joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10045c94
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10017e00
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10045cb5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10045cb7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x10045d3f
jg 0x10045cca
test esi, esi
je 0x10045d3f
test ecx, ecx
jl 0x10045d0c
jg 0x10045cd4
test eax, eax
je 0x10045d0c
cmp ebx, ecx
jg 0x10045ce6
jl 0x10045cde
cmp esi, eax
jae 0x10045ce6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.100a3800
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10045d12
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x10045d3f
jg 0x10045d1c
test esi, esi
je 0x10045d3f
cmp dword [edi + 0x4c], 0
je 0x10045d3f
mov ecx, edi
call fcn.100450b0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.100ad05a
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10045d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10045d84
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10017ed0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10045da5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10045da7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10045e24
jg 0x10045dba
test esi, esi
je 0x10045e24
test ecx, ecx
jl 0x10045dfe
jg 0x10045dc4
test eax, eax
je 0x10045dfe
cmp edi, ecx
jg 0x10045dd6
jl 0x10045dce
cmp esi, eax
jae 0x10045dd6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.100a3800
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10045e01
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10045e24
jg 0x10045e0b
test esi, esi
je 0x10045e24
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10045e24
push eax
push esi
push 1
push edx
call fcn.100ad6ee
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100466a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2806
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1010f404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x10046796
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x100467a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
push 0
push 0x100da924
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], 0
call fcn.100045a0
push 0
push 0x100da924
lea ecx, [esi + 8]
call fcn.100045a0
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003fe0
push 0x80004005
call fcn.10003fe0
int3
Function at 0x100483d0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2b10
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x478], eax
test ebx, ebx
jne 0x1004841d
xor al, al
jmp 0x1004856e
test edi, edi
je 0x10048416
cmp dword [esi], 0
je 0x1004842d
mov al, 1
jmp 0x1004856e
push 0x250
lea eax, [ebp - 0x46c]
push 0
push eax
call fcn.100a3d80
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.100a3d80
add esp, 0x18
lea eax, [ebp - 0x21c]
push edi
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004858c
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x100485a7
jmp 0x100484a6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.100094e0
push edi
lea ecx, [esi + 8]
call fcn.100094e0
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x478]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x46c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x468]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x464]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x460]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x45c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x458]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x454]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x44c]
push edi
push ebx
mov dword [esi + 0x30], eax
mov dword [esi], 1
call fcn.10047060
mov ecx, eax
call fcn.100493c0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x10048416
push 0
push 0
push esi
push 0x100486a0
push 0
push 0
call fcn.100a7907
add esp, 0x18
mov dword [esi + 0x3c], eax
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret 0x10
push 0x10102d7c
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0xffffffff
push eax
call fcn.100a3eda
push 0x10102d7c
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0xfffffffe
push eax
call fcn.100a3eda
int3
Function at 0x1004f850
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x1004f87a
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1004f8a6
push 1
mov ecx, esi
call fcn.1004f620
pop esi
pop ebp
ret 8
cmp dword [esi + 0x2c], 0
push edi
je 0x1004f886
mov edi, dword [esi + 0x34]
jmp 0x1004f889
mov edi, dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1004f8a5
test edi, edi
je 0x1004f8a5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1004f8b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x1004f8e1
mov eax, dword [esi + 0x24]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1004f90d
push 1
lea ecx, [esi - 0x24]
call fcn.1004f620
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [esi + 8], 0
push edi
je 0x1004f8ed
mov edi, dword [esi + 0x10]
jmp 0x1004f8f0
mov edi, dword [esi + 0xc]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1004f90c
test edi, edi
je 0x1004f90c
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x10050500
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x26], bl
mov dword [ebp - 0x2c], ebx
jb 0x10050528
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x1005062d
push esi
mov esi, 1
cmp dword [ebp - 0x2c], esi
jle 0x10050625
nop dword [eax]
mov edx, dword [edi + esi*4]
test edx, edx
je 0x100505cd
xor eax, eax
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
mov eax, edx
mov dword [ebp - 0x10], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10050573
sub eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x24]
sar eax, 1
push eax
push edx
call fcn.10011730
push 0
push 0
push 0
push 0
xor eax, eax
lea ecx, [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0xc], eax
or ebx, 1
cmp dword [ebp - 0x10], 8
mov word [ebp - 8], ax
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push 3
push ecx
push eax
call fcn.100adce4
add esp, 0x24
test eax, eax
jne 0x100505cd
mov byte [ebp - 0x25], 1
cmp word [ebp - 0xc], ax
jne 0x100505d1
mov byte [ebp - 0x25], 0
test bl, 1
je 0x1005060f
mov edx, dword [ebp - 0x10]
and ebx, 0xfffffffe
cmp edx, 8
jb 0x1005060f
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10050605
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10050640
push edx
push ecx
call fcn.1007d115
add esp, 8
cmp byte [ebp - 0x25], 0
jne 0x10050621
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x10050550
jmp 0x10050625
mov byte [ebp - 0x26], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x26]
xor ecx, ebp
pop edi
pop ebx
call fcn.1007d494
mov esp, ebp
pop ebp
ret
call fcn.100a7ba5
int3
Function at 0x100531d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3cf2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x10053300
test eax, eax
je 0x10053300
test ebx, ebx
je 0x10053300
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100532ef
cmp dword [ebp - 0x818], eax
je 0x10053300
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.100a3d80
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100532ef
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100532d1
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10011730
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x10053300
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10055260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10115374
mov dword [ebp - 0x28], 0x6c005c
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x640075
mov dword [ebp - 0x20], 0x730061
mov edx, 0x13
mov dword [ebp - 0x1c], 0x690068
sub esi, eax
mov dword [ebp - 0x18], 0x6c005f
mov dword [ebp - 0x14], 0x67006f
mov dword [ebp - 0x10], 0x2e006f
mov dword [ebp - 0xc], 0x6e0070
mov dword [ebp - 8], 0x67
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x100552de
movzx ecx, word [esi + eax]
test cx, cx
je 0x100552de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100552c0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115374
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x1005d720
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d47da
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1010f404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x1005d8e4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x1005d8ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x1005d8f8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1005d802
xor ecx, ecx
jmp 0x1005d820
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005d810
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.100045a0
push edi
mov ecx, ebx
call fcn.10009470
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1005d83c
xor ecx, ecx
jmp 0x1005d854
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005d844
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.100045a0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1005e070
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10009470
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005d895
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1005d8ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005d8ce
cmp dword [esi + 0x10], 0
je 0x1005d8c5
push dword [edi]
call fcn.100b2416
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10003fe0
push 0x80004005
call fcn.10003fe0
push 0x80004005
call fcn.10003fe0
int3
Function at 0x1005de70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d48c8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005e044
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005dec5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1005e044
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005dee3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1005e044
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005df01
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1005e044
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005df1f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1005e044
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1005e044
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1005df44
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1005df77
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1005df8f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1005dfcd
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10011390
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100a3800
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100e66a4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1005edb0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005dffb
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1005e034
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1005e034
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10008310
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10008cf0
lea ecx, [ebp - 0x28]
call fcn.10008cf0
lea ecx, [ebp - 0x34]
call fcn.10009000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret 4
Function at 0x1005e970
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d4a67
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1005e9ba
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e9c6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10011730
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x1005ea33
push 0x48
call fcn.1007d4b8
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1005ea27
push 0x48
push 0
push ebx
call fcn.100a3d80
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.1005d720
jmp 0x1005ea29
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005ea60
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10011730
push 3
push 0x100e66a4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.100115b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005eaaf
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1005eafe
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1005eafe
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10011730
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10008cf0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1005eb34
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005eb2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005eb71
push edx
push ecx
call fcn.1007d115
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x1005eb53
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret 0x14
call fcn.100a7ba5
int3