joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x4dca88
mov dword [ebp - 0x7c], 0x44004c
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x490053
push edi
mov dword [ebp - 0x74], 0x73006e
mov edx, 0x3d
mov dword [ebp - 0x70], 0x610074
sub esi, eax
mov dword [ebp - 0x6c], 0x6c006c
mov dword [ebp - 0x68], 0x720065
mov dword [ebp - 0x64], 0x61004d
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x690057
mov dword [ebp - 0x58], 0x64006e
mov dword [ebp - 0x54], 0x77006f
mov dword [ebp - 0x50], 0x45005f
mov dword [ebp - 0x4c], 0x410039
mov dword [ebp - 0x48], 0x350032
mov dword [ebp - 0x44], 0x340035
mov dword [ebp - 0x40], 0x2d0042
mov dword [ebp - 0x3c], 0x450044
mov dword [ebp - 0x38], 0x460043
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x320044
mov dword [ebp - 0x2c], 0x2d0036
mov dword [ebp - 0x28], 0x350039
mov dword [ebp - 0x24], 0x380036
mov dword [ebp - 0x20], 0x39002d
mov dword [ebp - 0x1c], 0x350037
mov dword [ebp - 0x18], 0x430043
mov dword [ebp - 0x14], 0x390036
mov dword [ebp - 0x10], 0x320045
mov dword [ebp - 0xc], 0x350041
mov dword [ebp - 8], 0x42
lea ecx, [edx + 0x7fffffc1]
test ecx, ecx
je 0x42e1b2
movzx ecx, word [esi + eax]
test cx, cx
je 0x42e1b2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42e194
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x4dca88
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x42e1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x4dcb08
mov dword [ebp - 0x68], 0x64006c
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x690073
push edi
mov dword [ebp - 0x60], 0x73006e
mov edx, 0x33
mov dword [ebp - 0x5c], 0x610074
sub esi, eax
mov dword [ebp - 0x58], 0x6c006c
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x44003a
mov dword [ebp - 0x4c], 0x390038
mov dword [ebp - 0x48], 0x340036
mov dword [ebp - 0x44], 0x460035
mov dword [ebp - 0x40], 0x2d0043
mov dword [ebp - 0x3c], 0x390043
mov dword [ebp - 0x38], 0x300030
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x440031
mov dword [ebp - 0x2c], 0x2d0041
mov dword [ebp - 0x28], 0x450042
mov dword [ebp - 0x24], 0x410039
mov dword [ebp - 0x20], 0x46002d
mov dword [ebp - 0x1c], 0x320044
mov dword [ebp - 0x18], 0x440033
mov dword [ebp - 0x14], 0x390032
mov dword [ebp - 0x10], 0x330035
mov dword [ebp - 0xc], 0x410041
mov dword [ebp - 8], 0x36
lea ecx, [edx + 0x7fffffcb]
test ecx, ecx
je 0x42e2cf
movzx ecx, word [esi + eax]
test cx, cx
je 0x42e2cf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42e2b1
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x4dcb08
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x42ec60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3a7c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4d61d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 4
lea esi, [edi + 0x28]
mov dword [edi], vtable.RunTaskInUiThread.0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00429be0
mov dword [esi], eax
mov byte [ebp - 4], 7
lea eax, [edi + 0x34]
push 2
push eax
mov dword [edi + 0x30], 1
mov dword [ebp - 0x14], eax
call fcn.004338df
add esp, 8
mov byte [ebp - 4], 9
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42fe30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50], 0x630039
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x50]
mov eax, 0x4dcb80
mov dword [ebp - 0x4c], 0x620032
push edi
mov dword [ebp - 0x48], 0x630066
mov edx, 0x26
mov dword [ebp - 0x44], 0x390033
sub esi, eax
mov dword [ebp - 0x40], 0x31002d
mov dword [ebp - 0x3c], 0x330030
mov dword [ebp - 0x38], 0x2d0034
mov dword [ebp - 0x34], 0x320034
mov dword [ebp - 0x30], 0x620031
mov dword [ebp - 0x2c], 0x39002d
mov dword [ebp - 0x28], 0x390039
mov dword [ebp - 0x24], 0x2d0065
mov dword [ebp - 0x20], 0x350065
mov dword [ebp - 0x1c], 0x630035
mov dword [ebp - 0x18], 0x390036
mov dword [ebp - 0x14], 0x620061
mov dword [ebp - 0x10], 0x610037
mov dword [ebp - 0xc], 0x610032
lea ecx, [edx + 0x7fffffd8]
test ecx, ecx
je 0x42fef4
movzx ecx, word [esi + eax]
test cx, cx
je 0x42fef4
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42fed6
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x4dcb80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x430460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.0043a680
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x1c], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x4304a0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43048f
mov eax, dword [esi]
push eax
call fcn.0044a240
add esp, 4
test eax, eax
je 0x4305e5
xorps xmm0, xmm0
mov dword [ebp - 0x1058], 0x44
lea eax, [ebp - 0x1058]
movlpd qword [ebp - 0x1054], xmm0
push eax
movlpd qword [ebp - 0x104c], xmm0
movlpd qword [ebp - 0x1044], xmm0
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movlpd qword [ebp - 0x102c], xmm0
movlpd qword [ebp - 0x1024], xmm0
movlpd qword [ebp - 0x101c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x10]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x1028], ax
lea eax, [ebp - 0x1004]
push 0
push eax
mov dword [ebp - 0x102c], 1
movups xmmword [ebp - 0x1014], xmm0
call fcn.004693b0
add esp, 0xc
cmp dword [edi + 0x10], 0
je 0x43055d
cmp dword [edi + 0x14], 8
jb 0x43053d
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x430545
mov esi, dword [esi]
push edi
push esi
lea eax, [ebp - 0x1004]
push 0x4acb60
push eax
call fcn.0042fb70
add esp, 0x10
jmp 0x43057a
cmp dword [esi + 0x14], 8
jb 0x430565
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x1004]
push 0x4acb70
push eax
call fcn.0042fb70
add esp, 0xc
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x4305e5
cmp byte [ebp + 0x14], 0
je 0x4305bd
push dword [ebp + 0x18]
push dword [ebp - 0x1014]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x1010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1014]
call esi
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x430950
Capabilities:
Get session user name
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3ff6
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x43099e
mov eax, 1
jmp 0x430b35
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4309b0
xor eax, eax
jmp 0x430b35
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.00430330
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.0041b6c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
push 0x1a
call fcn.0041b7f0
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x430a25
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x234]
push 0xf003f
cmovae ecx, dword [ebp - 0x234]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.0041b870
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x105
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.0041b710
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x430a96
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x234]
push 0xf003f
cmovae ecx, dword [ebp - 0x234]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.0041b870
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x430aaa
mov esi, 1
jmp 0x430b12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x430ab9
xor esi, esi
jmp 0x430b12
push 1
lea ecx, [ebp - 0x238]
call fcn.0041b7f0
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x430b07
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x234]
push 0xf003f
cmovae ecx, dword [ebp - 0x234]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.0041b870
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.0041b6d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00404220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x431ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a43a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [eax + 0x14], 8
jb 0x431ed7
mov eax, dword [eax]
push 0xfde9
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00431e20
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, esi
cmp byte [ecx + eax], 0x5c
je 0x431f1d
push 1
push 0x4a9a88
lea ecx, [ebp - 0x28]
call fcn.00407260
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x431f44
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004041a0
jmp 0x431fbb
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x431f33
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x431fa9
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x431f9f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431fd8
push edx
push ecx
call fcn.00439e29
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
call fcn.0046c89c
int3

Function at 0x431fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x431ff6
mov eax, dword [eax]
push 0x4add0c
push eax
lea eax, [ebp - 4]
push eax
call fcn.00470153
mov ecx, dword [ebp - 4]
add esp, 0xc
test ecx, ecx
jne 0x43201c
call fcn.0046c983
mov eax, dword [eax]
neg eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp dword [eax + 0x14], 0x10
lea edi, [eax + 0x10]
jb 0x43202c
mov eax, dword [eax]
push ecx
push dword [edi]
push 1
push eax
call fcn.004738f6
push dword [ebp - 4]
mov esi, eax
call fcn.0047002d
add esp, 0x14
xor eax, eax
cmp esi, dword [edi]
cmovne esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4323d0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4490
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 0
test esi, esi
jne 0x432423
mov edi, 0x80004003
jmp 0x43248e
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 1
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x432449
mov edi, 0x80004005
jmp 0x432478
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0
push ecx
xorps xmm0, xmm0
push 1
push eax
movups xmmword [ebp - 0x2c], xmm0
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor ecx, ecx
mov edi, 0x80004005
test eax, eax
mov eax, dword [ebp - 0x30]
cmovne edi, ecx
mov byte [ebp - 4], 0
test eax, eax
je 0x43248e
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4324a7
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x34], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x437dc0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a48ba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d61d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00406390
mov ecx, eax
test ecx, ecx
je 0x437f84
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00406390
mov ecx, eax
test ecx, ecx
je 0x437f8e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00406390
mov ecx, eax
test ecx, ecx
je 0x437f98
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x437ea2
xor ecx, ecx
jmp 0x437ec0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437eb0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406de0
push edi
mov ecx, ebx
call fcn.0040d5b0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x437edc
xor ecx, ecx
jmp 0x437ef4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437ee4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00406de0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00438950
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0040d5b0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x437f35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x437f6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x437f6e
cmp dword [esi + 0x10], 0
je 0x437f65
push dword [edi]
call fcn.00477f87
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00405790
push 0x80004005
call fcn.00405790
push 0x80004005
call fcn.00405790
int3
Function at 0x4386d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a49a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4388a4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x438725
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x4388a4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x438743
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x4388a4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x438761
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x4388a4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x43877f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x4388a4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4388a4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4387a4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x4387d7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x4387ef
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x43882d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.004071f0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.004688b0
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x4b1168
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00439620
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43885b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x438894
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x438894
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.0040c890
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00404220
lea ecx, [ebp - 0x28]
call fcn.00404220
lea ecx, [ebp - 0x34]
call fcn.0040d270
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret 4
Function at 0x438ef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4a97
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x438f3a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438f46
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.004077e0
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x438fb3
push 0x48
call fcn.00439df9
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x438fa7
push 0x48
push 0
push ebx
call fcn.004693b0
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00437dc0
jmp 0x438fa9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438fe0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004077e0
push 3
push 0x4b1168
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00407570
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43902f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x43907e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x43907e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.004077e0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00404220
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4390b4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4390aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4390f1
push edx
push ecx
call fcn.00439e29
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4390d3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret 0x14
call fcn.0046c89c
int3