joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100408f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10040914
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100171d0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10040935
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10040937
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x100409bf
jg 0x1004094a
test esi, esi
je 0x100409bf
test ecx, ecx
jl 0x1004098c
jg 0x10040954
test eax, eax
je 0x1004098c
cmp ebx, ecx
jg 0x10040966
jl 0x1004095e
cmp esi, eax
jae 0x10040966
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1009bf80
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10040992
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x100409bf
jg 0x1004099c
test esi, esi
je 0x100409bf
cmp dword [edi + 0x4c], 0
je 0x100409bf
mov ecx, edi
call fcn.1003fd30
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.100a56ed
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100409e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10040a04
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100172a0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10040a25
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10040a27
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10040aa4
jg 0x10040a3a
test esi, esi
je 0x10040aa4
test ecx, ecx
jl 0x10040a7e
jg 0x10040a44
test eax, eax
je 0x10040a7e
cmp edi, ecx
jg 0x10040a56
jl 0x10040a4e
cmp esi, eax
jae 0x10040a56
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1009bf80
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10040a81
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10040aa4
jg 0x10040a8b
test esi, esi
je 0x10040aa4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10040aa4
push eax
push esi
push 1
push edx
call fcn.100a5d81
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10041320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ca9c6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101063e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10004380
mov ecx, eax
test ecx, ecx
je 0x10041416
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
call fcn.10004380
mov ecx, eax
test ecx, ecx
je 0x10041420
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
push 0
push 0x100d2904
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], 0
call fcn.100044d0
push 0
push 0x100d2904
lea ecx, [esi + 8]
call fcn.100044d0
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003f10
push 0x80004005
call fcn.10003f10
int3
Function at 0x10043040
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cacd0
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x101063e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x478], eax
test ebx, ebx
jne 0x1004308d
xor al, al
jmp 0x100431de
test edi, edi
je 0x10043086
cmp dword [esi], 0
je 0x1004309d
mov al, 1
jmp 0x100431de
push 0x250
lea eax, [ebp - 0x46c]
push 0
push eax
call fcn.1009c500
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1009c500
add esp, 0x18
lea eax, [ebp - 0x21c]
push edi
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100431fc
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x10043217
jmp 0x10043116
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.100093c0
push edi
lea ecx, [esi + 8]
call fcn.100093c0
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x478]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x46c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x468]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x464]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x460]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x45c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x458]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x454]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x44c]
push edi
push ebx
mov dword [esi + 0x30], eax
mov dword [esi], 1
call fcn.10041ce0
mov ecx, eax
call fcn.10044030
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x10043086
push 0
push 0
push esi
push 0x10043310
push 0
push 0
call fcn.100a0087
add esp, 0x18
mov dword [esi + 0x3c], eax
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10075b61
mov esp, ebp
pop ebp
ret 0x10
push 0x100fa8f4
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0xffffffff
push eax
call fcn.1009c65a
push 0x100fa8f4
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0xfffffffe
push eax
call fcn.1009c65a
int3
Function at 0x1004a0c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x1004a0ea
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1004a116
push 1
mov ecx, esi
call fcn.10049e90
pop esi
pop ebp
ret 8
cmp dword [esi + 0x2c], 0
push edi
je 0x1004a0f6
mov edi, dword [esi + 0x34]
jmp 0x1004a0f9
mov edi, dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1004a115
test edi, edi
je 0x1004a115
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 8

Function at 0x1004a120
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x1004a151
mov eax, dword [esi + 0x24]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1004a17d
push 1
lea ecx, [esi - 0x24]
call fcn.10049e90
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [esi + 8], 0
push edi
je 0x1004a15d
mov edi, dword [esi + 0x10]
jmp 0x1004a160
mov edi, dword [esi + 0xc]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1004a17c
test edi, edi
je 0x1004a17c
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x1004add0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101063e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x26], bl
mov dword [ebp - 0x2c], ebx
jb 0x1004adf8
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x1004aefd
push esi
mov esi, 1
cmp dword [ebp - 0x2c], esi
jle 0x1004aef5
nop dword [eax]
mov edx, dword [edi + esi*4]
test edx, edx
je 0x1004ae9d
xor eax, eax
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
mov eax, edx
mov dword [ebp - 0x10], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1004ae43
sub eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x24]
sar eax, 1
push eax
push edx
call fcn.10010b00
push 0
push 0
push 0
push 0
xor eax, eax
lea ecx, [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0xc], eax
or ebx, 1
cmp dword [ebp - 0x10], 8
mov word [ebp - 8], ax
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push 3
push ecx
push eax
call fcn.100a6438
add esp, 0x24
test eax, eax
jne 0x1004ae9d
mov byte [ebp - 0x25], 1
cmp word [ebp - 0xc], ax
jne 0x1004aea1
mov byte [ebp - 0x25], 0
test bl, 1
je 0x1004aedf
mov edx, dword [ebp - 0x10]
and ebx, 0xfffffffe
cmp edx, 8
jb 0x1004aedf
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004aed5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004af10
push edx
push ecx
call fcn.100757e2
add esp, 8
cmp byte [ebp - 0x25], 0
jne 0x1004aef1
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x1004ae20
jmp 0x1004aef5
mov byte [ebp - 0x26], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x26]
xor ecx, ebp
pop edi
pop ebx
call fcn.10075b61
mov esp, ebp
pop ebp
ret
call fcn.100a0325
int3
Function at 0x1004c920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbc22
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x101063e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x1004ca50
test eax, eax
je 0x1004ca50
test ebx, ebx
je 0x1004ca50
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004ca3f
cmp dword [ebp - 0x818], eax
je 0x1004ca50
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.1009c500
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1004ca3f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004ca21
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10010b00
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x1004ca50
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075b61
mov esp, ebp
pop ebp
ret
Function at 0x10056df0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc71a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101063e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10004380
mov ecx, eax
test ecx, ecx
je 0x10056fb4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10004380
mov ecx, eax
test ecx, ecx
je 0x10056fbe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10004380
mov ecx, eax
test ecx, ecx
je 0x10056fc8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10056ed2
xor ecx, ecx
jmp 0x10056ef0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10056ee0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.100044d0
push edi
mov ecx, ebx
call fcn.10009350
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10056f0c
xor ecx, ecx
jmp 0x10056f24
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10056f14
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.100044d0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10057740
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10009350
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10056f65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x10056f9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10056f9e
cmp dword [esi + 0x10], 0
je 0x10056f95
push dword [edi]
call fcn.100aab66
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10003f10
push 0x80004005
call fcn.10003f10
push 0x80004005
call fcn.10003f10
int3
Function at 0x10057540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc808
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101063e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10057714
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10057595
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x10057714
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100575b3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x10057714
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100575d1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x10057714
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100575ef
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x10057714
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10057714
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10057614
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x10057647
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1005765f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1005769d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10010760
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.1009bf80
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100de7ac
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100582d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100576cb
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x10057704
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10057704
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10017de0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10008bd0
lea ecx, [ebp - 0x28]
call fcn.10008bd0
lea ecx, [ebp - 0x34]
call fcn.10008ee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075b61
mov esp, ebp
pop ebp
ret 4
Function at 0x10057e90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc977
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x101063e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x10057eda
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10057ee6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10010b00
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x10057f53
push 0x48
call fcn.10075b85
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10057f47
push 0x48
push 0
push ebx
call fcn.1009c500
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.10056df0
jmp 0x10057f49
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10057f80
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10010b00
push 3
push 0x100de7ac
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10010980
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10057fcf
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1005801e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1005801e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10010b00
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10008bd0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10058054
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1005804a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10058091
push edx
push ecx
call fcn.100757e2
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x10058073
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075b61
mov esp, ebp
pop ebp
ret 0x14
call fcn.100a0325
int3
Function at 0x100613c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbc22
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x101063e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x100614f0
test eax, eax
je 0x100614f0
test ebx, ebx
je 0x100614f0
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100614df
cmp dword [ebp - 0x818], eax
je 0x100614f0
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.1009c500
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100614df
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100614c1
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10010b00
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x100614f0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075b61
mov esp, ebp
pop ebp
ret 0x10