joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
push 0
mov dword [ebp - 8], esi
push 0
mov dword [ebp - 8], esi
push 0
mov dword [esi], vtable.CTrayPos.0
mov dword [esi + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x14], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x420ad0
push 0
push 0
call fcn.004eb3b1
mov dword [esi + 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x420b50
push 0
push 0
call fcn.004eb3b1
add esp, 0x30
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x38], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x3c], ecx
mov ecx, dword [ebp - 4]
mov dword [esi], vtable.CMsgTrayPos.0
xor ecx, ebp
pop esi
call fcn.004a2820
mov esp, ebp
pop ebp
ret 0xc

Function at 0x420910
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0xc], 0
mov dword [esi], vtable.CTrayPos.0
je 0x420961
push dword [esi + 0x14]
call eax
push 0x1388
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x420950
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xc]
call edi
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0xc], 0
cmp dword [esi + 0x10], 0
je 0x420998
push dword [esi + 0x14]
call eax
push 0x1388
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x42098c
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call edi
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4209a9
push eax
call edi
mov dword [esi + 0x14], 0
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
ret
Function at 0x4212d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x4213b8
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], 0
je 0x4213b8
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
je 0x4213b8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4213b8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e4230
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
push 0x104
push eax
push dword [edi + 4]
call fcn.004213e0
test eax, eax
je 0x4213b8
push esi
mov esi, dword [edi + 0xc]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004216a0
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
call fcn.004216a0
mov ecx, dword [ebp - 0x218]
mov edx, ecx
mov esi, dword [ebp - 0x210]
sub esi, dword [ebp - 0x214]
sub edx, dword [ebp - 0x21c]
cmp ecx, dword [ebp - 0x21c]
cmove edx, esi
xor eax, eax
test edx, edx
pop esi
sete al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a2820
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004a2820
mov esp, ebp
pop ebp
ret

Function at 0x4213e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004a28a0
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4214d9
test edi, edi
je 0x4214d9
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x104
jl 0x4214d9
push 0x4000
lea eax, [ebp - 0x4004]
push 0
push eax
call fcn.004e4230
add esp, 0xc
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4214d9
cmp eax, 0x3fff
ja 0x4214d9
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4214d9
lea eax, [ebp - 0x400c]
push eax
lea eax, [ebp - 0x4010]
push eax
push 0x5179e0
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4214d9
push ebx
push 0
push edi
call fcn.004e4230
mov ecx, dword [ebp - 0x4010]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [ebx - 1]
push eax
push edi
call fcn.00421620
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a2820
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a2820
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424320
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.004a28a0
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
cmp dword [esi - 0xc], 0
jne 0x424356
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a2820
mov esp, ebp
pop ebp
ret 4
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.004e4230
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004eab45
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004a2820
mov esp, ebp
pop ebp
ret 4
Function at 0x4243f0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ef6b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004e4230
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x518450
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4245c3
mov dword [ebp - 4], 0
call fcn.004051e0
mov ecx, eax
test ecx, ecx
je 0x4245de
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 4], 1
jge 0x4244d0
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.004056c0
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 8], 0x104
lea edi, [esi - 0x10]
jl 0x4245e8
xor eax, eax
mov dword [edi + 4], 0x104
mov word [esi + 0x208], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
push esi
push 0x519970
push str.state
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [edi + 8]
push esi
call fcn.004e77c8
add esp, 8
test eax, eax
js 0x4245e8
cmp eax, dword [edi + 8]
jg 0x4245e8
xor ecx, ecx
mov dword [edi + 4], eax
mov word [esi + eax*2], cx
mov ecx, str.ADBlockMasterUpdate
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x424566
test dx, dx
je 0x424562
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x424566
add eax, 4
add ecx, 4
test dx, dx
jne 0x424540
xor eax, eax
jmp 0x42456b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4245a7
mov eax, str.bigupdate
mov cx, word [esi]
cmp cx, word [eax]
jne 0x42459a
test cx, cx
je 0x424596
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x42459a
add esi, 4
add eax, 4
test cx, cx
jne 0x424574
xor eax, eax
jmp 0x42459f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4245a7
xor esi, esi
jmp 0x4245ac
mov esi, 1
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4245c1
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2820
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d90
push 0x80070057
call fcn.00404d90
int3
Function at 0x425990
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push 0
push eax
call fcn.004e4230
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e4230
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.ADBlockMaster
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x425a15
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
xor eax, eax
mov dword [ebp - 0x41c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425a40
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040af10
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
push esi
cmovae eax, dword [ebp - 0x42c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x418]
cmp edx, 8
jb 0x425ac1
mov ecx, dword [ebp - 0x42c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425ab7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x425ae9
push edx
push ecx
call fcn.004a256a
add esp, 8
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
call fcn.0042ea80
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a2820
mov esp, ebp
pop ebp
ret
call fcn.004e75c9
int3
Function at 0x425bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.004a28a0
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1048], 0x44
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1048]
push edi
mov edi, dword [ebp + 0xc]
push eax
movlpd qword [ebp - 0x1044], xmm0
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movlpd qword [ebp - 0x102c], xmm0
movlpd qword [ebp - 0x1024], xmm0
movlpd qword [ebp - 0x101c], xmm0
movlpd qword [ebp - 0x1014], xmm0
movlpd qword [ebp - 0x100c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x101c], 1
mov word [ebp - 0x1018], ax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1058], xmm0
test edi, edi
je 0x425cd5
push 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.004e4230
push edi
push esi
lea eax, [ebp - 0x1004]
push str.__s___s
push eax
call fcn.00424ed0
add esp, 0x1c
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
jmp 0x425cf0
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x425d14
push dword [ebp - 0x1054]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1058]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004a2820
mov esp, ebp
pop ebp
ret
Function at 0x429950
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f2e3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x4299f5
cmp word [esi], di
je 0x4299f5
test eax, eax
je 0x4299b1
cmp word [eax], di
je 0x4299b1
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x4299f5
jmp 0x4299f0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004e4230
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x4299f5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x429a5b
lea esi, [ebx + 0x38]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x429a1b
mov eax, dword [esi]
push esi
call dword [eax]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x429a7b
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov byte [ebp - 4], 2
test esi, esi
je 0x429a43
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x429a5b
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2820
mov esp, ebp
pop ebp
ret 0x30
call fcn.00426d81
int3
Function at 0x42a9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x55ea48], 0
push esi
jne 0x42aaf7
cmp dword [ecx + 0x2c], 8
lea eax, [ecx + 0x18]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
jb 0x42aa1b
mov eax, dword [eax]
push edi
push 0x20219
push eax
push dword [ecx + 0x30]
lea ecx, [ebp - 0x818]
call fcn.00411d00
mov edi, dword [ebp - 0x818]
test eax, eax
jne 0x42aaeb
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push 0x51e974
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42aaeb
mov eax, dword [ebp - 0x80c]
cmp eax, 1
je 0x42aa7f
cmp eax, 2
jne 0x42aaeb
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x42aa9c
test al, 1
jne 0x42aaeb
shr eax, 1
cmp word [ebp + eax*2 - 0x806], 0
je 0x42aaa5
jmp 0x42aaeb
xor eax, eax
mov word [ebp - 0x804], ax
mov ecx, 0x55ea48
lea esi, [ebp - 0x804]
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x42aade
movzx eax, word [esi + ecx]
test ax, ax
je 0x42aade
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x42aac0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x42aaf6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push 0x55ea48
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x42ab4b
mov ecx, 0x55ea48
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x42ab3e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42ab3e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x42ab20
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 0x55ea48
xor ecx, ebp
pop esi
call fcn.004a2820
mov esp, ebp
pop ebp
ret
Function at 0x42dbc0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f7ba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x557768]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.004051e0
mov ecx, eax
test ecx, ecx
je 0x42dd84
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.004051e0
mov ecx, eax
test ecx, ecx
je 0x42dd8e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.004051e0
mov ecx, eax
test ecx, ecx
je 0x42dd98
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x42dca2
xor ecx, ecx
jmp 0x42dcc0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42dcb0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040e400
push edi
mov ecx, ebx
call fcn.0040ecb0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dcdc
xor ecx, ecx
jmp 0x42dcf4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42dce4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.0040e400
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.0042e500
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0040ecb0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42dd35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x42dd6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42dd6e
cmp dword [esi + 0x10], 0
je 0x42dd65
push dword [edi]
call fcn.004f6d51
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00404d90
push 0x80004005
call fcn.00404d90
push 0x80004005
call fcn.00404d90
int3
Function at 0x42e300
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x557768]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x42e4d4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42e355
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x42e4d4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42e373
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x42e4d4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42e391
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x42e4d4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42e3af
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x42e4d4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x42e4d4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x42e3d4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x42e407
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x42e41f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x42e45d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040a8e0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.004e3730
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x51eb9c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0042ec90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e48b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x42e4c4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x42e4c4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.0041c4e0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.004072a0
lea ecx, [ebp - 0x28]
call fcn.004072a0
lea ecx, [ebp - 0x34]
call fcn.00419c00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2820
mov esp, ebp
pop ebp
ret 4