joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d8f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542bab
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x220], esi
call fcn.0050f150
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x42d9da
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x42d98f
movzx eax, ax
mov ecx, esi
push eax
call fcn.0040cd30
jmp 0x42d9be
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d9a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004122c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409540
int3
Function at 0x42da80
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542beb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0050f150
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x54f1b8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42dc53
mov dword [ebp - 4], 0
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x42dc6e
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 4], 1
jge 0x42db60
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.0040d530
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 8], 0x104
lea edi, [esi - 0x10]
jl 0x42dc78
xor eax, eax
mov dword [edi + 4], 0x104
mov word [esi + 0x208], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
push esi
push 0x54e970
push str.state
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [edi + 8]
push esi
call fcn.0051e3d5
add esp, 8
test eax, eax
js 0x42dc78
cmp eax, dword [edi + 8]
jg 0x42dc78
xor ecx, ecx
mov dword [edi + 4], eax
mov word [esi + eax*2], cx
mov ecx, str.AnyUpdate
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42dbf6
test dx, dx
je 0x42dbf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42dbf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x42dbd0
xor eax, eax
jmp 0x42dbfb
sbb eax, eax
or eax, 1
test eax, eax
je 0x42dc37
mov eax, str.bigupdate
mov cx, word [esi]
cmp cx, word [eax]
jne 0x42dc2a
test cx, cx
je 0x42dc26
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x42dc2a
add esi, 4
add eax, 4
test cx, cx
jne 0x42dc04
xor eax, eax
jmp 0x42dc2f
sbb eax, eax
or eax, 1
test eax, eax
je 0x42dc37
xor esi, esi
jmp 0x42dc3c
mov esi, 1
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42dc51
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409540
push 0x80070057
call fcn.00409540
int3
Function at 0x42dc90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.0050f150
add esp, 0xc
cmp word [0x59ad40], 0
jne 0x42dce4
push 0x104
push 0x59ad40
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x59ad40
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
push 0x59ad40
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0043a260
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret

Function at 0x42de50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0050f150
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42deb0
cmp dword [ebp - 0x114], 6
jb 0x42deb0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret

Function at 0x42e080
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e0af
push 5
push 0
push 0
push dword [ebp + 8]
push 0x54f090
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x42e0af
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x42e550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x586398
push 0x50f2f0
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x594584]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.0050f150
push edi
push str.SYSTEMCurrentControlSetServices_sParameters
push 0xff
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x430]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x42c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e669
mov dword [ebp - 0x438], eax
push 0x210
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0050f150
add esp, 0xc
mov dword [ebp - 0x434], 0x210
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push str.ServiceDll
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e669
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jle 0x42e669
push ecx
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 4], 0xfffffffe
call fcn.0042e69b
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ef00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542e06
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x220], edi
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x42f061
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov eax, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x42ef75
movzx eax, ax
push eax
call fcn.0040cd30
jmp 0x42ef81
push 0x39
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
call fcn.004122c0
push esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.0042c130
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push 0
push eax
push 0
push 0x20206
push 0
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42f01b
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0050f150
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x42f01b
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 1
cmove edi, ecx
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x42f02c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42f044
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409540
int3
Function at 0x430190
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542f09
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x594584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 0
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
shl ebx, 0x10
mov dword [ebp + 0xc], ebx
cmp esi, 0x2d
je 0x4301f3
cmp esi, 0x2e
je 0x4301f3
cmp esi, 0x90
je 0x4301f3
cmp esi, 0x21
jb 0x4301ed
cmp esi, 0x28
jbe 0x4301f3
cmp dword [ebp + 0x10], 0
je 0x4301fc
or ebx, 0x1000000
mov dword [ebp + 0xc], ebx
mov dword [ebp - 4], 1
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x4302cb
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov esi, 0x40
mov dword [ebp - 0x10], 1
add esi, esi
js 0x4302c1
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x430255
push esi
mov ecx, edi
call fcn.0040d530
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x4302c1
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
mov word [eax + esi*2], dx
lea eax, [esi + 1]
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x430290
mov ecx, dword [edi]
test ecx, ecx
jne 0x430284
xor eax, eax
jmp 0x430294
push dword [ecx - 8]
push ecx
call fcn.0051e3d5
add esp, 8
test eax, eax
js 0x4302c1
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4302c1
mov dword [ecx - 0xc], eax
xor edx, edx
mov ecx, dword [edi]
cmp ebx, esi
mov ebx, dword [ebp + 0xc]
mov word [ecx + eax*2], dx
je 0x430232
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
int3
Function at 0x431ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x118], 0x740068
push edi
mov dword [ebp - 0x114], 0x700074
mov dword [ebp - 0x110], 0x2f003a
mov dword [ebp - 0x10c], 0x73002f
mov dword [ebp - 0x108], 0x35002e
mov dword [ebp - 0x104], 0x740032
mov dword [ebp - 0x100], 0x6f006f
mov dword [ebp - 0xfc], 0x62006c
mov dword [ebp - 0xf8], 0x78006f
mov dword [ebp - 0xf4], 0x63002e
mov dword [ebp - 0xf0], 0x6d006f
mov dword [ebp - 0xec], 0x61002f
mov dword [ebp - 0xe8], 0x79006e
mov dword [ebp - 0xe4], 0x650073
mov dword [ebp - 0xe0], 0x720061
mov dword [ebp - 0xdc], 0x680063
mov dword [ebp - 0xd8], 0x61003f
mov dword [ebp - 0xd4], 0x700070
mov dword [ebp - 0xd0], 0x61003d
mov dword [ebp - 0xcc], 0x79006e
mov dword [ebp - 0xc8], 0x650073
mov dword [ebp - 0xc4], 0x720061
mov dword [ebp - 0xc0], 0x680063
mov dword [ebp - 0xbc], 0x700026
mov dword [ebp - 0xb8], 0x640069
mov dword [ebp - 0xb4], 0x7b003d
mov dword [ebp - 0xb0], 0x690070
mov dword [ebp - 0xac], 0x7d0064
mov dword [ebp - 0xa8], 0x6d0026
mov dword [ebp - 0xa4], 0x640069
mov dword [ebp - 0xa0], 0x7b003d
mov dword [ebp - 0x9c], 0x69006d
mov dword [ebp - 0x98], 0x7d0064
mov dword [ebp - 0x94], 0x6d0026
mov dword [ebp - 0x90], 0x640069
mov dword [ebp - 0x8c], 0x3d0032
mov dword [ebp - 0x88], 0x6d007b
mov dword [ebp - 0x84], 0x640069
mov dword [ebp - 0x80], 0x7d0032
mov dword [ebp - 0x7c], 0x610026
mov dword [ebp - 0x78], 0x700070
mov dword [ebp - 0x74], 0x650076
mov dword [ebp - 0x70], 0x3d0072
mov dword [ebp - 0x6c], 0x61007b
mov dword [ebp - 0x68], 0x700070
mov dword [ebp - 0x64], 0x650076
mov dword [ebp - 0x60], 0x7d0072
mov dword [ebp - 0x5c], 0x6d0026
mov dword [ebp - 0x58], 0x64006f
mov dword [ebp - 0x54], 0x650076
mov dword [ebp - 0x50], 0x3d0072
mov dword [ebp - 0x4c], 0x6d007b
mov dword [ebp - 0x48], 0x64006f
mov dword [ebp - 0x44], 0x650076
mov dword [ebp - 0x40], 0x7d0072
mov dword [ebp - 0x3c], 0x740026
mov dword [ebp - 0x38], 0x700079
mov dword [ebp - 0x34], 0x3d0065
mov dword [ebp - 0x30], 0x74007b
mov dword [ebp - 0x2c], 0x700079
mov dword [ebp - 0x28], 0x7d0065
mov dword [ebp - 0x24], 0x610026
mov dword [ebp - 0x20], 0x740063
mov dword [ebp - 0x1c], 0x6f0069
mov dword [ebp - 0x18], 0x3d006e
mov dword [ebp - 0x14], 0x61007b
mov dword [ebp - 0x10], 0x740063
mov dword [ebp - 0xc], 0x6f0069
mov dword [ebp - 8], 0x7d006e
mov word [ebp - 4], ax
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x431e74
mov eax, dword [ecx]
push 2
push 0x8a
call dword [eax]
test eax, eax
je 0x431e7e
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x8a
jl 0x431e6a
mov dword [eax - 0xc], 0x8a
xor eax, eax
mov ecx, dword [esi]
push 0x8a
mov word [ecx + 0x114], ax
lea eax, [ebp - 0x118]
push eax
push 0x8a
push dword [esi]
call fcn.00411970
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
call fcn.0040d7b0
int3
Function at 0x439220
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5435ea
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x594584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x4393e4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x4393ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.0040c4c0
mov ecx, eax
test ecx, ecx
je 0x4393f8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x439302
xor ecx, ecx
jmp 0x439320
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439310
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.004122c0
push edi
mov ecx, ebx
call fcn.00422c40
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43933c
xor ecx, ecx
jmp 0x439354
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439344
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.004122c0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00439ce0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00422c40
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x439395
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4393ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4393ce
cmp dword [esi + 0x10], 0
je 0x4393c5
push dword [edi]
call fcn.005226ac
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00409540
push 0x80004005
call fcn.00409540
push 0x80004005
call fcn.00409540
int3
Function at 0x439ae0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5436d8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x439cb4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439b35
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x439cb4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439b53
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x439cb4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439b71
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x439cb4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439b8f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x439cb4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439cb4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x439bb4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x439be7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x439bff
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x439c3d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040efe0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.0050e650
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x555b54
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043a490
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439c6b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x439ca4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x439ca4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00406c40
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00407a40
lea ecx, [ebp - 0x28]
call fcn.00407a40
lea ecx, [ebp - 0x34]
call fcn.00439430
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret 4
Function at 0x43a050
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543797
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x594584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x43a09a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a0a6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.0040f730
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x43a113
push 0x48
call fcn.004cbef6
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x43a107
push 0x48
push 0
push ebx
call fcn.0050f150
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00439220
jmp 0x43a109
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a140
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f730
push 3
push 0x555b54
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040f4c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a18f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x43a1de
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x43a1de
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.0040f730
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00407a40
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43a214
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43a20a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a251
push edx
push ecx
call fcn.004cbf26
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x43a233
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cc1ce
mov esp, ebp
pop ebp
ret 0x14
call fcn.005127d9
int3