joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e19b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x46005f
mov dword [ebp - 0x58], 0x410044
mov dword [ebp - 0x54], 0x450038
mov dword [ebp - 0x50], 0x330046
mov dword [ebp - 0x4c], 0x2d0032
mov dword [ebp - 0x48], 0x410045
mov dword [ebp - 0x44], 0x420031
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x330032
mov dword [ebp - 0x38], 0x2d0045
mov dword [ebp - 0x34], 0x320042
mov dword [ebp - 0x30], 0x460037
mov dword [ebp - 0x2c], 0x38002d
mov dword [ebp - 0x28], 0x420046
mov dword [ebp - 0x24], 0x350034
mov dword [ebp - 0x20], 0x450043
mov dword [ebp - 0x1c], 0x360037
mov dword [ebp - 0x18], 0x350037
mov dword [ebp - 0x14], 0x44
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44806e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x44804e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448030
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x448150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e208
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x690044
mov dword [ebp - 0x48], 0x610064
mov dword [ebp - 0x44], 0x6f0043
mov dword [ebp - 0x40], 0x66006e
mov dword [ebp - 0x3c], 0x670069
mov dword [ebp - 0x38], 0x650043
mov dword [ebp - 0x34], 0x74006e
mov dword [ebp - 0x30], 0x720065
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov word [ebp - 0x14], ax
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44825b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x44823b
lea ecx, [ebp - 0x4c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448220
sub ecx, edx
lea eax, [ebp - 0x4c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3

Function at 0x448340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e268
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x720054
mov dword [ebp - 0x30], 0x630061
mov dword [ebp - 0x2c], 0x6c0065
mov dword [ebp - 0x28], 0x730065
mov dword [ebp - 0x24], 0x630073
mov dword [ebp - 0x20], 0x610068
mov dword [ebp - 0x1c], 0x2e0074
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44841a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x4483fb
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4483e0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x448430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e298
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0x4f0053
mov dword [ebp - 0x3c], 0x540046
mov dword [ebp - 0x38], 0x410057
mov dword [ebp - 0x34], 0x450052
mov dword [ebp - 0x30], 0x54005c
mov dword [ebp - 0x2c], 0x610072
mov dword [ebp - 0x28], 0x650063
mov dword [ebp - 0x24], 0x65006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x680063
mov dword [ebp - 0x18], 0x740061
mov word [ebp - 0x14], ax
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44851e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x4484ff
lea ecx, [ebp - 0x40]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4484e4
sub ecx, edx
lea eax, [ebp - 0x40]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x448530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e2cb
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], 0x740068
mov dword [ebp - 0x88], 0x700074
mov dword [ebp - 0x84], 0x2f003a
mov dword [ebp - 0x80], 0x69002f
mov dword [ebp - 0x7c], 0x74006e
mov dword [ebp - 0x78], 0x2d0066
mov dword [ebp - 0x74], 0x630070
mov dword [ebp - 0x70], 0x62002e
mov dword [ebp - 0x6c], 0x75006c
mov dword [ebp - 0x68], 0x770065
mov dword [ebp - 0x64], 0x610068
mov dword [ebp - 0x60], 0x65006c
mov dword [ebp - 0x5c], 0x680063
mov dword [ebp - 0x58], 0x740061
mov dword [ebp - 0x54], 0x63002e
mov dword [ebp - 0x50], 0x6d006f
mov dword [ebp - 0x4c], 0x63002f
mov dword [ebp - 0x48], 0x670066
mov dword [ebp - 0x44], 0x74002f
mov dword [ebp - 0x40], 0x610072
mov dword [ebp - 0x3c], 0x650063
mov dword [ebp - 0x38], 0x65006c
mov dword [ebp - 0x34], 0x730073
mov dword [ebp - 0x30], 0x680063
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x64005f
mov dword [ebp - 0x24], 0x740065
mov dword [ebp - 0x20], 0x690061
mov dword [ebp - 0x1c], 0x2e006c
mov dword [ebp - 0x18], 0x680070
mov dword [ebp - 0x14], 0x70
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x4486be
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x44869e
lea ecx, [ebp - 0x8c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448680
sub ecx, edx
lea eax, [ebp - 0x8c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x4486d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e308
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], 0x4f0053
mov dword [ebp - 0x40], 0x540046
mov dword [ebp - 0x3c], 0x410057
mov dword [ebp - 0x38], 0x450052
mov dword [ebp - 0x34], 0x43005c
mov dword [ebp - 0x30], 0x610068
mov dword [ebp - 0x2c], 0x67006e
mov dword [ebp - 0x28], 0x570065
mov dword [ebp - 0x24], 0x6c0061
mov dword [ebp - 0x20], 0x50006c
mov dword [ebp - 0x1c], 0x700061
mov dword [ebp - 0x18], 0x720065
mov word [ebp - 0x14], ax
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x4487ca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x4487ab
lea ecx, [ebp - 0x44]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448790
sub ecx, edx
lea eax, [ebp - 0x44]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3

Function at 0x4487e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e338
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], 0x690044
mov dword [ebp - 0x5c], 0x610064
mov dword [ebp - 0x58], 0x6f0043
mov dword [ebp - 0x54], 0x66006e
mov dword [ebp - 0x50], 0x670069
mov dword [ebp - 0x4c], 0x650043
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x720065
mov dword [ebp - 0x40], 0x740053
mov dword [ebp - 0x3c], 0x620075
mov dword [ebp - 0x38], 0x720050
mov dword [ebp - 0x34], 0x660065
mov dword [ebp - 0x30], 0x780069
mov dword [ebp - 0x2c], 0x6e0057
mov dword [ebp - 0x28], 0x430064
mov dword [ebp - 0x24], 0x61006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x61004e
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x5f
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44890b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x4488eb
lea ecx, [ebp - 0x60]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4488d0
sub ecx, edx
lea eax, [ebp - 0x60]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x448d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x6f0044
mov dword [ebp - 0x4c], 0x70006c
mov dword [ebp - 0x48], 0x690068
mov dword [ebp - 0x44], 0x43006e
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x448e0d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x448ded
lea ecx, [ebp - 0x50]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448dd2
sub ecx, edx
lea eax, [ebp - 0x50]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3

Function at 0x448e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e408
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x790053
mov dword [ebp - 0x2c], 0x430073
mov dword [ebp - 0x28], 0x65006c
mov dword [ebp - 0x24], 0x6e0061
mov dword [ebp - 0x20], 0x720065
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x448ef0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x448ed2
lea ecx, [ebp - 0x30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448eb7
sub ecx, edx
lea eax, [ebp - 0x30]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x448f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e438
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x4f0053
mov dword [ebp - 0x30], 0x540046
mov dword [ebp - 0x2c], 0x410057
mov dword [ebp - 0x28], 0x450052
mov dword [ebp - 0x24], 0x50005c
mov dword [ebp - 0x20], 0x4d0043
mov dword [ebp - 0x1c], 0x6e0061
mov dword [ebp - 0x18], 0x670061
mov dword [ebp - 0x14], 0x65
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x448fd9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00407360
test al, al
jne 0x448fbb
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448fa0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004088f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407340
int3
Function at 0x44bc40
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x44bda9
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.00451e80
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x44bcaf
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x44bca1
mov eax, dword [0x4c5c3c]
mov esi, dword [eax]
cmp esi, eax
je 0x44bda9
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00451e80
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x44bdd0
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov word [ebp - 8], ax
cmp ecx, 3
jne 0x44bd61
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
jne 0x44bdbc
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x44bd87
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x44bd83
cmp esi, dword [eax + 8]
jne 0x44bd83
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x44bd73
mov esi, eax
jmp 0x44bd9d
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x44bd9d
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x44bd91
cmp esi, dword [0x4c5c3c]
jne 0x44bcd0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f149
mov esp, ebp
pop ebp
ret
Function at 0x44c630
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a01ca
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c30e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44c7f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44c7fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.004118c0
mov ecx, eax
test ecx, ecx
je 0x44c808
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x44c712
xor ecx, ecx
jmp 0x44c730
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c720
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.004088f0
push edi
mov ecx, ebx
call fcn.00406ff0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x44c74c
xor ecx, ecx
jmp 0x44c764
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c754
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.004088f0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.0044d470
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00406ff0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c7a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x44c7de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44c7de
cmp dword [esi + 0x10], 0
je 0x44c7d5
push dword [edi]
call fcn.0047994d
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
int3
Function at 0x44d190
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0308
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x44d364
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44d1e5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x44d364
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44d203
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x44d364
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44d221
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x44d364
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44d23f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x44d364
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44d364
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x44d264
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x44d297
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x44d2af
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x44d2ed
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040fad0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.00451380
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x4a93c4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044e320
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44d31b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x44d354
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x44d354
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00422b1a
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.0040e7e0
lea ecx, [ebp - 0x28]
call fcn.0040e7e0
lea ecx, [ebp - 0x34]
call fcn.0044c880
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 4