joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029400
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100aa394]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
mov dword [ebp - 0x210], eax
jne 0x10029597
mov esi, dword [edi + 0x28]
push 0
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10029d00
mov dword [edi + 0x28], esi
test eax, eax
jne 0x1002947d
mov eax, dword [ebp + 0xc]
cmp eax, 0x10
jne 0x10029487
push 0
push 0
push 0x7e9
push dword [edi + 0x74]
mov dword [edi + 0x70], 1
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebx], 0
cmp dword [edi + 0x70], 0
je 0x10029597
mov eax, 1
jmp 0x10029599
cmp eax, 0x111
jne 0x10029597
mov eax, dword [ebp + 0x10]
mov ecx, 0x3eb
movzx eax, ax
cmp cx, ax
jne 0x100294dd
push 0
push 0
push 0
push 0
push str.btn_close
call fcn.1000eab0
mov ecx, eax
call fcn.1003d2e0
push 0
push 0
push 0x7e9
push dword [edi + 0x74]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebx], 0
mov eax, 1
jmp 0x10029599
mov ecx, 0x3ea
cmp cx, ax
jne 0x10029597
push 0
push 0
push 0
push 0
push str.btn_set
call fcn.1000eab0
mov ecx, eax
call fcn.1003d2e0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1005be50
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x100ac52c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
push str.ComputerZ_CN.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002958a
push 0
push 0
push 1
push 1
push dword [0x100a926c]
lea eax, [ebp - 0x20c]
push eax
call fcn.100234b0
add esp, 0x18
mov dword [ebx], 0
mov eax, 1
jmp 0x10029599
xor eax, eax
mov ecx, dword [ebp - 0x210]
mov dword [edi + 0x70], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003f57d
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10033590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x100335b9
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 4], 0
movzx eax, word [ebp + 8]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x100335da
xor esi, esi
jmp 0x100336cd
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x100336cd
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1003360b
xor esi, esi
jmp 0x100336cd
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x10033628
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
jmp 0x100336cd
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x10033648
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
jmp 0x100336cd
push esi
push dword [ebp + 8]
push eax
call fcn.1005b350
add esp, 0xc
mov dword [ebp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 0x10]
xor esi, esi
test eax, eax
je 0x10033672
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x100336b9
mov edi, dword [ebp + 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x100336b5
lea eax, [ebp + 8]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push edi
mov dword [ebp + 8], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
jmp 0x100336c0
xor esi, esi
jmp 0x100336c0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100336cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 4], esi
pop edi
test esi, esi
jne 0x100336dd
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x100336f7
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebx + 4]
mov dword [ebx + 8], eax
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], 0
push dword [esi + 4]
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x1003371a
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebx + 0xc], eax
call fcn.10033520
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10037740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083b01
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100aa394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.10004ec0
mov ecx, eax
test ecx, ecx
je 0x100378d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10037895
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10037887
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10037895
add eax, 0x10
push 0x100ac6da
push eax
mov dword [ebp - 0x20], eax
call fcn.1003fc12
mov esi, eax
add esp, 8
test esi, esi
je 0x10037895
push dword [ebp - 0x20]
push 0
push esi
call fcn.1005be50
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003784a
push esi
call fcn.1003f5ec
add esp, 4
jmp 0x10037895
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10037850
sub ecx, edx
sar ecx, 1
je 0x1003787e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10037866
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.10006390
push esi
call fcn.1003f5ec
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10037895
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100378b4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003f57d
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10004b70
int3
Function at 0x100378e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100aa394]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10037904
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x10037966
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x10037966
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10037981
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003f57d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100386f0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083c78
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100aa394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edx, 2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [eax]
mov eax, ecx
add ecx, 0xa
shr eax, 6
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100400c8
mov ecx, dword [ebp - 0x2c]
mov edi, eax
add ecx, ecx
push ecx
push 0
push edi
call fcn.1005be50
add esp, 0x10
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x80000001
push dword [ebp + 0xc]
push esi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ecx, edi
mov dword [ebp - 0x18], 0
mov esi, eax
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10038794
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10007bd0
push 2
push edi
mov dword [ebp - 4], 0
call fcn.1003f20c
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edi, dword [ebp - 0x28]
test esi, esi
je 0x10038896
cmp ebx, 8
lea eax, [ebp - 0x28]
cmovae eax, edi
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x30], edx
nop dword [eax]
cmp ebx, 8
lea ecx, [ebp - 0x28]
cmovae ecx, edi
lea ecx, [ecx + edx*2]
cmp eax, ecx
je 0x10038864
cmp word [eax], 0xa
jne 0x1003885c
cmp ebx, 8
lea ecx, [ebp - 0x28]
cmovae ecx, edi
sub eax, ecx
sar eax, 1
cmp edx, eax
jb 0x100388e4
mov ecx, edx
lea esi, [eax + eax]
sub ecx, eax
mov edx, 1
cmp ecx, edx
cmovb edx, ecx
cmp ebx, 8
mov ebx, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
cmovae ecx, edi
sub ebx, edx
mov dword [ebp - 0x18], ebx
add ecx, esi
sub ebx, eax
lea eax, [ebx*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call fcn.1005b8d0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
add esp, 0xc
cmp ebx, 8
cmovae eax, edi
add eax, esi
jmp 0x100387d6
add eax, 2
jmp 0x100387e0
mov esi, dword [ebp - 0x34]
mov ecx, dword [esi]
cmp edx, ecx
jbe 0x10038871
xor esi, esi
jmp 0x10038896
cmp ebx, 8
lea eax, [ebp - 0x28]
push edx
cmovae eax, edi
push eax
push ecx
push dword [ebp - 0x38]
call fcn.1006c402
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov dword [esi], eax
mov esi, dword [ebp - 0x3c]
cmp ebx, 8
jb 0x100388c6
lea ebx, [ebx*2 + 2]
mov eax, edi
cmp ebx, 0x1000
jb 0x100388bc
mov edi, dword [edi - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100388e9
push ebx
push edi
call fcn.1003f20c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003f57d
mov esp, ebp
pop ebp
ret
call fcn.10007590
call fcn.1005f339
int3
Function at 0x1003a750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083da8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100aa394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1003f1dc
mov edi, eax
add esp, 4
test edi, edi
je 0x1003a7f4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1002b048
add esp, 4
mov dword [edi + 4], eax
jmp 0x1003a7f6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.1000c490
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x1003a857
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x1003a857
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x1003a87a
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1003a89d
cmp byte [ebp + 0xc], 0
je 0x1003a889
push esi
call fcn.1002b569
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1003a8a9
mov esi, str.ios_base::badbit_set
jmp 0x1003a8b9
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10008a30
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10003af0
push 0x100a04ec
lea eax, [ebp - 0x30]
push eax
call fcn.1005af34
int3
Function at 0x1003b3a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083eca
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100aa394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10004ec0
mov ecx, eax
test ecx, ecx
je 0x1003b564
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10004ec0
mov ecx, eax
test ecx, ecx
je 0x1003b56e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10004ec0
mov ecx, eax
test ecx, ecx
je 0x1003b578
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1003b482
xor ecx, ecx
jmp 0x1003b4a0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b490
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10006390
push edi
mov ecx, ebx
call fcn.1000d1e0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1003b4bc
xor ecx, ecx
jmp 0x1003b4d4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b4c4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10006390
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1003bdc0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1000d1e0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b515
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1003b54e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003b54e
cmp dword [esi + 0x10], 0
je 0x1003b545
push dword [edi]
call fcn.1006e051
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10004b70
push 0x80004005
call fcn.10004b70
push 0x80004005
call fcn.10004b70
int3
Function at 0x1003bbc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100aa394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003bd94
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003bc15
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1003bd94
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003bc33
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1003bd94
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003bc51
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1003bd94
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003bc6f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1003bd94
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003bd94
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1003bc94
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1003bcc7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1003bcdf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1003bd1d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10007600
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.1005b350
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x10090114
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1003c720
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003bd4b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1003bd84
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003bd84
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.1002ea38
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10003f10
lea ecx, [ebp - 0x28]
call fcn.10003f10
lea ecx, [ebp - 0x34]
call fcn.1000d080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003f57d
mov esp, ebp
pop ebp
ret 4
Function at 0x1003c2e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100840a7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100aa394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1003c32a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c336
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10007bd0
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x1003c3a3
push 0x48
call fcn.1003f1dc
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1003c397
push 0x48
push 0
push ebx
call fcn.1005be50
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.1003b3a0
jmp 0x1003c399
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c3d0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10007bd0
push 3
push 0x10090114
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1002eb53
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003c41f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1003c46e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003c46e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10007bd0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10003f10
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1003c4a4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003c49a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003c4e1
push edx
push ecx
call fcn.1003f20c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x1003c4c3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003f57d
mov esp, ebp
pop ebp
ret 0x14
call fcn.1005f339
int3