joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cbf60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ff88
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5cac4c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push 0x1a
push eax
call fcn.004cd030
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x4cbfc7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cc045
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov ecx, esi
push 1
push eax
call fcn.004cd030
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x4cc00b
mov ecx, eax
call fcn.0043c6b0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4cc045
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4cc03b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4cc14d
push edx
push ecx
call fcn.004aa2ce
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x4cc070
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x57ba4c
mov word [edi], ax
call fcn.00412940
jmp 0x4cc126
call fcn.00414ac0
mov ecx, eax
test ecx, ecx
je 0x4cc152
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040e030
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00451560
mov edx, dword [ebp - 0x48]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4cc0d7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc0f2
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00412940
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4cc126
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.004109e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aa2b8
mov esp, ebp
pop ebp
ret 8
call fcn.00524d73
push 0x80004005
call fcn.0040ad60
int3
Function at 0x4cfd50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570682
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x5cac4c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x4cfe80
test eax, eax
je 0x4cfe80
test ebx, ebx
je 0x4cfe80
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cfe6f
cmp dword [ebp - 0x818], eax
je 0x4cfe80
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00507970
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4cfe6f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cfe51
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00412940
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x4cfe80
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aa2b8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4d0050
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x4d005f
pop ebp
jmp fcn.004d0070
xor al, al
pop ebp
ret 4
Function at 0x4d2470
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5709eb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5cac4c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00507970
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi]
push 0x104
push eax
push dword [edi]
mov eax, dword [ebp - 0x21c]
push dword [ebx]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00414ac0
mov ecx, eax
test ecx, ecx
je 0x4d256e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x220]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.0040e220
test al, al
jne 0x4d2550
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d2532
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040d860
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aa2b8
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040ad60
int3
Function at 0x4d3180
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5cac4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x4d32c9
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4d32c9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d32c9
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4d32c9
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push SysReAllocString
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x4d32b5
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4d32ae
cmp dword [ebp - 0x1c], ebx
jne 0x4d32ae
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x4d324d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x4d3247
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x4d3259
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0043c8a0
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.00489086
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x4d32ae
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4f00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57286a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5cac4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00414ac0
mov ecx, eax
test ecx, ecx
je 0x4e50c4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00414ac0
mov ecx, eax
test ecx, ecx
je 0x4e50ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00414ac0
mov ecx, eax
test ecx, ecx
je 0x4e50d8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x4e4fe2
xor ecx, ecx
jmp 0x4e5000
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e4ff0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040d860
push edi
mov ecx, ebx
call fcn.0041ce40
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4e501c
xor ecx, ecx
jmp 0x4e5034
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e5024
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.0040d860
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.004e5aa0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0041ce40
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4e5075
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4e50ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4e50ae
cmp dword [esi + 0x10], 0
je 0x4e50a5
push dword [edi]
call fcn.00544ae3
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.0040ad60
push 0x80004005
call fcn.0040ad60
push 0x80004005
call fcn.0040ad60
int3
Function at 0x4e58a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5729a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5cac4c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4e5a74
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e58f5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x4e5a74
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e5913
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x4e5a74
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e5931
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x4e5a74
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e594f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x4e5a74
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4e5a74
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4e5974
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x4e59a7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x4e59bf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x4e59fd
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.00422e20
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.00508100
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x59683c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004e6880
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e5a2b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x4e5a64
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4e5a64
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00410870
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.004109e0
lea ecx, [ebp - 0x28]
call fcn.004109e0
lea ecx, [ebp - 0x34]
call fcn.00456730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aa2b8
mov esp, ebp
pop ebp
ret 4
Function at 0x4e63e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572b47
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5cac4c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4e642a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e6436
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.00412940
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x4e64a3
push 0x48
call fcn.004aa859
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4e6497
push 0x48
push 0
push ebx
call fcn.00507970
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.004e4f00
jmp 0x4e6499
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e64d0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.00412940
push 3
push 0x59683c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00422ff0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e651f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x4e656e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4e656e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.00412940
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.004109e0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4e65a4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4e659a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e65e1
push edx
push ecx
call fcn.004aa2ce
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4e65c3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aa2b8
mov esp, ebp
pop ebp
ret 0x14
call fcn.00524d73
int3
Function at 0x4e6ca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572c78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5cac4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004aa859
mov edi, eax
add esp, 4
test edi, edi
je 0x4e6d43
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004888bd
add esp, 4
mov dword [edi + 4], eax
jmp 0x4e6d45
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00420570
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4e6da5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x4e6da5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x4e6dc9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4e6deb
cmp byte [ebp + 0xc], 0
je 0x4e6dd8
push esi
call fcn.004899b2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4e6df7
mov esi, str.ios_base::badbit_set
jmp 0x4e6e07
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.004237b0
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00420eb0
push 0x5adfc0
lea eax, [ebp - 0x30]
push eax
call fcn.00507c07
int3
Function at 0x4e966a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x54bafe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054b703

Function at 0x54bb09
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054b884

Function at 0x552a87
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00552261

Function at 0x552a92
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055249c

Function at 0x552f25
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00552cac
Function at 0x4014f3
Capabilities:
Get file size

Disassembly:
mov eax, 0x4973c0
call fcn.0047d43c
sub esp, 0x134
push ebx
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4015c9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 4
push ebx
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4015c2
push esi
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x4015b8
lea eax, [ebp + 0xb]
push 1
push eax
lea ecx, [ebp - 0x3c]
push dword [ebp + 0xc]
mov byte [ebp - 0x3d], bl
call fcn.00401884
push 0x103
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00401a14
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.0047d490
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.00401093
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x14]
push esi
call fcn.00401495
add esp, 0xc
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40168b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4016e8
push edi
push esi
push esi
push esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x4016e0
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
call fcn.004015ee
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4016ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.0047d58e
mov esi, eax
pop ecx
test esi, esi
je 0x40173c
xor edx, edx
test ebx, ebx
jbe 0x40173c
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
inc edx
cmp edx, ebx
mov byte [ecx], al
jb 0x401726
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret