joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae37d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100cf3f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10045e63
mov edi, eax
add esp, 4
test edi, edi
je 0x10016e3d
push 1
mov dword [ebp - 4], 0
call fcn.10024284
add esp, 4
mov dword [edi + 4], eax
jmp 0x10016e3f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1000df80
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10016e9a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10016e9a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10016eb6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10016ed9
cmp byte [ebp + 0xc], 0
je 0x10016ec5
push esi
call fcn.100247b9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10016ee5
mov esi, str.ios_base::badbit_set
jmp 0x10016ef5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10016f40
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.1000eb70
push 0x100c84a4
lea eax, [ebp - 0x28]
push eax
call fcn.1004872b
int3
Function at 0x10019480
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100194aa
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
push edi
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x100194e9
push ebx
call esi
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 0x3c]
push 4
push 0x1000
push dword [eax + edi + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10019536
push dword [ebp + 0xc]
push esi
push edi
call fcn.10019550
add esp, 0xc
test eax, eax
je 0x10019526
push dword [ebp + 0xc]
push esi
call fcn.10019120
add esp, 8
test eax, eax
jne 0x10019536
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1001a800
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
test esi, esi
jne 0x1001a833
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x1001a847
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov ecx, eax
mov dword [ebp - 0x50], ecx
jne 0x1001a87b
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x50]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x4c], eax
je 0x1001a889
cmp dword [esi + 0xc], 0
jle 0x1001a889
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x24]
jmp 0x1001a88b
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100461c3
mov esp, ebp
pop ebp
ret
Function at 0x1001a8c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], 0
test edi, edi
jne 0x1001a8f8
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x1001a90c
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x1001a93a
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov esi, dword [ebx]
xor edx, edx
push eax
mov ecx, dword [esi + 0x24]
cmp ecx, dword [edi + 8]
cmove ecx, edx
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ac00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae43d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test ebx, ebx
jne 0x1001ac53
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x1001ac67
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x1001aca1
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x58], eax
jne 0x1001aca1
xor edi, edi
jmp 0x1001acd2
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x1001acd2
push esi
mov ecx, ebx
call fcn.1001bd60
mov ecx, dword [ebx + 8]
mov esi, eax
push ecx
push esi
push dword [ecx + 0x20]
mov ecx, ebx
call fcn.1001bd80
inc dword [ebx + 0xc]
test edi, edi
cmove edi, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x1001aca8
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ba10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae47d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x54]
test esi, esi
jne 0x1001ba5d
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x1001ba71
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x1001baab
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x58], eax
jne 0x1001baab
xor edi, edi
jmp 0x1001bad9
mov ebx, dword [ebp + 8]
cmp ebx, dword [esi + 0xc]
cmovge ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x1001bad9
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov ecx, esi
push dword [eax + 0x24]
call fcn.1001bda0
test eax, eax
je 0x1001bad9
dec dword [esi + 0xc]
inc edi
cmp edi, ebx
jl 0x1001bac0
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4

Function at 0x1001e150
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x1001e17c
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4
movzx eax, word [0x100b5d9c]
mov word [ebp - 0x10], ax
mov al, byte [0x100b5d9e]
push ebx
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov byte [ebp - 8], 0
call dword [sym.imp.USER32.dll_CharToOemA]
movsx eax, byte [ebp - 0x10]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ebx, dword [ebp + 8]
push 0
push ebx
movzx edi, al
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov eax, edi
or eax, 1
push eax
push ebx
push 0x100
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x1001e212
or edi, 0xc0000001
push edi
push ebx
push 0x101
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x1001e212
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4
Function at 0x10020520
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
push esi
push edi
test ebx, ebx
jne 0x10020555
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x10020569
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov edi, eax
mov dword [ebp - 0x50], edi
jne 0x1002059d
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x50]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x4c], eax
je 0x100205ca
mov eax, dword [ebx + 4]
mov ebx, dword [ebx + 8]
mov esi, dword [eax + 0x440c]
cmp esi, ebx
je 0x100205ca
nop dword [eax]
push dword [ebp + 8]
push esi
call fcn.10020fc0
add esp, 8
test eax, eax
jne 0x100205cc
mov esi, dword [esi + 0x440c]
cmp esi, ebx
jne 0x100205b0
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4

Function at 0x10020600
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
test esi, esi
jne 0x10020633
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x10020647
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov ecx, eax
mov dword [ebp - 0x50], ecx
jne 0x1002067b
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x50]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x4c], eax
je 0x1002068c
cmp dword [esi + 0xc], 0
jle 0x1002068c
mov eax, dword [esi + 4]
mov esi, dword [eax + 0x440c]
jmp 0x1002068e
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100461c3
mov esp, ebp
pop ebp
ret
Function at 0x100206c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], 0
test edi, edi
jne 0x100206f8
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x1002070c
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x1002073a
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov esi, dword [ebx]
xor edx, edx
push eax
mov ecx, dword [esi + 0x440c]
cmp ecx, dword [edi + 8]
cmove ecx, edx
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4

Function at 0x10020780
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae50d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test edi, edi
jne 0x100207d3
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x100207e7
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10020821
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x58], eax
jne 0x10020821
xor esi, esi
jmp 0x10020860
cmp dword [ebp + 0xc], 0
mov ebx, dword [edi + 4]
jle 0x10020857
nop word [eax + eax]
push esi
mov ecx, edi
call fcn.10020f50
push dword [ebx + 0x440c]
mov esi, eax
mov ecx, edi
push esi
push ebx
call fcn.10020fd0
inc dword [edi + 0xc]
mov ebx, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x10020830
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x440c]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 8
Function at 0x100208a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae54d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test ebx, ebx
jne 0x100208f3
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x10020907
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10020941
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x58], eax
jne 0x10020941
xor edi, edi
jmp 0x10020975
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x10020975
push esi
mov ecx, ebx
call fcn.10020f50
mov ecx, dword [ebx + 8]
mov esi, eax
push ecx
push esi
push dword [ecx + 0x4408]
mov ecx, ebx
call fcn.10020fd0
inc dword [ebx + 0xc]
test edi, edi
cmove edi, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x10020948
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 8
Function at 0x10020a80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae58d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], 0
test esi, esi
jne 0x10020ad3
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x10020ae7
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10020b1d
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x58], eax
je 0x10020b5f
mov ebx, dword [ebx]
mov ecx, esi
push ebx
call fcn.10020f80
test eax, eax
je 0x10020b5f
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x10020b44
sub eax, 1
je 0x10020b3c
xor edi, edi
jmp 0x10020b4a
mov edi, dword [ebx + 0x440c]
jmp 0x10020b4a
mov edi, dword [ebx + 0x4408]
push ebx
mov ecx, esi
call fcn.10021000
test eax, eax
jne 0x10020b9a
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
xor esi, esi
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 8
dec dword [esi + 0xc]
cmp edi, dword [esi + 4]
je 0x10020ba7
cmp edi, dword [esi + 8]
jne 0x10020ba9
xor edi, edi
mov eax, dword [ebp - 0x60]
mov esi, 1
mov dword [eax], edi
jmp 0x10020b61
Function at 0x10020c70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae5cd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x54]
test esi, esi
jne 0x10020cbd
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x10020cd1
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10020d0b
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x58], eax
jne 0x10020d0b
xor edi, edi
jmp 0x10020d3c
mov ebx, dword [ebp + 8]
cmp ebx, dword [esi + 0xc]
cmovge ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x10020d3c
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov ecx, esi
push dword [eax + 0x440c]
call fcn.10021000
test eax, eax
je 0x10020d3c
dec dword [esi + 0xc]
inc edi
cmp edi, ebx
jl 0x10020d20
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100461c3
mov esp, ebp
pop ebp
ret 4

Function at 0x10020dd0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100cf3f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x10020e0b
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.10075082
add esp, 0xc
jmp 0x10020e1f
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005700
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x10020e4e
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x4c], eax
je 0x10020e5a
push edi
mov ecx, esi
call fcn.10020f80
test eax, eax
jne 0x10020e5e
xor esi, esi
jmp 0x10020e72
push 0x4408
push ebx
push edi
call fcn.100480e0
add esp, 0xc
mov esi, 1
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100461c3
mov esp, ebp
pop ebp
ret 8