joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100905a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call fcn.1005de90
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov eax, dword [esi + 8]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.1005e220
test al, al
jne 0x1005e4af
lea ecx, [esp + 4]
call fcn.1005dee0
xor al, al
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov edx, dword [esp + 4]
push ebx
push esi
lea ecx, [esp + 0xc]
call dword [edx + 8]
lea ecx, [esp + 8]
mov bl, al
call fcn.1005dee0
mov ecx, dword [esp + 0x24]
mov al, bl
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10060dd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x10061a10
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100907eb
push eax
mov eax, dword [0x100ac4f4]
mov dword fs:[0], esp
sub esp, 0x54
test eax, eax
jne 0x10061ac5
push esi
push edi
mov ecx, 0x13
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x10]
push str.NabeLogFileManager_InitialMutex__d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100ac4f4]
test eax, eax
jne 0x10061ab0
push 0x30
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x64], 0
je 0x10061aa9
mov ecx, eax
call fcn.10061ae0
jmp 0x10061aab
xor eax, eax
mov dword [0x100ac4f4], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100ac4f4]
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x10061d50
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10090838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x10]
push eax
call fcn.100619c0
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x20], 0
test ebx, ebx
jne 0x10061dac
lea ecx, [esp + 0x10]
call fcn.10061a00
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
mov edi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.10062a00
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], eax
cmp eax, ecx
je 0x10061df0
mov eax, dword [eax + 0x10]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test eax, eax
jne 0x10061dd2
mov eax, edx
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x10061ddb
mov ecx, edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jl 0x10061df0
lea eax, [esp + 0x2c]
jmp 0x10061dfb
mov ecx, dword [esi + 4]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ecx
mov eax, dword [eax]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x10061e26
lea ecx, [esp + 0x10]
call fcn.10061a00
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
mov esi, dword [eax + 0x1c]
test esi, esi
jne 0x10061e4f
lea ecx, [esp + 0x10]
call fcn.10061a00
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10061e83
lea ecx, [esp + 0x10]
call fcn.10061a00
pop edi
pop esi
mov eax, 0xfffffffb
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
push ecx
push ebx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
lea ecx, [esp + 0x10]
jne 0x10061ecd
call fcn.10061a00
pop edi
pop esi
mov eax, 0xfffffffa
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
call fcn.10061a00
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x10062390
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x100908b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
lea eax, [esi + 0x10]
push eax
call fcn.100619c0
mov edi, dword [esp + 0x24]
mov ecx, esi
push edi
mov dword [esp + 0x20], 0
call fcn.10062a00
mov ecx, dword [esi + 4]
mov dword [esp + 0x24], eax
cmp eax, ecx
je 0x10062405
mov eax, dword [eax + 0x10]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
test eax, eax
jne 0x100623e7
mov eax, edx
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x100623f0
mov ecx, edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jl 0x10062405
lea eax, [esp + 0x24]
jmp 0x10062410
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
mov dword [esp + 8], ecx
mov eax, dword [eax]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x10062438
lea ecx, [esp + 0xc]
call fcn.10061a00
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x1006245e
lea ecx, [esp + 0xc]
call fcn.10061a00
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.10061a00
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x10063e00
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x110
push ebp
mov ebp, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], eax
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SOFTWARESky_ProductSKYSEAClientViewScvInst
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10063eab
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push str.SCVDIR
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10063eab
mov al, byte [esp + 0x10]
test al, al
je 0x10063eab
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x14]
push str.AppSet
push ecx
call esi
lea edx, [esp + 0x14]
push str.PerformTune.ini
push edx
call esi
lea eax, [esp + 0x14]
push eax
push 0
push str.CtlCliLog
push 0x100a9f94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp + 0x70], eax
pop esi
mov eax, dword [esp + 8]
pop edi
test eax, eax
pop ebp
je 0x10063ebc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x110
ret
Function at 0x100656c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x100ac518]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x10064a60
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x10065180
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x10064a10
je 0x1006571b
mov eax, dword [esp + 0x230]
and eax, 0xffff
mov eax, dword [eax*8 + 0x100aa014]
add esp, 0x22c
ret 4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x134]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10065864
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100657bc
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x10065834
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x10065864
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x10065834
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10065864
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x1006582b
inc ebx
add edi, 8
cmp ebx, 3
jl 0x1006583a
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x100aa014], edx
add eax, 8
cmp eax, 0x18
jl 0x10065852
mov eax, dword [esp + 0x240]
pop edi
and eax, 0xffff
pop esi
pop ebp
mov dword [0x100ac518], 1
mov eax, dword [eax*8 + 0x100aa014]
pop ebx
add esp, 0x22c
ret 4
Function at 0x10065d20
Capabilities:
Get hostname

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x10065d60
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
add esp, 0x104
ret
mov esi, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
push esi
push ecx
push 0
lea edx, [esp + 0x14]
push 0
push edx
call fcn.100653c0
add esp, 0x14
test eax, eax
jne 0x10065d8a
cmp dword [esi], 0
je 0x10065d8a
pop edi
pop esi
add esp, 0x104
ret
Function at 0x10065e70
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x100ac520]
sub esp, 0x22c
test eax, eax
jne 0x10066027
mov eax, dword [0x100ac518]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x10064a60
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x10065180
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x10064a10
je 0x10065ec6
mov eax, dword [0x100aa024]
jmp 0x10066022
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006600f
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10065f67
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x10065fdf
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1006600f
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x10065fdf
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1006600f
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x10065fd6
inc ebx
add edi, 8
cmp ebx, 3
jl 0x10065fe5
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x100aa014], edx
add eax, 8
cmp eax, 0x18
jl 0x10065ffd
mov eax, dword [0x100aa024]
pop edi
pop esi
pop ebp
mov dword [0x100ac518], 1
pop ebx
mov dword [0x100ac520], eax
mov ecx, dword [esp + 0x230]
push ecx
call eax
mov eax, 1
add esp, 0x22c
ret 4
Function at 0x10066400
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push 0xff
push esi
push 0
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
jne 0x100664d8
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
push 1
push eax
push eax
lea ecx, [esp + 0x20]
push eax
push ecx
call ebp
test eax, eax
je 0x10066489
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call ebp
test eax, eax
jne 0x10066460
mov edi, dword [esp + 0x3c]
cmp edi, 0xffffffff
je 0x100664af
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jae 0x100664a5
sub eax, ecx
dec eax
jmp 0x100664a7
sub eax, ecx
cmp eax, edi
ja 0x100664d3
mov esi, edi
sub esi, eax
mov edx, dword [esp + 0x38]
push 0xff
push esi
push 0
push edx
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
je 0x1006643b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov eax, 0x102
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10067dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, ecx
call edi
mov ecx, ebx
mov dword [esp + 0x10], eax
mov ebp, eax
call fcn.10067e50
test al, al
jne 0x10067e32
mov esi, dword [esp + 0x18]
call edi
cmp esi, 0xffffffff
je 0x10067e07
mov edx, dword [esp + 0x10]
mov ecx, eax
sub ecx, edx
cmp esi, ecx
jb 0x10067e3c
sub eax, ebp
cmp eax, 0x1388
jbe 0x10067e1f
mov ecx, ebx
call fcn.10067ed0
test al, al
jne 0x10067e32
call edi
mov ebp, eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.10067e50
test al, al
je 0x10067df4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 4
Function at 0x1006b6a0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x258
push ebp
push edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.NabelogMulti_SysLogPath__d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, eax
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0x264]
push edx
call fcn.1006ab70
mov ecx, eax
add ecx, 0x20
call fcn.1006bae0
mov ecx, eax
call fcn.1003a6e0
test eax, eax
je 0x1006b845
mov ecx, dword [esp + 0x264]
push ebx
lea eax, [esp + 0x5c]
push esi
push eax
push ecx
call fcn.1006b860
add esp, 8
lea edx, [esp + 0x164]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea eax, [esp + 0x164]
push 0x5c
push eax
call ebx
add esp, 8
lea edi, [eax + 1]
test eax, eax
jne 0x1006b766
lea edi, [esp + 0x164]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x60]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x60]
and ecx, 3
push 0x2e
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov edx, eax
add esp, 8
test edx, edx
je 0x1006b7c1
mov edi, dword [str._sys.log]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x1006b7eb
mov edi, dword [str._sys.log]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
lea eax, [esp + 0x60]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x26c]
push eax
push ecx
call fcn.1006ab70
mov ecx, eax
add ecx, 0x20
call fcn.1006bae0
mov ecx, eax
call fcn.1003a610
lea edx, [esp + 0x60]
push edx
call fcn.1006ba00
add esp, 4
lea eax, [esp + 0x60]
lea ecx, [esp + 0x26c]
push eax
push ecx
call fcn.1006ab70
mov ecx, eax
add ecx, 0x30
call fcn.1006bae0
mov ecx, eax
call fcn.1003a610
pop esi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
add esp, 0x258
ret
Function at 0x1006fed0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100914ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov al, byte [esp + 0x6c]
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esp + 0xa]
lea edx, [esp + 0xb]
push ecx
push 0
push edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x78], 0
call fcn.10070310
mov edi, dword [esp + 0x74]
push 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x70], 1
mov al, byte [edi]
mov byte [esp + 0x38], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ecx]
lea ecx, [esp + 0x34]
push edx
push 0
push edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x44]
push eax
mov byte [esp + 0x70], 2
call fcn.1006f900
lea ecx, [esp + 0x34]
lea edx, [esp + 0xc]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x74], 3
call fcn.10071060
lea eax, [esp + 0x44]
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x6c], 5
call fcn.1006fde0
push 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x70], 4
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push 1
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
lea ecx, [esp + 0x24]
mov dword [esp + 0x6c], 6
call fcn.1006fde0
mov eax, dword [esp + 0x18]
pop edi
test eax, eax
pop esi
je 0x10070018
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x1006fff7
cmp al, 0xff
je 0x1006fff7
dec al
mov byte [ecx], al
mov ecx, dword [esp + 4]
lea eax, [ecx + 0x1c]
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 4
push ecx
call fcn.10088e50
mov edx, dword [esp + 8]
add esp, 4
lea eax, [edx + 0x1c]
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 4
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x5c]
add eax, 0x1c
mov dword fs:[0], ecx
add esp, 0x68
ret 4
Function at 0x100744b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10091860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, ecx
push ebx
xor ebx, ebx
push esi
mov cl, byte [eax + 0x18]
mov dword [esp + 0xc], eax
cmp cl, bl
mov dword [esp + 0x10], ebx
je 0x100745bc
push ebp
mov ebp, dword [eax + 0xc]
push edi
mov edi, dword [eax + 0x10]
cmp ebp, edi
je 0x100745b7
mov esi, edi
mov dword [esp + 0x18], ebx
sub esi, ebp
sar esi, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x10], eax
jle 0x10074532
mov ecx, dword [sym.imp.MSVCP60.dll_struct_std::nothrow_t_const_std::nothrow]
shl eax, 4
push ecx
push eax
call fcn.10088e92
add esp, 8
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x10074532
mov eax, dword [esp + 0x10]
cdq
sub eax, edx
sar eax, 1
cmp eax, ebx
mov dword [esp + 0x10], eax
jg 0x10074506
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.10077ba0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x24]
push eax
push ecx
push esi
push edi
push ebp
mov dword [esp + 0x54], ebx
call fcn.10055180
mov esi, dword [esp + 0x38]
add esp, 0x14
cmp esi, ebx
mov dword [esp + 0x40], 0xffffffff
je 0x100745b3
cmp esi, dword [esp + 0x2c]
je 0x100745aa
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx]
mov eax, dword [esp + 0x2c]
add esi, 0x10
cmp esi, eax
jne 0x10074594
mov esi, dword [esp + 0x24]
push esi
call fcn.10088e50
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
mov byte [eax + 0x18], bl
pop ebp
mov esi, dword [esp + 0x40]
mov dl, byte [esp + 0x40]
lea ecx, [esi + 4]
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov byte [esi + 0x14], bl
add eax, 8
mov dword [esi + 0x18], 0x10093a38
mov dword [esi + 0x1c], 0x10093a34
push eax
mov dword [esp + 0x3c], 1
mov dword [esi], 0x10094540
mov dword [esi + 0x18], 0x1009453c
mov dword [esi + 0x1c], 0x10094538
call fcn.10075aa0
mov eax, dword [esp + 0xc]
mov cl, byte [eax + 0x18]
mov eax, esi
mov byte [esi + 0x14], cl
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4