joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x6c0075
mov dword [ebp - 0x34], 0x720074
mov dword [ebp - 0x30], 0x5c0061
mov dword [ebp - 0x2c], 0x70006f
mov dword [ebp - 0x28], 0x6e0065
mov dword [ebp - 0x24], 0x720070
mov dword [ebp - 0x20], 0x67006f
mov dword [ebp - 0x1c], 0x610072
mov dword [ebp - 0x18], 0x77006d
mov dword [ebp - 0x14], 0x64006e
mov dword [ebp - 0x10], 0x78002e
mov dword [ebp - 0xc], 0x6c006d
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x10037fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0xc
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x6c0063
mov dword [ebp - 0x1c], 0x73006f
mov dword [ebp - 0x18], 0x5f0065
mov dword [ebp - 0x14], 0x6c0063
mov dword [ebp - 0x10], 0x73006f
mov dword [ebp - 0xc], 0x640065
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x10038060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x13
mov ecx, esi
mov dword [ebp - 0x30], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x6c0075
mov dword [ebp - 0x28], 0x720074
mov dword [ebp - 0x24], 0x5c0061
mov dword [ebp - 0x20], 0x650064
mov dword [ebp - 0x1c], 0x6c006c
mov dword [ebp - 0x18], 0x6b006e
mov dword [ebp - 0x14], 0x6e0077
mov dword [ebp - 0x10], 0x2e0064
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4
Function at 0x10038100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x16
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x6c0075
mov dword [ebp - 0x30], 0x720074
mov dword [ebp - 0x2c], 0x5c0061
mov dword [ebp - 0x28], 0x750073
mov dword [ebp - 0x24], 0x650070
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x7a0069
mov dword [ebp - 0x18], 0x770065
mov dword [ebp - 0x14], 0x64006e
mov dword [ebp - 0x10], 0x78002e
mov dword [ebp - 0xc], 0x6c006d
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x100381a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x2b
mov ecx, esi
mov dword [ebp - 0x60], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x6f006d
mov dword [ebp - 0x58], 0x730075
mov dword [ebp - 0x54], 0x200065
mov dword [ebp - 0x50], 0x6f006e
mov dword [ebp - 0x4c], 0x200074
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x630020
mov dword [ebp - 0x40], 0x720074
mov dword [ebp - 0x3c], 0x2e006c
mov dword [ebp - 0x38], 0x690020
mov dword [ebp - 0x34], 0x73006e
mov dword [ebp - 0x30], 0x610074
mov dword [ebp - 0x2c], 0x6c006c
mov dword [ebp - 0x28], 0x6f0020
mov dword [ebp - 0x24], 0x200072
mov dword [ebp - 0x20], 0x61006c
mov dword [ebp - 0x1c], 0x75006e
mov dword [ebp - 0x18], 0x680063
mov dword [ebp - 0x14], 0x550020
mov dword [ebp - 0x10], 0x74006c
mov dword [ebp - 0xc], 0x610072
mov dword [ebp - 8], 0x2e
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x10038290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x12
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x740062
mov dword [ebp - 0x28], 0x5f006e
mov dword [ebp - 0x24], 0x6f006e
mov dword [ebp - 0x20], 0x6d005f
mov dword [ebp - 0x1c], 0x72006f
mov dword [ebp - 0x18], 0x5f0065
mov dword [ebp - 0x14], 0x650072
mov dword [ebp - 0x10], 0x69006d
mov dword [ebp - 0xc], 0x64006e
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4
Function at 0x10038320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x15
mov ecx, esi
mov dword [ebp - 0x34], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x6c0075
mov dword [ebp - 0x2c], 0x720074
mov dword [ebp - 0x28], 0x5c0061
mov dword [ebp - 0x24], 0x61006d
mov dword [ebp - 0x20], 0x77006c
mov dword [ebp - 0x1c], 0x64006e
mov dword [ebp - 0x18], 0x790074
mov dword [ebp - 0x14], 0x650070
mov dword [ebp - 0x10], 0x2e0031
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x100383c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x15
mov ecx, esi
mov dword [ebp - 0x34], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x6c0075
mov dword [ebp - 0x2c], 0x720074
mov dword [ebp - 0x28], 0x5c0061
mov dword [ebp - 0x24], 0x61006d
mov dword [ebp - 0x20], 0x77006c
mov dword [ebp - 0x1c], 0x64006e
mov dword [ebp - 0x18], 0x790074
mov dword [ebp - 0x14], 0x650070
mov dword [ebp - 0x10], 0x2e0032
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x10038460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor eax, eax
mov dword [ebp - 0x28], 0x6f005f
push edi
mov dword [ebp - 0x24], 0x650070
mov dword [ebp - 0x20], 0x5f006e
mov dword [ebp - 0x1c], 0x720070
mov dword [ebp - 0x18], 0x67006f
mov dword [ebp - 0x14], 0x610072
mov dword [ebp - 0x10], 0x66006d
mov dword [ebp - 0xc], 0x6c0069
mov dword [ebp - 8], 0x730065
mov word [ebp - 4], ax
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x10038507
mov eax, dword [ecx]
push 2
push 0x12
call dword [eax]
test eax, eax
je 0x10038511
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x12
jl 0x100384fd
mov dword [eax - 0xc], 0x12
xor eax, eax
mov ecx, dword [esi]
push 0x24
mov word [ecx + 0x24], ax
lea eax, [ebp - 0x28]
push eax
push 0x24
push dword [esi]
call fcn.1000a7b0
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100094b0
push 0x80004005
call fcn.100094b0
call fcn.1000a110
int3
Function at 0x10038640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov dword [ebp - 0x24], 0x64005f
push esi
mov dword [ebp - 0x20], 0x6c0065
mov dword [ebp - 0x1c], 0x740065
mov dword [ebp - 0x18], 0x5f0065
mov dword [ebp - 0x14], 0x6e006c
mov dword [ebp - 0x10], 0x5f006b
mov dword [ebp - 0xc], 0x690066
mov dword [ebp - 8], 0x65006c
mov word [ebp - 4], ax
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x100386de
mov eax, dword [ecx]
push 2
push 0x10
call dword [eax]
test eax, eax
je 0x100386e8
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x10
jl 0x100386d4
mov dword [eax - 0xc], 0x10
xor eax, eax
mov ecx, dword [esi]
push 0x20
mov word [ecx + 0x20], ax
lea eax, [ebp - 0x24]
push eax
push 0x20
push dword [esi]
call fcn.1000a7b0
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100094b0
push 0x80004005
call fcn.100094b0
call fcn.1000a110
int3

Function at 0x100386f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x15
mov ecx, esi
mov dword [ebp - 0x34], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x6c0075
mov dword [ebp - 0x2c], 0x720074
mov dword [ebp - 0x28], 0x5c0061
mov dword [ebp - 0x24], 0x61006d
mov dword [ebp - 0x20], 0x77006c
mov dword [ebp - 0x1c], 0x64006e
mov dword [ebp - 0x18], 0x790074
mov dword [ebp - 0x14], 0x650070
mov dword [ebp - 0x10], 0x2e0033
mov dword [ebp - 0xc], 0x6d0078
mov dword [ebp - 8], 0x6c
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x10038790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], 0x75005f
mov dword [ebp - 0x18], 0x69006e
mov dword [ebp - 0x14], 0x73006e
mov dword [ebp - 0x10], 0x5f0074
mov dword [ebp - 0xc], 0x610070
mov dword [ebp - 8], 0x65006e
mov dword [ebp - 4], 0x6c
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x10038821
mov eax, dword [ecx]
push 2
push 0xd
call dword [eax]
test eax, eax
je 0x1003882b
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x10038817
mov dword [eax - 0xc], 0xd
xor eax, eax
mov ecx, dword [esi]
push 0x1a
mov word [ecx + 0x1a], ax
lea eax, [ebp - 0x1c]
push eax
push 0x1a
push dword [esi]
call fcn.1000a7b0
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100094b0
push 0x80004005
call fcn.100094b0
call fcn.1000a110
int3
Function at 0x10038840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x17
mov ecx, esi
mov dword [ebp - 0x38], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x6c0075
mov dword [ebp - 0x30], 0x720074
mov dword [ebp - 0x2c], 0x5f0061
mov dword [ebp - 0x28], 0x690075
mov dword [ebp - 0x24], 0x6d005f
mov dword [ebp - 0x20], 0x690061
mov dword [ebp - 0x1c], 0x5f006e
mov dword [ebp - 0x18], 0x6e0077
mov dword [ebp - 0x14], 0x5f0064
mov dword [ebp - 0x10], 0x6c0063
mov dword [ebp - 0xc], 0x730061
mov dword [ebp - 8], 0x73
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x100388f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 8], ax
mov ecx, esi
push 0xa
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x6c0063
mov dword [ebp - 0x18], 0x73006f
mov dword [ebp - 0x14], 0x5f0065
mov dword [ebp - 0x10], 0x750061
mov dword [ebp - 0xc], 0x6f0074
call fcn.1000a620
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4

Function at 0x10038960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 0x28], 0x6c0075
mov dword [ebp - 0x24], 0x720074
mov dword [ebp - 0x20], 0x5c0061
mov dword [ebp - 0x1c], 0x6f006c
mov dword [ebp - 0x18], 0x6f0067
mov dword [ebp - 0x14], 0x6c005c
mov dword [ebp - 0x10], 0x67006f
mov dword [ebp - 0xc], 0x2e006f
mov dword [ebp - 8], 0x760073
mov dword [ebp - 4], 0x67
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x10038a06
mov eax, dword [ecx]
push 2
push 0x13
call dword [eax]
test eax, eax
je 0x10038a10
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x13
jl 0x100389fc
mov dword [eax - 0xc], 0x13
xor eax, eax
mov ecx, dword [esi]
push 0x26
mov word [ecx + 0x26], ax
lea eax, [ebp - 0x28]
push eax
push 0x26
push dword [esi]
call fcn.1000a7b0
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100094b0
push 0x80004005
call fcn.100094b0
call fcn.1000a110
int3
Function at 0x10038a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0x73005f
mov dword [ebp - 0x14], 0x700075
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x690073
mov dword [ebp - 8], 0x65007a
mov word [ebp - 4], ax
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x10038aa9
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x10038ab3
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x10038a9f
mov dword [eax - 0xc], 0xa
xor eax, eax
mov ecx, dword [esi]
push 0x14
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [esi]
call fcn.1000a7b0
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100094b0
push 0x80004005
call fcn.100094b0
call fcn.1000a110
int3

Function at 0x100395c0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push edi
mov edi, ecx
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x28], edi
movlpd qword [ebp - 0xc], xmm0
call esi
push 0
push 0
push dword [ebp - 8]
lea ebx, [edi + 0x30]
push dword [ebp - 0xc]
call fcn.10056140
add esp, 8
mov ecx, ebx
push eax
call fcn.10053330
push ebx
mov ecx, edi
call fcn.10047e70
mov ecx, edi
call fcn.10038ff0
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x14], xmm0
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1001c4c0
add esp, 8
mov ecx, ebx
call fcn.1004ea90
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x24]
push dword [ecx + 0x33c]
mov ecx, eax
call fcn.10056400
mov ecx, ebx
sub edi, eax
call fcn.1004ea90
mov ebx, dword [ebp - 0x28]
mov ecx, eax
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
push dword [ebx + 0x340]
call fcn.10056400
sub esi, eax
movzx eax, di
movzx ecx, si
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x479
mov ecx, ebx
call fcn.10056dc0
cmp dword [ebx + 0x318], 0
je 0x100396c8
push 0
push 0
push 0x47a
mov ecx, ebx
call fcn.10056dc0
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x6ddd00
push 0x7d4
push dword [ebx + 4]
call esi
push 0
push 0x7530
push 0x7d5
push dword [ebx + 4]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c416e
mov esp, ebp
pop ebp
ret
Function at 0x100416f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013409a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10180440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x100418b4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x100418be
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.100095a0
mov ecx, eax
test ecx, ecx
je 0x100418c8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x100417d2
xor ecx, ecx
jmp 0x100417f0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100417e0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10009e20
push edi
mov ecx, ebx
call fcn.1000d5d0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1004180c
xor ecx, ecx
jmp 0x10041824
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10041814
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10009e20
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10042190
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1000d5d0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041865
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1004189e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004189e
cmp dword [esi + 0x10], 0
je 0x10041895
push dword [edi]
call fcn.10118732
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100094b0
push 0x80004005
call fcn.100094b0
push 0x80004005
call fcn.100094b0
int3
Function at 0x10041f90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10134188
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10180440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10042164
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10041fe5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x10042164
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10042003
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x10042164
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10042021
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x10042164
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1004203f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x10042164
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10042164
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10042064
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x10042097
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x100420af
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x100420ed
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.1000a5b0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.10105710
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x10144174
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10042960
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004211b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x10042154
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10042154
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10030930
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10009070
lea ecx, [ebp - 0x28]
call fcn.10009070
lea ecx, [ebp - 0x34]
call fcn.10015dc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c416e
mov esp, ebp
pop ebp
ret 4