joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41af20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x3030], 0
lea esi, [edi + 0x3034]
je 0x41afa2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41af5c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00428f70
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00406380
mov edx, dword [esi]
mov ecx, 0x45e828
push dword [edi + 0x3030]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x303c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00406380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41b470
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x41b4ac
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x41b492
cmp byte [esi], al
jne 0x41b492
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x4549b8]
test al, al
jne 0x41b484
pop ebx
not ecx
call fcn.0041b3b0
test eax, eax
jne 0x41b4c0
mov ecx, edi
pop edi
pop esi
jmp fcn.0041b2d0
pop edi
pop esi
ret
Function at 0x41f0a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], esi
push edi
test eax, eax
jle 0x41f236
lea ebx, [edx + 0x18]
nop word [eax + eax]
mov edx, dword [ebx - 0x18]
test edx, edx
je 0x41f227
mov ecx, esi
call fcn.0041ea20
mov edi, eax
mov eax, dword [ebx - 0x14]
mov dword [ebp - 0x1c], edi
test eax, eax
je 0x41f0fe
push eax
lea ecx, [esi + 0x2fb8]
call fcn.00406120
mov ecx, eax
jmp 0x41f100
xor ecx, ecx
mov dword [edi + 0x10], ecx
movsx eax, word [ebx]
movd xmm1, eax
movsx eax, word [ebx + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x2c], xmm1
movss dword [edi + 0x30], xmm0
movsx eax, word [ebx + 4]
movd xmm1, eax
movsx eax, word [ebx + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x34], xmm1
movss dword [edi + 0x38], xmm0
movsx eax, word [ebx + 8]
movd xmm1, eax
movsx eax, word [ebx + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [edi + 0x90]
cvtdq2ps xmm0, xmm0
and eax, 0xfffffe49
or eax, 0x49
mov dword [edi + 0x90], eax
movss dword [edi + 0x3c], xmm1
movss dword [edi + 0x40], xmm0
test ecx, ecx
je 0x41f18e
cmp dword [ecx + 0x14], 0
jne 0x41f185
mov dword [ecx + 0x14], edi
jmp 0x41f18e
cmp dword [ecx + 0x18], 0
jne 0x41f18e
mov dword [ecx + 0x18], edi
mov eax, dword [ebx - 0xc]
mov ecx, edi
mov dword [edi + 0x88], eax
movsx eax, byte [ebx - 8]
mov dword [edi + 0x44], eax
mov eax, dword [ebx - 4]
and eax, 0x61fc20
or dword [edi + 8], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41f1bb
mov ecx, eax
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x41f1b2
push dword [ecx]
lea eax, [ebp - 0x18]
push str.DockNode__02X
push 0x14
push eax
call fcn.00405b00
mov al, byte [ebp - 0x18]
lea esi, [ebp - 0x17]
add esp, 0x10
or edx, 0xffffffff
test al, al
je 0x41f20a
or edi, 0xffffffff
cmp al, 0x23
jne 0x41f1ee
cmp byte [esi], al
jne 0x41f1ee
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x4549b8]
test al, al
jne 0x41f1e0
mov edi, dword [ebp - 0x1c]
mov ecx, dword [0x45e820]
not edx
push edx
lea ecx, [ecx + 0x1c30]
call fcn.00406120
mov esi, dword [ebp - 0x20]
mov dword [edi + 0x68], eax
mov eax, dword [ebp + 8]
add ebx, 0x24
sub eax, 1
mov dword [ebp + 8], eax
jne 0x41f0d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b80b
mov esp, ebp
pop ebp
ret
Function at 0x431080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4310ba
mov eax, dword [0x45e820]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x4310ad
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4310eb
mov eax, dword [0x45e820]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x4310de
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43111c
mov eax, dword [0x45e820]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x43110f
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x431169
mov eax, dword [0x45e820]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x43115c
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x43119a
mov eax, dword [0x45e820]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x43118d
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4311cb
mov eax, dword [0x45e820]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x4311be
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00433ac0
Function at 0x448b00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, edx
je 0x448b91
test dword [ecx + 0xc], 0x100000
jne 0x448b31
push 0x1cdb
push str.C:UsersXDesktop_freeimguiimgui_widgets.cpp
push str.tab_bar__Flags__ImGuiTabBarFlags_DockNode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov cl, byte [esi]
or eax, 0xffffffff
inc esi
test cl, cl
je 0x448b69
push edi
or edi, 0xffffffff
nop
cmp cl, 0x23
jne 0x448b4f
cmp byte [esi], cl
jne 0x448b4f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4549b8]
test cl, cl
jne 0x448b40
pop edi
mov ecx, dword [0x45e820]
not eax
cmp dword [ecx + 0x1c84], eax
jne 0x448b7f
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x448ba3
mov byte [ecx + 0x1cc0], 1
pop esi
pop ebp
ret
mov eax, dword [0x45e820]
push ecx
push esi
mov ecx, dword [eax + 0x1c48]
call fcn.00408680
pop esi
pop ebp
ret
Function at 0x44c3e2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44c421
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44c421
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44c421
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44c421
cmp dword [ecx + 0x74], 0xe
jbe 0x44c421
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401230
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x51e2a6
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x268]
mov ecx, 0xe
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [esp + 0x50]
push eax
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x4c]
push 0x5c
push ecx
call fcn.0042f3fe
lea edx, [esp + 0x54]
mov esi, eax
push 0x2e
push edx
add esi, 2
call fcn.0042f3fe
add esp, 0x10
test esi, esi
mov edi, eax
je 0x4012df
test edi, edi
je 0x4012df
push 0x208
lea ebx, [ebp + 0x104]
push 0
push ebx
call fcn.00436020
sub edi, esi
sar edi, 1
push edi
push esi
push ebx
call fcn.0042f42e
add esp, 0x18
lea eax, [esp + 0x4c]
push 0x5c
push eax
call fcn.0042f3fe
mov word [eax + 2], 0
lea eax, [esp + 0x54]
add esp, 8
lea edx, [eax + 2]
jmp 0x401300
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401300
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x50]
lea edi, [ebp + 0x30c]
push ecx
mov esi, edi
call fcn.004021f0
push edi
mov ebx, str.SCWBSvcInfo.ini
lea esi, [esp + 0x34]
call fcn.00401c90
add esp, 4
push 0xffffffffffffffff
add ebp, 0x328
push 0
mov ecx, ebp
mov dword [esp + 0x268], 0
call fcn.004020b0
mov esi, 8
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x48], esi
jb 0x401373
mov edx, dword [esp + 0x34]
push edx
call fcn.0042f3a5
add esp, 4
cmp dword [ebp + 0x18], esi
jb 0x40137d
mov eax, dword [ebp + 4]
jmp 0x401380
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4013c7
push edi
mov ebx, str.SCWBOverlayInfo.ini
lea esi, [esp + 0x18]
call fcn.00401c90
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, ebp
mov dword [esp + 0x268], 1
call fcn.004020b0
cmp dword [esp + 0x2c], 8
jb 0x4013c7
mov eax, dword [esp + 0x18]
push eax
call fcn.0042f3a5
add esp, 4
cmp dword [edi + 0x18], 8
jb 0x4013d2
mov edi, dword [edi + 4]
jmp 0x4013d5
add edi, 4
push edi
push str.m_strConfigPath_path___s
call fcn.0041a020
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.0042f3aa
add esp, 0x250
ret 4
Function at 0x4014d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x324], 8
mov esi, edx
mov dword [esp + 0x10], ebx
jb 0x401503
mov eax, dword [edi + 0x310]
jmp 0x401509
lea eax, [edi + 0x310]
push str.SCWBSvcInfo.ini
push eax
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.0042f46b
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
je 0x40155e
lea eax, [esp + 0x14]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401547
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
jmp 0x4015dc
cmp dword [edi + 0x324], 8
jb 0x40156f
mov edi, dword [edi + 0x310]
jmp 0x401575
add edi, 0x310
push str.SCWBOverlayInfo.ini
push edi
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.0042f46b
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
lea eax, [esp + 0x14]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], bx
lea edx, [eax + 2]
je 0x4015c7
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4015b0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
jmp 0x4015dc
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4015c7
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004021f0
mov ecx, dword [esp + 0x21c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042f3aa
add esp, 0x210
ret

Function at 0x401c90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x51e1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.004020b0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401ce4
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00401d70
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.004020b0
cmp dword [esp + 0x24], 8
jb 0x401d2a
mov eax, dword [esp + 0x10]
push eax
call fcn.0042f3a5
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x402560
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 8]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call esi
test eax, eax
jne 0x4025ef
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push 0x20119
push eax
push str.SCWBIconOverlay
push edx
call esi
test eax, eax
jne 0x4025ef
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push eax
push ecx
push 0
push 0
push 0x560d40
push edx
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov eax, dword [esp + 4]
je 0x4025f8
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
xor al, al
pop esi
add esp, 0xc
ret 4
test eax, eax
je 0x4025ff
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x40260a
push eax
call esi
mov al, 1
pop esi
add esp, 0xc
ret 4

Function at 0x402620
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 4]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402674
mov edx, dword [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push eax
push 0xf013f
push eax
push eax
push eax
push str.SCWBIconOverlay
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40267b
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
add esp, 8
ret
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402680
sub eax, edx
mov edx, dword [esp + 8]
sar eax, 1
lea ecx, [eax + eax]
push ecx
push esi
push 1
push 0
push 0x560d40
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call esi
mov al, 1
pop esi
add esp, 8
ret
Function at 0x403210
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51fa08
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
lea esi, [ecx + 4]
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x403259
mov eax, dword [esi + 4]
jmp 0x40325c
lea eax, [esi + 4]
push eax
push str.RunHPCmd::RunCommand_cmd___s
call fcn.0041a280
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.0040d3c0
sub esp, 0x10
xor ebx, ebx
mov ecx, esp
mov dword [esp + 0x84], ebx
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00405590
lea esi, [esp + 0x3c]
call fcn.0040e310
add esp, 0x1c
cmp dword [esp + 0x38], edi
mov eax, dword [esp + 0x24]
jae 0x4032b9
lea eax, [esp + 0x24]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x68], 2
jne 0x403339
cmp esi, ebx
je 0x4032fa
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], edi
jb 0x40330d
mov edx, dword [esp + 0x24]
push edx
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb 0x403332
mov eax, dword [esp + 0x40]
push eax
call fcn.0042f3a5
add esp, 4
xor eax, eax
jmp 0x4033bd
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov edi, 0x560d38
mov byte [ecx + 4], bl
call fcn.00405590
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.004296a0
cmp esi, ebx
je 0x40337f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], 8
jb 0x403393
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb 0x4033b8
mov edx, dword [esp + 0x40]
push edx
call fcn.0042f3a5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042f3aa
mov esp, ebp
pop ebp
ret
Function at 0x4033e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51fa08
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
lea esi, [ecx + 4]
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x403429
mov eax, dword [esi + 4]
jmp 0x40342c
lea eax, [esi + 4]
push eax
push str.RunDHangCmd::RunCommand_cmd___s
call fcn.0041a280
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.0040d3c0
sub esp, 0x10
xor ebx, ebx
mov ecx, esp
mov dword [esp + 0x84], ebx
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00405590
lea esi, [esp + 0x3c]
call fcn.0040e310
add esp, 0x1c
cmp dword [esp + 0x38], edi
mov eax, dword [esp + 0x24]
jae 0x403489
lea eax, [esp + 0x24]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x68], 2
jne 0x403509
cmp esi, ebx
je 0x4034ca
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], edi
jb 0x4034dd
mov edx, dword [esp + 0x24]
push edx
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb 0x403502
mov eax, dword [esp + 0x40]
push eax
call fcn.0042f3a5
add esp, 4
xor eax, eax
jmp 0x40358d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov edi, 0x560d38
mov byte [ecx + 4], bl
call fcn.00405590
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.004296a0
cmp esi, ebx
je 0x40354f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], 8
jb 0x403563
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb 0x403588
mov edx, dword [esp + 0x40]
push edx
call fcn.0042f3a5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042f3aa
mov esp, ebp
pop ebp
ret
Function at 0x4035b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51fa08
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
lea esi, [ecx + 4]
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x4035f9
mov eax, dword [esi + 4]
jmp 0x4035fc
lea eax, [esi + 4]
push eax
push str.RunDHCmd::RunCommand_cmd___s
call fcn.0041a280
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.0040d3c0
sub esp, 0x10
xor ebx, ebx
mov ecx, esp
mov dword [esp + 0x84], ebx
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00405590
lea esi, [esp + 0x3c]
call fcn.0040e310
add esp, 0x1c
cmp dword [esp + 0x38], edi
mov eax, dword [esp + 0x24]
jae 0x403659
lea eax, [esp + 0x24]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x68], 2
jne 0x4036d9
cmp esi, ebx
je 0x40369a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], edi
jb 0x4036ad
mov edx, dword [esp + 0x24]
push edx
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb 0x4036d2
mov eax, dword [esp + 0x40]
push eax
call fcn.0042f3a5
add esp, 4
xor eax, eax
jmp 0x40375d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov edi, 0x560d38
mov byte [ecx + 4], bl
call fcn.00405590
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.004296a0
cmp esi, ebx
je 0x40371f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x38], 8
jb 0x403733
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb 0x403758
mov edx, dword [esp + 0x40]
push edx
call fcn.0042f3a5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042f3aa
mov esp, ebp
pop ebp
ret