joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f5c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
xor eax, eax
jne 0x1002f5c9
cmp dword [ebp + 0xc], 0
je 0x1002f5dc
mov dword [ebp - 0x18], 1
jmp 0x1002f5e3
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x1002f5f9
mov eax, 0xd
jmp 0x1002f67c
xor edx, edx
jne 0x1002f5cd
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov cx, word [eax]
mov word [ebp - 2], cx
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x1002f619
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x20]
sar edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*2]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 1
jne 0x1002f60a
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 7
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002f690
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
xor eax, eax
jne 0x1002f699
cmp dword [ebp + 0xc], 0
je 0x1002f6ac
mov dword [ebp - 0xc], 1
jmp 0x1002f6b3
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x1002f6c6
mov eax, 0xd
jmp 0x1002f71b
xor edx, edx
jne 0x1002f69d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x1002f6d9
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002f830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095a41
mov eax, dword fs:[0]
push eax
sub esp, 0x2ec
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], ecx
mov eax, dword [ebp - 0x24c]
cmp dword [eax], 0
je 0x1002f873
xor eax, eax
jmp 0x1002fa3f
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.1006c6b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [0x100c5894]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Logmisc.log
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
push ecx
call fcn.1003ee30
push 1
call fcn.100595b0
add esp, 4
push 1
call fcn.10013850
mov ecx, eax
call fcn.10021100
call fcn.1003eb30
mov dword [ebp - 0x250], eax
push 1
mov edx, dword [ebp - 0x250]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x258], al
cmp byte [ebp - 0x258], 1
je 0x1002f925
jmp 0x1002f9e0
push 0x100a0450
lea ecx, [ebp - 0x248]
call fcn.10004260
mov dword [ebp - 4], 0
push 0x100a044c
lea ecx, [ebp - 0x230]
call fcn.10004260
mov byte [ebp - 4], 1
call fcn.1003eb30
mov dword [ebp - 0x254], eax
push str.Start_Work
push 0x1d
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.10004a60
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x260], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x260]
call fcn.10002a60
push eax
mov eax, dword [ebp - 0x254]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x254]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2f8]
call fcn.10005a70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10005680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10005680
push 0
push 0x100a04b0
push 1
call fcn.100078e0
mov ecx, eax
call fcn.1005c2a0
mov ecx, dword [ebp - 0x24c]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 0x24c]
push edx
push 0x1002fe00
push 0
push 0
call fcn.10073545
add esp, 0x18
mov ecx, dword [ebp - 0x24c]
mov dword [ecx], eax
push 0
push 0
push 1
push 0
push 0x100a04bc
call fcn.100078e0
mov ecx, eax
call fcn.1005c2c0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret
Function at 0x100328b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100328c8
mov eax, 1
jmp 0x1003290e
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x10032d40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x10032904
mov dword [ebp - 8], 1
jmp 0x1003290b
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10032f50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x244]
call fcn.1000f0b0
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
je 0x10033037
push 0x22c
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.1006c6b0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1003302a
mov dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp + 0xc]
jne 0x10033013
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x244]
call fcn.10005e60
jmp 0x1003302a
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x240]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10032ff4
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x244]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000f0d0
mov eax, dword [ebp - 0x248]
or eax, 1
mov dword [ebp - 0x248], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.100054b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret
Function at 0x100367b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
call fcn.10009ee0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
jne 0x100367de
jmp 0x10036828
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100367fe
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 1
jmp 0x10036828
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
call fcn.1002b0d0
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
jne 0x100367d6
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10036f10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 0
lea edx, [ebp - 0x24]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
call fcn.10006150
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10036f82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10036f82
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10036f84
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10037330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x1003734f
cmp dword [ebp + 0xc], 0
jne 0x10037356
xor eax, eax
jmp 0x10037487
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10037485
mov dword [ebp - 0x4c0], 0
jmp 0x1003738b
mov ecx, dword [ebp - 0x4c0]
add ecx, 4
mov dword [ebp - 0x4c0], ecx
mov edx, dword [ebp - 0x4c0]
movzx eax, word [ebp + edx*2 - 0x4bc]
test eax, eax
je 0x10037485
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp - 0x4c0]
mov cx, word [ebp + eax*2 - 0x4bc]
mov word [ebp + edx - 0xc], cx
mov edx, 2
shl edx, 0
mov eax, dword [ebp - 0x4c0]
mov cx, word [ebp + eax*2 - 0x4ba]
mov word [ebp + edx - 0xc], cx
mov edx, 2
shl edx, 1
mov dword [ebp - 0x4c4], edx
cmp dword [ebp - 0x4c4], 6
jae 0x100373ef
jmp 0x100373f4
call fcn.1005e1ae
xor eax, eax
mov ecx, dword [ebp - 0x4c4]
mov word [ebp + ecx - 0xc], ax
push 0x64
lea edx, [ebp - 0xd4]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1003741d
jmp 0x1003737c
lea ecx, [ebp - 0xd4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x4c8], eax
mov edx, dword [ebp - 0x4c8]
push edx
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100739d5
add esp, 0xc
test eax, eax
jne 0x10037480
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10025600
mov edx, dword [ebp - 0x4c8]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*2]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10038ed0
mov eax, 1
jmp 0x10037487
jmp 0x1003737c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret

Function at 0x100375e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10037662
mov dword [ebp - 0x14], 1
mov ecx, 0xc
imul edx, ecx, 0
lea eax, [ebp + edx - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 8], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret
Function at 0x10037a70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
push 0x100a20f0
mov ecx, dword [ebp + 8]
call fcn.10006150
push eax
call fcn.10073934
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10037b48
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.10074a31
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10074fa3
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.10074a31
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.1005e04c
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.10074646
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jne 0x10037b1d
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov dword [ebp - 0xc], 1
jmp 0x10037b3c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
push 1
mov eax, dword [ebp - 0x18]
push eax
call fcn.1005dc64
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
push edx
call fcn.100743fa
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10038200
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100962c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp + 8]
call fcn.10009ee0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10038247
jmp 0x100382d6
mov ecx, dword [ebp + 0xc]
call fcn.1000a340
movzx eax, al
test eax, eax
je 0x10038258
jmp 0x100382d6
push 0x42
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.1006c6b0
add esp, 0xc
push 0x21
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp + 8]
call fcn.10009ee0
push eax
call fcn.1003fab0
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x58]
call fcn.10003d50
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.10009ee0
push eax
lea ecx, [ebp - 0x58]
call fcn.1001b6d0
test eax, eax
je 0x100382b8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.100054b0
jmp 0x100382d6
mov dword [ebp - 0x5c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.100054b0
xor ecx, ecx
jne 0x1003822f
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret
Function at 0x10038300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
push 0x100a20e8
mov ecx, dword [ebp + 8]
call fcn.10009ee0
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1007394b
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1003833b
call fcn.1006e972
mov eax, dword [eax]
neg eax
jmp 0x100384b2
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10074a31
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call fcn.10074fa3
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.10074a31
add esp, 0xc
cmp dword [ebp - 0x10], 0
jne 0x10038383
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100743fa
add esp, 4
xor eax, eax
jmp 0x100384b2
mov dword [ebp - 0x14], 0
mov byte [ebp - 1], 0
cmp dword [ebp - 0x10], 3
jl 0x10038425
xor edx, edx
mov word [ebp - 8], dx
mov byte [ebp - 6], dl
mov eax, dword [ebp - 0xc]
push eax
push 1
push 3
lea ecx, [ebp - 8]
push ecx
call fcn.10074646
add esp, 0x10
cmp eax, 1
je 0x100383d4
mov edx, dword [ebp - 0xc]
push edx
call fcn.100743fa
add esp, 4
call fcn.1006e972
mov eax, dword [eax]
neg eax
jmp 0x100384b2
mov eax, 1
imul ecx, eax, 0
movzx edx, byte [ebp + ecx - 8]
cmp edx, 0xef
jne 0x10038425
mov eax, 1
shl eax, 0
movzx ecx, byte [ebp + eax - 8]
cmp ecx, 0xbb
jne 0x10038425
mov edx, 1
shl edx, 1
movzx eax, byte [ebp + edx - 8]
cmp eax, 0xbf
jne 0x10038425
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 3
mov ecx, dword [ebp - 0x10]
sub ecx, 3
mov dword [ebp - 0x10], ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10074a31
add esp, 0xc
push 0
mov ecx, dword [ebp + 0xc]
call fcn.1000ba00
mov ecx, dword [ebp - 0x10]
lea edx, [eax + ecx + 1]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10019de0
mov ecx, dword [ebp + 0xc]
call fcn.10009ce0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10074646
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.100743fa
add esp, 4
mov dword [ebp - 0xc], 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.1000ba00
sub eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10019de0
cmp dword [ebp - 0x1c], 1
je 0x100384af
call fcn.1006e972
mov eax, dword [eax]
neg eax
jmp 0x100384b2
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10039200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x100a20d0
mov ecx, dword [ebp + 8]
call fcn.10009ee0
push eax
lea eax, [ebp - 4]
push eax
call fcn.1007394b
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x10039236
call fcn.1006e972
mov eax, dword [eax]
neg eax
jmp 0x1003926a
mov ecx, dword [ebp - 4]
push ecx
push 1
mov ecx, dword [ebp + 0xc]
call fcn.1000ba00
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10009ce0
push eax
call fcn.100751e6
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.100743fa
add esp, 4
mov ecx, dword [ebp + 0xc]
call fcn.1000ba00
mov esp, ebp
pop ebp
ret
Function at 0x1003ded0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100966fa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100c3384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10007990
mov ecx, eax
test ecx, ecx
je 0x1003e094
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10007990
mov ecx, eax
test ecx, ecx
je 0x1003e09e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10007990
mov ecx, eax
test ecx, ecx
je 0x1003e0a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1003dfb2
xor ecx, ecx
jmp 0x1003dfd0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003dfc0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10008220
push edi
mov ecx, ebx
call fcn.1000fef0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1003dfec
xor ecx, ecx
jmp 0x1003e004
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003dff4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10008220
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1003e8b0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1000fef0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003e045
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1003e07e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003e07e
cmp dword [esi + 0x10], 0
je 0x1003e075
push dword [edi]
call fcn.10079b56
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10006ca0
push 0x80004005
call fcn.10006ca0
push 0x80004005
call fcn.10006ca0
int3
Function at 0x1003e6b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100967e8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003e884
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e705
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1003e884
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e723
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1003e884
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e741
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1003e884
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e75f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1003e884
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1003e884
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1003e784
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1003e7b7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1003e7cf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1003e80d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.100098c0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.1006bbb0
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100a575c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10022650
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003e83b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1003e874
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1003e874
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.1000f360
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.100056d0
lea ecx, [ebp - 0x28]
call fcn.100056d0
lea ecx, [ebp - 0x34]
call fcn.10005a00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret 4