joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14e1360
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1089000]
push edi
jmp 0x14e137a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x14e1381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x14e1370
mov eax, 1
add ebx, ebx
jne 0x14e1393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x14e13a4
jne 0x14e13c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x14e13c3
dec eax
add ebx, ebx
jne 0x14e13b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x14e1388
add ebx, ebx
jne 0x14e13bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x14e1415
xor ecx, ecx
sub eax, 3
jb 0x14e13db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x14e144a
sar eax, 1
mov ebp, eax
jmp 0x14e13e6
add ebx, ebx
jne 0x14e13e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x14e13b4
inc ecx
add ebx, ebx
jne 0x14e13f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x14e13b4
add ebx, ebx
jne 0x14e1401
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x14e13f6
jne 0x14e1412
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x14e13f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x14e1434
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x14e1426
jmp 0x14e1376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x14e1434
add edi, ecx
jmp 0x14e1376
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x14e1452
cmp byte [edi], 0x11
jne 0x14e1452
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x14e1457
lea edi, [esi + 0x10da000]
mov eax, dword [edi]
or eax, eax
je 0x14e14cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20ea9bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20eab38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x14e1484
mov ecx, edi
jns 0x14e14b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20eab3c]
or eax, eax
je 0x14e14c9
mov dword [ebx], eax
add ebx, 4
jmp 0x14e14a1
call dword [esi + 0x20eab4c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x14e1500
cmp al, 0xef
ja 0x14e14f3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x14e14d5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x14e14e2
mov ebp, dword [esi + 0x20eab40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x14e1534
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x4016a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4016f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4016f9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4016ea
cmp esi, edx
jae 0x4016f9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4016d8
cmp esi, edx
jae 0x4016f9
cmp word [esi], 0
je 0x4016f9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x405f10
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4527d7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x46f124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x405f65
mov dword [ebx], 0x465afc
mov dword [ebx + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
lea edi, [ebx + 4]
push 0
push edi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.00407460
mov dword [ebp - 4], 2
mov eax, dword [ebx]
push 8
mov dword [ebp + 0xc], edi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0042ba55
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 3
call fcn.0040dc17
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov ecx, eax
not ecx
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
and ecx, 1
mov dword [edi + 0x38], 0
shl ecx, 2
mov edx, ecx
or edx, 8
and al, 8
cmove edx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
or eax, 0x10
and cl, 4
cmove eax, edx
mov dword [edi + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4093e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4529f3
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x46f124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], 0
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.0042d750
add esp, 0xc
mov dword [ebp - 0x424], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], esi
test esi, esi
jne 0x409499
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], eax
test esi, esi
jne 0x409499
call fcn.00408a50
mov edi, eax
jmp 0x4095b5
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4094bc
call fcn.00408a50
jmp 0x4095a8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
test ebx, ebx
jne 0x4094da
call fcn.00408a50
jmp 0x4095a8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x428], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4094fb
mov edi, 0x8007000e
jmp 0x4095aa
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4095f0
jb 0x409519
cmp eax, 0xffffffff
ja 0x4095f0
cmp eax, 0x400
jbe 0x40952e
push eax
lea ecx, [ebp - 0x424]
call fcn.0040cd90
jmp 0x409554
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x409554
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
jne 0x40956b
mov edi, 0x8007000e
jmp 0x4095aa
push edi
push dword [ebp - 0x424]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40958b
call fcn.00408a50
jmp 0x4095a8
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.0040a200
mov edi, eax
test esi, esi
je 0x4095b5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x4095d0
lea ecx, [ebp - 0x424]
call fcn.0040cd20
nop
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042b793
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004015b0
int3
Function at 0x40bd20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46f124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x40bd9e
test esi, esi
je 0x40bd9e
push 5
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40bd9e
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40bd98
mov eax, dword [esi]
mov dword [edi], eax
mov al, byte [esi + 4]
mov byte [edi + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40bd98
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b793
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0042b793
mov esp, ebp
pop ebp
ret
Function at 0x415dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4536c1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46f124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.00402c30
mov ecx, eax
test ecx, ecx
je 0x415f64
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415f25
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415f17
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x415f25
add eax, 0x10
push 0x470c5a
push eax
mov dword [ebp - 0x20], eax
call fcn.0042c03a
mov esi, eax
add esp, 8
test esi, esi
je 0x415f25
push dword [ebp - 0x20]
push 0
push esi
call fcn.0042d750
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x415eda
push esi
call fcn.0042be31
add esp, 4
jmp 0x415f25
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415ee0
sub ecx, edx
sar ecx, 1
je 0x415f0e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415ef6
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.004078a0
push esi
call fcn.0042be31
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x415f25
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415f44
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b793
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004015b0
int3
Function at 0x415f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46f124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x415f94
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x415ff6
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x415ff6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x416011
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b793
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417160
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45387f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46f124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00402c30
mov ecx, eax
test ecx, ecx
je 0x417314
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00402c30
mov ecx, eax
test ecx, ecx
je 0x41731e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00402c30
mov ecx, eax
test ecx, ecx
je 0x417328
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 4
mov dword [esi + 0x10], eax
test edx, edx
jne 0x417238
xor ecx, ecx
jmp 0x417250
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417240
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.004078a0
push edi
mov ecx, ebx
call fcn.0040cb90
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41726c
xor ecx, ecx
jmp 0x417284
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417274
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.004078a0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00418250
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.0040cb90
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4172c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4172fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4172fe
cmp dword [esi + 0x10], 0
je 0x4172f5
push dword [edi]
call fcn.0043a758
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.004015b0
push 0x80004005
call fcn.004015b0
push 0x80004005
call fcn.004015b0
int3
Function at 0x4180d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4539b8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46f124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x418231
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.__set_log_lev0
push edi
call ebx
test eax, eax
je 0x418128
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 4]
jmp 0x418231
push str.__set_log_lev1
push edi
call ebx
test eax, eax
je 0x418142
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x418231
push str.__set_log_lev2
push edi
call ebx
test eax, eax
je 0x41815c
mov eax, dword [esi]
mov ecx, esi
push 2
call dword [eax + 4]
jmp 0x418231
push str.__set_log_lev3
push edi
call ebx
test eax, eax
je 0x418176
mov eax, dword [esi]
mov ecx, esi
push 3
call dword [eax + 4]
jmp 0x418231
push str.__reload_log_switch
push edi
call ebx
test eax, eax
je 0x418231
push 3
mov ecx, esi
call fcn.00418090
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.00411478
push 0x45a1e8
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00419a20
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4181ce
push 0
mov ecx, esi
call fcn.00418090
lea eax, [esi + 0x2c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4181df
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x44], 0
mov byte [ebp - 4], 1
je 0x418221
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x418221
mov eax, dword [ecx]
push 1
mov eax, dword [eax + 4]
call eax
test al, al
je 0x418221
push str._______log_reload_switch
lea ecx, [ebp - 0x44]
call fcn.00405b90
mov ecx, dword [esi + 0x44]
lea edx, [ebp - 0x44]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.00405af0
lea ecx, [ebp - 0x2c]
call fcn.00417410
lea ecx, [ebp - 0x28]
call fcn.00405af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b793
mov esp, ebp
pop ebp
ret 4
Function at 0x41a020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453cfb
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x46f124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [edi]
mov eax, dword [ebp + 8]
push eax
call dword [edx]
cmp byte [edi + 0xc], 0
je 0x41a156
mov ebx, dword [edi + 0x14]
lea esi, [edi + 0x20]
push 0x180
push 0x40
push 0x8109
push ebx
push esi
call fcn.0043b0b6
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x41a136
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.0042d750
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.00405f10
push 0x459f60
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push ebx
push str.open
push eax
call fcn.00407bd0
add esp, 8
push eax
call fcn.00407bd0
add esp, 8
push eax
call fcn.00407bd0
add esp, 8
mov ecx, eax
call fcn.00417590
push eax
call fcn.00407bd0
add esp, 8
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00419f60
cmp dword [eax + 0x14], 8
jb 0x41a119
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xd8]
call fcn.00405af0
lea ecx, [ebp - 0xa8]
call fcn.00403280
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x41a14c
push 2
push 0
push eax
call fcn.0043b584
add esp, 0xc
jmp 0x41a14f
or eax, 0xffffffff
mov dword [edi + 8], eax
mov byte [edi + 0xc], 0
mov eax, dword [edi + 4]
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x41a274
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor bl, bl
push 0
push eax
call esi
test eax, eax
movzx edx, bl
mov ecx, 1
cmove edx, ecx
mov dword [ebp - 0xac], edx
test dl, dl
jne 0x41a1a9
cmp dword [ebp + 0xc], 0
je 0x41a1a1
push 0xffffffffffffffff
push dword [edi + 4]
call esi
mov byte [ebp - 0xac], 1
jmp 0x41a1a9
test dl, dl
je 0x41a274
lea ecx, [edi + 0x24]
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
cmp eax, ecx
je 0x41a24d
mov esi, dword [ecx]
mov dword [ecx], 0
mov edx, dword [ecx + 4]
mov dword [ecx + 4], 0
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], eax
mov dword [ecx + 8], 0
cmp esi, edx
je 0x41a24d
nop dword [eax]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x41a21a
mov ecx, dword [esi]
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x41a239
push dword [esi + 0x10]
push ecx
push eax
call fcn.0043bdbb
mov edx, dword [ebp - 0xbc]
add esp, 0xc
mov ecx, eax
jmp 0x41a23c
or ecx, 0xffffffff
mov ebx, dword [edi + 8]
add esi, 0x18
add ebx, ecx
mov dword [edi + 8], ebx
cmp esi, edx
jne 0x41a210
jmp 0x41a250
mov ebx, dword [edi + 8]
lea ecx, [ebp - 0xb8]
call fcn.00416750
cmp byte [ebp - 0xac], 0
je 0x41a270
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
jmp 0x41a277
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b793
mov esp, ebp
pop ebp
ret 8
Function at 0x421540
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4549b0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x46f124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x42168d
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x42168d
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42168d
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x42168d
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push 0x80000000
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x421679
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x421672
cmp dword [ebp - 0x1c], ebx
jne 0x421672
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x42160d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x421607
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x421619
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040d97b
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0040d925
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421672
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x421672
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret