joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420a20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edi, [ecx + 0x47ba]
push edi
push 0x104
lea esi, [ecx + 0x4dd2]
push esi
push 0x4a1b98
push str.StartingTime
push str.Statistics
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x4a1b98
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x420a87
test dx, dx
je 0x420a83
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x420a87
add eax, 4
add ecx, 4
test dx, dx
jne 0x420a61
xor eax, eax
jmp 0x420a8c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x420add
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str._u__.2u__.2u__.2u:_.2u:_.2u
push 0x103
push esi
call fcn.00401690
add esp, 0x24
push edi
push esi
push str.StartingTime
push str.Statistics
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret
Function at 0x422d70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4cc416], 0
je 0x422dd3
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.004866f0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x800
push 0x800
push eax
call fcn.004890f0
add esp, 0x20
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret

Function at 0x422df0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00488190
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4cc416], 0
je 0x422e58
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
call fcn.004866f0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push 0x800
push 0x800
push eax
call fcn.004872df
add esp, 0x20
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret
Function at 0x429900
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a011b
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x460]
call fcn.00431400
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 4], 0
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0042ce90
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x460]
call fcn.00432a70
lea eax, [ebp - 0x460]
push eax
mov ecx, edi
call fcn.0042c540
push esi
push str._UNO_
lea eax, [ebp - 0x460]
push eax
mov ecx, edi
call fcn.0042b6d0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x460]
call fcn.00433130
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0042f2f0
mov esi, eax
test esi, esi
je 0x429a24
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [edi + 0x14]
push eax
lea eax, [ebp - 0x420]
push str._s_s
push eax
call fcn.0042f2d0
add esp, 0x10
lea eax, [ebp - 0x420]
push 0
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x460]
mov dword [ebp - 4], 0xffffffff
call fcn.00431470
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4

Function at 0x429b30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x429b49
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429b55
sub eax, edi
inc eax
add edx, eax
add esi, eax
cmp eax, 1
jne 0x429b50
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c300
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a02ae
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.CInternal::generateLogHeader
push 0x4a1890
call fcn.00422df0
add esp, 8
lea edi, [esi + 0x424]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c3a1
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004866f0
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [ebp - 0x218]
push str._s_s
push eax
call fcn.0042f2d0
add esp, 0x10
lea eax, [ebp - 0x218]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x42c3b5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], 0
push edi
mov ecx, esi
call fcn.0042ce90
push 0x40
call fcn.004867f5
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x42c3e1
mov ecx, eax
call fcn.00431400
jmp 0x42c3e3
xor eax, eax
push edi
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 4], eax
call fcn.00432a70
push edi
call fcn.0042f880
lea eax, [esi + 0x1080]
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x42c40c
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push str.uno_ver
call fcn.00431aa0
cmp dword [esi + 0x10ac], 8
lea eax, [esi + 0x1098]
jb 0x42c42b
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push 0x4aed18
call fcn.00431aa0
cmp dword [esi + 0x10c4], 8
lea eax, [esi + 0x10b0]
jb 0x42c44a
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push 0x4aed24
call fcn.00431aa0
cmp dword [esi + 0x10f4], 8
lea eax, [esi + 0x10e0]
jb 0x42c469
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push 0x4aed2c
call fcn.00431aa0
cmp dword [esi + 0x10dc], 8
lea eax, [esi + 0x10c8]
jb 0x42c488
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push 0x4aed34
call fcn.00431aa0
cmp dword [esi + 0x110c], 8
lea eax, [esi + 0x10f8]
jb 0x42c4a7
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push 0x4aed3c
call fcn.00431aa0
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 8]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x42c519
xor ebx, ebx
xor edi, edi
mov eax, dword [esi + 8]
add eax, ebx
cmp dword [eax + 0x2c], 8
lea ecx, [eax + 0x18]
jb 0x42c4e2
mov ecx, dword [ecx]
cmp dword [eax + 0x14], 8
jb 0x42c4ea
mov eax, dword [eax]
push ecx
mov ecx, dword [esi + 4]
push eax
call fcn.00431aa0
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 8]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 0x30
cmp edi, eax
jb 0x42c4d2
lea edi, [esi + 0x424]
mov ecx, dword [esi + 4]
push edi
call fcn.00433130
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret
Function at 0x42ce90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
mov edi, ecx
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x42cf54
test eax, eax
je 0x42cf54
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0042ce20
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str._s_s.json
push esi
call fcn.0042f2d0
push esi
push str.CInternal::getLogSavedFile
push str._UNO___s___s
call fcn.00422df0
add esp, 0x1c
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4

Function at 0x42cf70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
lea eax, [ebp - 0x20c]
je 0x42cffa
push ebx
push edi
push str.CyberLinkCBE
push eax
push str._s_s_s_s_v2
push esi
call fcn.0042f2d0
add esp, 0x18
lea edi, [esi - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x42cfe3
mov ax, word [0x4a1b98]
mov word [edi], ax
jmp 0x42d027
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42d027
push ebx
push edi
push str.CyberLinkCBE
lea eax, [ebp - 0x20c]
push eax
push str._s_s_s_s_v2
push esi
call fcn.0042f2d0
add esp, 0x18
push esi
push str.CInternal::getLogSavedPath
push str._UNO___s___s
call fcn.00422df0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42d690
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.Global9661BB2B_7119_4ee5_A048_B161A76304D9
mov edi, 1
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x1074], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1078], eax
cmp eax, 0xb7
jne 0x42d728
push 0x1388
push dword [esi + 0x1074]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x1074]
test eax, eax
je 0x42d6f8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x1074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1074], 0
push str.Global9661BB2B_7119_4ee5_A048_B161A76304D9
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x1074], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1078], eax
xor eax, eax
cmp dword [esi + 0x1078], 0xb7
cmove edi, eax
mov eax, dword [esi + 0x1074]
test eax, eax
je 0x42d74f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x1074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1074], 0
mov eax, str.FALSE
mov ecx, str.TRUE
test edi, edi
cmove ecx, eax
push ecx
push str.CInternal::isAllowToUpload
push str._UNO___s__bAllowUpload___s
call fcn.00422df0
add esp, 0xc
mov eax, edi
pop edi
pop esi
ret

Function at 0x42d780
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x42d7f7
push ebx
push edi
push edi
push edi
push edi
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
jne 0x42d7ba
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x42d7f6
push esi
push str.Sensapi.DLL
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42d7ee
push str.IsNetworkAlive
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d7e7
lea ecx, [ebp - 8]
push ecx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
pop ebx
mov ecx, str.FALSE
mov eax, str.TRUE
test edi, edi
cmove eax, ecx
push eax
push str.CInternal::isNetworkConnected
push str._UNO___s__Is_network_alive___s
call fcn.00422df0
add esp, 0xc
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42e7c0
Capabilities:
Check if file exists
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42e882
push esi
push edi
lea eax, [ebx + 6]
push 0x4a7124
push eax
call fcn.00489ce3
push 0x208
mov edi, eax
call fcn.0048614e
add esp, 0xc
mov esi, eax
test edi, edi
je 0x42e86a
jmp 0x42e800
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e805
sub ecx, edx
sar ecx, 1
lea eax, [edi + 3]
cmp eax, ecx
ja 0x42e86a
push 0x104
push 0x4acfc4
push esi
call fcn.00487152
lea eax, [edi + 4]
push eax
push ebx
push esi
call fcn.00487152
add esp, 0x18
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42e851
push esi
call fcn.0048ae5b
add esp, 4
test eax, eax
jne 0x42e86a
lea eax, [ebx + 8]
push 0x4a7124
lea eax, [eax + edi*2]
push eax
call fcn.00489ce3
inc edi
add esp, 8
add edi, eax
jne 0x42e800
test esi, esi
je 0x42e877
push esi
call fcn.004866e2
add esp, 4
push ebx
call fcn.0042f880
add esp, 4
pop edi
pop esi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x42f9a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42f9d0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0xc]
mov ebx, eax
mov dword [edi], ebx
test ebx, ebx
jne 0x42fa03
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 1]
push eax
call fcn.0048a9ca
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x42fa2c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
je 0x42fa62
push 0x4b0470
push str._UNO___s__ReadFile_error__
call fcn.00422df0
add esp, 8
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
pop edi
pop ebx
mov byte [ecx + eax], 0
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42fe90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x42feaf
push 0x3e8
call fcn.0042ff40
test eax, eax
js 0x42ff2f
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x4302c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
test eax, eax
je 0x42ff1d
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x42ff14
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x42ff14
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42fefe
movzx esi, si
or esi, 0x80070000
push 0x3e8
mov ecx, edi
call fcn.0042ff40
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42ff2f
movzx eax, ax
or eax, 0x80070000
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x42ff40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
lea eax, [edi + 4]
je 0x42ffb6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
test esi, esi
je 0x42ffb6
push esi
push str.CThreadMgr::DestroyThread
push str._UNO___s_Thread_Handle:__08x
call fcn.00422d70
add esp, 0xc
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42ff9c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push str.CThreadMgr::DestroyThread
push str._UNO___s_TerminateThread:__08x
call fcn.00422d70
add esp, 0xc
push esi
push str.CThreadMgr::DestroyThread
push str._UNO___s_CloseHandle:__08x
call fcn.00422d70
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x68], 0
je 0x42ffdc
mov eax, dword [edi + 0x68]
nop
test eax, eax
je 0x42ffd6
dec eax
mov dword [edi + 0x68], eax
jne 0x42ffd3
mov dword [edi + 0x64], 0
jmp 0x42ffd6
inc dword [edi + 0x64]
cmp dword [edi + 0x68], 0
jne 0x42ffc0
lea esi, [edi + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x432a70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0898
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x432b88
lea esi, [ebx + 8]
mov ecx, esi
call fcn.00401aa0
test esi, esi
je 0x432acf
xorps xmm0, xmm0
movq qword [esi], xmm0
mov eax, 3
movq qword [esi + 8], xmm0
mov word [esi + 0xe], ax
push 0x4a2a0c
lea eax, [ebp + 8]
push edi
push eax
mov dword [ebp + 8], 0
call fcn.0048759c
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x432bef
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
call fcn.0048b2d5
add esp, 4
cmp eax, 0xffffffff
je 0x432b13
inc dword [ebp - 0x14]
mov byte [ebp - 0x18], al
jmp 0x432b17
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x100
mov dword [ebp - 0x24], 0x144
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00430d90
push dword [ebp + 8]
call fcn.00487717
push dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004871da
push dword [ebp - 0x38]
call fcn.00486409
add esp, 0xc
jmp 0x432bef
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0x10], 0
call fcn.0042f9a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x432bb6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x10], 0
jbe 0x432be6
lea eax, [ebp - 0x18]
lea ecx, [ebx + 8]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00423ea0
cmp dword [eax + 0x30], 0
je 0x432be6
push str.CLogFile::LoadLog
push str._UNO___s__Parse_error
call fcn.00422df0
add esp, 8
push esi
call fcn.004871da
add esp, 4
push edi
push str.CLogFile::LoadLog
push str._UNO___s__LogPath_s
call fcn.00422df0
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0a20
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4362d4
push esi
push esi
push str.CHttpToolW::GetMimeType:_hFile_can_not_be_NULL.
call fcn.00437020
mov edi, dword [ebp + 0xc]
cmp edi, 0xfde9
je 0x436457
cmp edi, 0xfde8
je 0x436457
cmp esi, 0xffffffff
jne 0x436350
mov esi, dword [str.application_octet_stream]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x436300
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0048a9ca
mov edx, eax
add esp, 4
test edx, edx
jne 0x436322
push 0x66
call fcn.00436f40
mov ecx, edx
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
lea esi, [esi + 1]
test al, al
jne 0x436326
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x11c]
push eax
push 0x100
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
test eax, eax
jne 0x436383
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x25a
call fcn.00436f70
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
cmp eax, 0xffffffff
jne 0x4363a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x25c
call fcn.00436f70
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
push eax
push 0
push 0
mov dword [ebp - 0x118], 0
call sub.urlmon.dll_FindMimeFromData
test eax, eax
je 0x436417
mov esi, dword [str.application_octet_stream]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4363e0
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0048a9ca
mov edx, eax
add esp, 4
test edx, edx
jne 0x436402
push 0x66
call fcn.00436f40
mov ecx, edx
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
lea esi, [esi + 1]
test al, al
jne 0x436406
jmp 0x436332
push edi
push dword [ebp - 0x118]
mov dword [ebp - 4], 0
call fcn.004371b0
add esp, 8
mov esi, eax
push dword [ebp - 0x118]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
jmp 0x436334
push 0
push 0
push str.CHttpToolW::GetMimeType:_CP_UTF8_and_CP_UTF7_can_not_be_used_for_the_CodePage_parameter.
call fcn.00437020
int3
Function at 0x4364a0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4364e8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4364f4
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x436500
xor esi, esi
test edi, edi
je 0x4364e3
lea eax, [ebp + 8]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ecx]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x43650c
add esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp esi, edi
jb 0x4364c1
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push str.CHttpToolA::InternetWriteFile:_hRequest_can_not_be_NULL.
call fcn.00436e60
push 0
push str.CHttpToolA::InternetWriteFile:_pbyBuff_can_not_be_NULL.
call fcn.00436e60
push 0
push str.CHttpToolA::InternetWriteFile:_cbyBuff_can_not_be_zero.
call fcn.00436e60
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x198
call fcn.00436db0
int3