov eax, dword [ebp + 0x10]
cmp edi, eax
je 0x529ea6
cmp edi, dword [ebp + 0xc]
jne 0x529ea6
cmp byte [ebp - 0x14], bl
je 0x529ea6
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_InflateRect]
push eax
pop esi
lea eax, [ebp - 0x69]
push eax
push 0x4d
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop ecx
movsx eax, bl
sub ecx, eax
mov eax, dword [ebp + 0x10]
mov ebx, esi
mov dword [ebp - 0x18], ecx
add ebx, ecx
cmp eax, 0xb919155
je 0x529eb3
mov esi, dword [ebp - 0x18]
jmp 0x529ed6
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
jmp 0x529ea9
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
cmp eax, 0xb919155
jne 0x529e99
mov esi, dword [ebp - 0x18]
cmp esi, eax
jne 0x529ed6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push 0xb919155
push edi
push 0xb919155
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ebx, eax
add ebx, edi
movsx ecx, bl
mov edx, ecx
sub edx, dword [ebp + 8]
imul edx, esi
mov eax, dword [ebp - 0x14]
and eax, edx
movsx eax, al
add eax, edx
and eax, ecx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52a120
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov esi, ebx
and esi, 0x8000
imul esi, ebx
push dword [0x53e844]
push dword [0x53e780]
push esi
and esi, ebx
push esi
call fcn.00524540
add esp, 0x10
imul esi, eax
xor eax, esi
sub esp, 4
push eax
push esi
call fcn.005254a0
add esp, 0xc
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.00525220
mov edi, eax
add edi, ebx
call fcn.00524a50
cmp edi, ebx
jge 0x52a189
cmp eax, edi
je 0x52a18f
cmp esi, ebx
je 0x52a189
xor edi, esi
cmp eax, edi
jne 0x52a18f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x65]
push eax
push 0x59
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
imul eax, ebx
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52a580
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x130
sub esp, 4
call fcn.00528ee0
add esp, 4
push eax
pop ebx
mov edi, eax
imul edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [ebp - 0x52]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x10], eax
sub eax, edi
movsx esi, al
imul ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
sub edi, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
pop eax
shl eax, 0x18
add eax, 0x20000000
sar eax, 0x18
push eax
push ebx
push esi
push edi
call fcn.00528d40
add esp, 0x10
call fcn.00528480
sub esp, 0xc
push eax
call fcn.0052b430
add esp, 0x10
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp + 8]
cmp eax, 0x8e57d97b
jne 0x52a61a
cmp dword [ebp - 0x10], eax
jne 0x52a61a
imul ebx, edi
cmp ebx, eax
je 0x52a61a
call dword [sym.imp.USER32.dll_CreatePopupMenu]
lea eax, [ebp - 0x13b]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x59
call esi
lea eax, [ebp - 0xe2]
push eax
push 0x4a
call esi
lea eax, [ebp - 0x98]
push eax
push 0x46
call esi
add esp, 0x130
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52aa80
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edx, dword [ebp + 8]
mov eax, edx
or al, 4
movsx ecx, al
shl al, 4
movsx eax, al
add ecx, edx
add ecx, eax
movsx esi, dl
push edx
pop ebx
not esi
and esi, ecx
lea eax, [ebp - 0x68]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, eax
imul edi, esi
add edi, eax
lea eax, [edi + ebx]
mov dword [ebp - 0x10], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
push eax
pop ebx
imul ebx, esi
call ecx
push eax
pop esi
add esi, edi
add esi, ebx
sub esp, 4
call fcn.00528ee0
add esp, 4
push eax
pop ebx
or ebx, edi
imul ebx, dword [ebp + 8]
shl ebx, 0xa
or ebx, 0x100
sub ebx, esi
call fcn.00528480
shl eax, 0xb
mov dword [ebp - 0x20], eax
add eax, edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop edx
mov dword [ebp - 0x14], eax
add edi, eax
lea ecx, [ebx + edi]
push ecx
pop eax
xor eax, 8
mov dword [ebp - 0x1c], eax
or eax, edx
movsx edx, byte [ebp - 0x10]
mov dword [ebp - 0x28], ecx
push ecx
mov dword [ebp - 0x24], edx
push edx
push eax
push dword [ebp - 0x18]
call fcn.00528d40
add esp, 0x10
or eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
movsx eax, al
mov dword [ebp - 0x10], eax
sub esp, 0xc
mov dword [ebp - 0x14], esi
push esi
call fcn.0052b430
add esp, 0x10
push eax
pop ecx
cmp dword [ebp + 8], 0x808b8f2c
jne 0x52ab79
cmp edi, dword [ebp - 0x20]
je 0x52ab79
mov eax, dword [ebp - 0x10]
lea ebx, [eax + ecx]
push eax
push ebx
mov esi, ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, esi
xor eax, eax
cmp ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x28]
je 0x52ab99
or esi, esi
jne 0x52ab8c
cmp ebx, dword [ebp - 0x1c]
je 0x52ab99
push ecx
pop ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, ebx
xor eax, dword [ebp - 0x14]
cmp dword [ebp + 8], 0xb306cf77
jne 0x52abbe
cmp ecx, dword [ebp - 0x24]
jg 0x52abbe
cmp eax, edi
jne 0x52abbe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movsx eax, byte [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push eax
pop esi
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52b0a0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov esi, dword [0x53e468]
push esi
pop eax
xor eax, 0x7d12e0e4
push 0
push eax
push 0x334719b8
call fcn.00527970
add esp, 0xc
xor esi, 0xb1aa06a2
je 0x52b0e9
cmp dword [0x53e360], 0x22db9e1f
jne 0x52b0e9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 8], eax
push esi
pop eax
add esp, 4
pop esi
pop ebp
ret
Function at 0x52b370
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x9c
mov esi, dword [0x53e574]
shl esi, 0xd
or esi, 0x20000000
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
add esi, eax
imul eax, esi
or eax, esi
mov ecx, dword [0x53e504]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.0053a350
add esp, 0xc
lea eax, [ebp - 0xa7]
push eax
push 0x57
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
pop esi
call edi
sub esp, 8
push eax
call fcn.0052bbe0
add esp, 0xc
call ebx
call ebx
call fcn.0052bc80
push eax
pop ebx
imul esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [eax + esi]
push edi
push ebx
push eax
call fcn.00526ab0
add esp, 0xc
cmp ebx, esi
jne 0x52b405
cmp ebx, edi
jne 0x52b419
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x50]
push eax
push 0x44
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
pop edi
mov eax, edi
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x52b430
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0xb8
lea eax, [ebp - 0xb2]
mov dword [esp + 4], eax
mov dword [esp], 0x59
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call esi
sub esp, 8
lea eax, [ebp - 0x59]
mov dword [esp + 4], eax
mov dword [esp], 0x4d
call esi
sub esp, 8
call fcn.0052b370
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
add eax, 0xffffffe0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call fcn.0052ba20
push eax
pop esi
call fcn.0052b710
push eax
pop edi
mov dword [esp + 8], esi
call fcn.0052bfa0
mov esi, eax
or ebx, ebx
jne 0x52b4a5
cmp edi, dword [ebp + 8]
jl 0x52b4b4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
shl eax, 8
and eax, ecx
add eax, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52ba20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea esi, [eax + 8]
imul esi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
xor eax, esi
lea esi, [eax + edi*2]
mov dword [ebp - 0x14], esi
call ebx
imul edi, esi
imul edi, eax
lea eax, [ebp - 0x8e]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x5a
call esi
mov ebx, eax
lea eax, [ebp - 0xee]
push eax
push 0x60
call esi
mov esi, eax
sub ebx, dword [ebp + 0xc]
add ebx, eax
sub ebx, edi
movsx edi, bl
add edi, dword [ebp + 0x10]
lea ebx, [edi + eax]
sub esp, 8
push eax
call fcn.0052bbe0
add esp, 0xc
imul ebx, edi
movsx eax, bl
mov dword [ebp - 0x10], eax
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0053a350
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
call fcn.0052bc80
mov dword [ebp - 0x28], eax
movsx esi, al
push esi
pop eax
mov ecx, dword [ebp - 0x14]
and eax, ecx
mov dword [ebp - 0x1c], eax
lea ebx, [eax + ecx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
pop edi
mov dword [ebp - 0x20], esi
or edi, esi
xor ebx, edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x24], eax
movsx esi, al
mov dword [ebp - 0x2c], esi
sub esi, edi
imul esi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov ecx, dword [ebp - 0x14]
push ecx
pop eax
imul eax, ebx
mov dword [ebp - 0x34], eax
push esi
mov esi, ecx
push dword [ebp - 0x10]
push ecx
call fcn.00526ab0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x10], ebx
cmp ebx, ecx
jne 0x52bb33
mov edx, edi
mov edi, dword [ebp - 0x18]
jmp 0x52bb4c
push edi
pop edx
cmp esi, edi
mov edi, dword [ebp - 0x18]
je 0x52bb44
mov ebx, dword [ebp - 0x24]
cmp bl, byte [ebp - 0x28]
je 0x52bb4c
movsx esi, al
and esi, edi
add esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x34]
shl ebx, 0x10
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov ecx, eax
je 0x52bbc2
cmp ecx, dword [ebp - 0x10]
jg 0x52bbc2
or esi, 0x800
mov edx, edi
push esi
pop edi
mov eax, esi
xor eax, 1
add eax, dword [ebp - 0x1c]
push eax
pop esi
push edi
pop eax
push edx
pop edi
cmp ecx, ebx
je 0x52bbcc
cmp dword [ebp + 0xc], 0xedf5bb9
jne 0x52bbcc
mov edx, eax
mov eax, dword [ebp - 0x1c]
cmp edi, eax
jne 0x52bbca
cmp esi, eax
mov eax, edx
je 0x52bbcc
mov eax, dword [ebp - 0x2c]
push eax
push edi
pop edx
mov edi, dword [ebp - 0x10]
push edi
push edi
push eax
push 0xedf5bb9
push edx
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
push ebx
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x30]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
and eax, 0x40
jmp 0x52bbcc
mov eax, edx
cmp ecx, ebx
jne 0x52bb7c
jmp 0x52bbcc
push edx
pop eax
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x52bbe0
Capabilities:
Get common file path

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push esi
sub esp, 0x9c
mov eax, dword [ebp + 8]
lea esi, [eax - 0x100]
and esi, eax
call fcn.0053a080
imul esi, eax
mov ecx, dword [0x53e364]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
call fcn.00525110
push eax
pop esi
lea eax, [ebp - 0x97]
mov dword [esp + 4], eax
mov dword [esp], 0x48
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call ebx
sub esp, 8
push eax
pop edi
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [ebp - 0x4f]
mov dword [esp + 4], eax
mov dword [esp], 0x43
call ebx
sub esp, 8
mov dword [esp], edi
call fcn.0053a590
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
call fcn.0053a860
call esi
add esp, 0x9c
pop esi
pop edi
pop ebx
pop ebp
ret