joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443600
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557bfb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x564f60
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4437d9
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x4437f4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 4], 0
jge 0x4436d9
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.00406ba0
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 8], 0x104
jl 0x4437fe
xor eax, eax
mov dword [esi - 0xc], 0x104
mov word [esi + 0x208], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
push esi
push 0x5645e0
push str.type
push 0x567a94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [esi - 8]
push esi
call fcn.00517503
add esp, 8
test eax, eax
js 0x4437fe
cmp eax, dword [esi - 8]
jg 0x4437fe
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov ecx, str.bigupdate
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44376b
test dx, dx
je 0x443767
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44376b
add eax, 4
add ecx, 4
test dx, dx
jne 0x443745
xor eax, eax
jmp 0x443770
sbb eax, eax
or eax, 1
test eax, eax
je 0x4437b3
mov ecx, str.generalupdate
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4437a6
test dx, dx
je 0x4437a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4437a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x443780
xor eax, eax
jmp 0x4437ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x4437b3
xor edi, edi
jmp 0x4437b8
mov edi, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4437d7
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406210
push 0x80070057
call fcn.00406210
int3
Function at 0x443f10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1858
call fcn.004d68c0
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
push 0
push eax
call fcn.00513d10
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x443f7a
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
push ebx
call fcn.00443d90
add esp, 0x10
test eax, eax
jne 0x443f92
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x804]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x443f82
xorps xmm0, xmm0
mov dword [ebp - 0x1858], 0x44
lea eax, [ebp - 0x1858]
movlpd qword [ebp - 0x1854], xmm0
push eax
movlpd qword [ebp - 0x184c], xmm0
movlpd qword [ebp - 0x1844], xmm0
movlpd qword [ebp - 0x183c], xmm0
movlpd qword [ebp - 0x1834], xmm0
movlpd qword [ebp - 0x182c], xmm0
movlpd qword [ebp - 0x1824], xmm0
movlpd qword [ebp - 0x181c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x14]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x1828], ax
lea eax, [ebp - 0x1804]
push 0
push eax
mov dword [ebp - 0x182c], 1
movups xmmword [ebp - 0x1814], xmm0
call fcn.00513d10
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x444043
push edi
push eax
lea eax, [ebp - 0x1804]
push str.__s___s
push eax
call fcn.0041c1a0
add esp, 0x10
jmp 0x444058
push eax
lea eax, [ebp - 0x1804]
push str.__s_
push eax
call fcn.0041c1a0
add esp, 0xc
lea eax, [ebp - 0x1814]
push eax
lea eax, [ebp - 0x1858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x4440c6
cmp dword [ebp + 0x18], 0
je 0x44409c
push dword [ebp + 0x1c]
push dword [ebp - 0x1814]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x4440b0
push eax
push dword [ebp - 0x1814]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1814]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d684f
mov esp, ebp
pop ebp
ret
Function at 0x444190
Capabilities:
Check if file exists
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557d16
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x81c], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44423d
mov dword [ebp - 0x814], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0x566aac
push 0x17
push 0
push 0x56a5e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x444244
mov eax, dword [ebp - 0x818]
mov byte [ebp - 4], 0
test eax, eax
je 0x444226
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x814]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44423d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x44439e
mov ecx, dword [ebp - 0x818]
mov eax, dword [ebp - 0x814]
mov byte [ebp - 4], 2
cmp ecx, eax
je 0x4442a5
mov edi, ecx
test eax, eax
je 0x444281
mov ecx, dword [eax]
lea edx, [ebp - 0x818]
push edx
push 0x566abc
push eax
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x814]
js 0x444281
mov ecx, dword [ebp - 0x818]
jmp 0x444289
xor ecx, ecx
mov dword [ebp - 0x818], ecx
test edi, edi
je 0x44429f
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x814]
mov ecx, dword [ebp - 0x818]
mov edi, dword [ebp - 0x81c]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x44422c
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x444212
test ebx, ebx
je 0x4442dc
mov eax, dword [ebp - 0x814]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x444212
mov eax, dword [ebp - 0x814]
push 5
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x444212
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00513d10
push 0x400
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.0051dab6
add esp, 0x18
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, dword [ebp + 0x18]
test edx, edx
jle 0x44433c
mov eax, dword [ebp - 0x814]
push edx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x814]
lea edx, [ebp - 0x810]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
mov eax, dword [ebp - 0x818]
js 0x444218
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x18]
test eax, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x818]
js 0x44421c
test eax, eax
je 0x444382
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x814]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x444399
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
Function at 0x4443c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor bl, bl
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x444436
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x44442f
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
je 0x44442d
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x444406
jmp 0x44442f
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d684f
mov esp, ebp
pop ebp
ret

Function at 0x444450
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push 0
push 2
mov dword [ebp - 0x660], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x65c], esi
cmp esi, 0xffffffff
je 0x44454f
lea eax, [ebp - 0x658]
mov dword [ebp - 0x658], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x444548
nop dword [eax]
push dword [ebp - 0x660]
lea eax, [ebp - 0x634]
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
jne 0x444533
push dword [ebp - 0x650]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x444528
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x428
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x444521
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0051f4b1
add esp, 8
test eax, eax
je 0x44451f
lea eax, [ebp - 0x42c]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4444f8
jmp 0x444521
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x65c]
cmp bl, 1
je 0x444548
lea eax, [ebp - 0x658]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4444b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d684f
mov esp, ebp
pop ebp
ret
Function at 0x444950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5574fb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x5b8128], 0
jne 0x444a8a
push 0x20219
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.004137c0
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x444a7f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.FROM
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444a7f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x444a1c
cmp eax, 2
jne 0x444a7f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x444a39
test al, 1
jne 0x444a7f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x444a42
jmp 0x444a7f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x5b8128
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x444a72
movzx eax, word [esi + ecx]
test ax, ax
je 0x444a72
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x444a54
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x444a8a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x444b01
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x5b8128
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x444abf
movzx eax, ax
mov ecx, edi
push eax
call fcn.004069f0
jmp 0x444ae3
mov ecx, 0x5b8128
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x444ac7
sub ecx, edx
sar ecx, 1
push ecx
push 0x5b8128
mov ecx, edi
call fcn.0040adc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406210
int3
Function at 0x444c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5574fb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x5b7928], 0
jne 0x444dca
push 0x20219
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.004137c0
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x444dbf
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push 0x569c94
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444dbf
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x444d5c
cmp eax, 2
jne 0x444dbf
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x444d79
test al, 1
jne 0x444dbf
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x444d82
jmp 0x444dbf
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x5b7928
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x444db2
movzx eax, word [esi + ecx]
test ax, ax
je 0x444db2
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x444d94
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x444dca
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5b7928
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x444e1b
mov ecx, 0x5b7928
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x444e0e
movzx eax, word [esi + ecx]
test ax, ax
je 0x444e0e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x444df0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x444e9a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x5b7928
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x444e50
movzx eax, ax
mov ecx, edi
push eax
call fcn.004069f0
jmp 0x444e7c
mov ecx, 0x5b7928
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x444e60
sub ecx, edx
sar ecx, 1
push ecx
push 0x5b7928
mov ecx, edi
call fcn.0040adc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406210
int3
Function at 0x445380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.004d68c0
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1058], 0x44
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1058]
push edi
mov edi, dword [ebp + 0xc]
push eax
movlpd qword [ebp - 0x1054], xmm0
movlpd qword [ebp - 0x104c], xmm0
movlpd qword [ebp - 0x1044], xmm0
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movlpd qword [ebp - 0x102c], xmm0
movlpd qword [ebp - 0x1024], xmm0
movlpd qword [ebp - 0x101c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x102c], 1
mov word [ebp - 0x1028], ax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1014], xmm0
test edi, edi
je 0x445465
push 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.00513d10
push edi
push esi
lea eax, [ebp - 0x1004]
push str.__s___s
push eax
call fcn.0041c1a0
add esp, 0x1c
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
jmp 0x445480
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x4454a4
push dword [ebp - 0x1010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1014]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004d684f
mov esp, ebp
pop ebp
ret

Function at 0x4454c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
lea eax, [ebp - 0x54]
mov ecx, 0x44
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4454d0
mov ecx, 0x10
lea eax, [ebp - 0x10]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4454e3
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x44
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00445560
add esp, 0x14
test eax, eax
je 0x44552e
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0xa
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
pop esi
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x44e400
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55844a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ad6f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x44e5c4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x44e5ce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00406530
mov ecx, eax
test ecx, ecx
je 0x44e5d8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x44e4e2
xor ecx, ecx
jmp 0x44e500
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44e4f0
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040adc0
push edi
mov ecx, ebx
call fcn.00411b30
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x44e51c
xor ecx, ecx
jmp 0x44e534
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44e524
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.0040adc0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.0044ee10
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00411b30
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44e575
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x44e5ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44e5ae
cmp dword [esi + 0x10], 0
je 0x44e5a5
push dword [edi]
call fcn.0052b4a5
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00406210
push 0x80004005
call fcn.00406210
push 0x80004005
call fcn.00406210
int3
Function at 0x44ec10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558538
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5ad6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x44ede4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44ec65
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x44ede4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44ec83
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x44ede4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44eca1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x44ede4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44ecbf
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x44ede4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44ede4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x44ece4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x44ed17
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x44ed2f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x44ed6d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040bfd0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.00513210
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x56dc94
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044f770
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44ed9b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x44edd4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x44edd4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00407b80
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.004087e0
lea ecx, [ebp - 0x28]
call fcn.004087e0
lea ecx, [ebp - 0x34]
call fcn.00437c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d684f
mov esp, ebp
pop ebp
ret 4