joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e6d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be6c0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x40]
push eax
call fcn.1002e610
add esp, 4
mov dword [ebp - 4], 0
mov ecx, eax
push 1
push 0x100cf0d0
call fcn.10012240
mov ecx, str.cache_scr.xua
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1002e723
sub ecx, esi
sar ecx, 1
push ecx
push str.cache_scr.xua
mov ecx, eax
call fcn.10012240
push eax
lea ecx, [ebp - 0x28]
call fcn.10003f90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.10005430
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret
Function at 0x100304d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bebc2
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x228], esi
push 0
mov dword [ebp - 0x224], 0
push eax
mov dword [ebp - 0x220], 1
call fcn.10087da0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], 1
push eax
lea eax, [ebp - 0x220]
push eax
push 0x100cf200
push 0x100cf210
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100305b5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030597
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10012240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret
Function at 0x100329f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10032a9f
cmp byte [esi + 0x3e], 0
je 0x10032a9f
mov eax, dword [esi]
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x10032a55
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10032a67
sub eax, 1
je 0x10032a6b
sub eax, 2
je 0x10032a9f
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10032a88
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10092fcd
add esp, 0x10
cmp edi, eax
jne 0x10032a55
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1004f51c
mov esp, ebp
pop ebp
ret
Function at 0x10037200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x10037235
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x10037273
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x10037273
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10037351
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x1003729d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100372d6
push dword [esi + 0x4c]
push edi
call fcn.1009203a
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x10037356
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x10037351
cmp eax, 1
jle 0x10037324
cmp eax, 3
jne 0x10037351
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1002ac20
add esp, 8
test al, al
movzx eax, di
jne 0x10037356
jmp 0x10037351
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x10037341
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.10092fcd
add esp, 0x10
cmp ebx, eax
jne 0x10037351
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x1003725d
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 4
Function at 0x1003c3a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0483
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x144]
mov dword [ebp - 0x164], esi
push eax
mov dword [ebp - 0x160], 0
call fcn.1003bd60
mov dword [ebp - 4], 1
cmp dword [ebp - 0x134], 0
je 0x1003c44a
movups xmm0, xmmword [ebp - 0x144]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov byte [ebp - 0x144], 0
movq xmm0, qword [ebp - 0x134]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x160], 1
jmp 0x1003c572
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.10087da0
add esp, 0xc
lea eax, [ebp - 0x114]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
lea edx, [eax + 1]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c4b0
sub eax, edx
lea ecx, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.10008e70
mov byte [ebp - 4], 2
lea eax, [ebp - 0x15c]
push str._tskp_workspacecache_
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.1003a000
add esp, 0xc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
movups xmm0, xmmword [ebp - 0x12c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov byte [ebp - 0x12c], 0
movq xmm0, qword [ebp - 0x11c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x160], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12c]
call fcn.100053b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x15c]
call fcn.100053b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.100053b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 4
Function at 0x100405c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbc76
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push esi
push edi
mov eax, dword [0x100fe39c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 8], 0xf120
je 0x1004060f
mov dword [edi + 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.1004e090
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x100406ea
push 0x58
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], eax
push 0x100d27c8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.10008e70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push 3
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x100d2824
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.10008e70
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3c]
push 0x3ac
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xd4]
call fcn.10004210
mov esi, eax
mov byte [ebp - 4], 2
push str.TaskBarWndImpl::OnWndSysCommand____SC_RESTORE.
push esi
call fcn.10006300
add esp, 8
call fcn.1004e090
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd4]
call fcn.100067d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.100053b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100053b0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10040709
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [edi + 0x228], 0
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call esi
push 5
push dword [edi + 4]
call esi
push 2
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x74]
test ecx, ecx
je 0x1004073d
mov eax, dword [ecx]
push 2
push dword [edi + 4]
push ecx
call dword [eax + 0x28]
mov ecx, edi
call fcn.1003eb50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10042a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c11aa
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push esi
push edi
mov eax, dword [0x100fe39c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x40], edi
mov dword [edi], vtable.LdsJsBasic::WebWindowListener.0
mov dword [ebp - 4], 0
lea edx, [edi + 4]
mov dword [ebp - 0x44], edx
lea eax, [edx + 8]
mov dword [edx + 4], 0
mov dword [ebp - 0x48], eax
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 2
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov byte [ebp - 4], 3
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edx + 0x20], eax
mov byte [ebp - 4], 5
lea ecx, [edi + 0x34]
mov dword [edi], vtable.TaskBarCefWindow.0
mov dword [edx], vtable.TaskBarCefWindow.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100386d0
mov byte [ebp - 4], 6
mov byte [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov byte [edi + 0x54], 0
call fcn.1004e090
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x10042bbf
push 0x5a
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], eax
push 0x100d37f8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.10008e70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
push 3
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x100d3854
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.10008e70
mov byte [ebp - 4], 8
lea eax, [ebp - 0x3c]
push 0xd
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xe0]
call fcn.10004210
mov esi, eax
mov byte [ebp - 4], 9
push str.TaskBarCefWindow::TaskBarCefWindow____webview_Create.
push esi
call fcn.10006300
add esp, 8
call fcn.1004e090
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe0]
call fcn.100067d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.100053b0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.100053b0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004c5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1d81
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.1000b000
mov ecx, eax
test ecx, ecx
je 0x1004c754
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004c715
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004c707
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1004c715
add eax, 0x10
push 0x10103c66
push eax
mov dword [ebp - 0x20], eax
call fcn.1004f76d
mov esi, eax
add esp, 8
test esi, esi
je 0x1004c715
push dword [ebp - 0x20]
push 0
push esi
call fcn.10087da0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004c6ca
push esi
call fcn.1004f56d
add esp, 4
jmp 0x1004c715
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004c6d0
sub ecx, edx
sar ecx, 1
je 0x1004c6fe
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004c6e6
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.1000bca0
push esi
call fcn.1004f56d
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1004c715
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004c734
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.1000ae20
int3
Function at 0x1004c760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1004c784
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x1004c7e6
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x1004c7e6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1004c801
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004d1f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1eaa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100fe39c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.1000b000
mov ecx, eax
test ecx, ecx
je 0x1004d3b4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.1000b000
mov ecx, eax
test ecx, ecx
je 0x1004d3be
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.1000b000
mov ecx, eax
test ecx, ecx
je 0x1004d3c8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1004d2d2
xor ecx, ecx
jmp 0x1004d2f0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004d2e0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.1000bca0
push edi
mov ecx, ebx
call fcn.1004d400
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1004d30c
xor ecx, ecx
jmp 0x1004d324
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004d314
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.1000bca0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1004dd60
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1004d400
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004d365
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1004d39e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004d39e
cmp dword [esi + 0x10], 0
je 0x1004d395
push dword [edi]
call fcn.1009578f
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.1000ae20
push 0x80004005
call fcn.1000ae20
push 0x80004005
call fcn.1000ae20
int3
Function at 0x1004dae0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1f98
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100fe39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1004dcb4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004db35
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1004dcb4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004db53
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1004dcb4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004db71
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1004dcb4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004db8f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1004dcb4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004dcb4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1004dbb4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1004dbe7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1004dbff
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1004dc3d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10008ad0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100872a0
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100d814c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1004e840
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004dc6b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1004dca4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1004dca4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.1003a4c0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10005430
lea ecx, [ebp - 0x28]
call fcn.10005430
lea ecx, [ebp - 0x34]
call fcn.10005ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f51c
mov esp, ebp
pop ebp
ret 4