joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e90f
Capabilities:
Set thread local storage value

Disassembly:
push 0x34
mov eax, 0x47d8ce
call fcn.0043aeb9
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi]
call fcn.00412683
test eax, eax
je 0x42e944
and dword [ebp - 4], 0
push edi
push edi
call fcn.00429f5d
pop ecx
pop ecx
jmp 0x42ea1d
push edi
push 0x68
mov dword [ebp - 0x38], edi
call fcn.0040d36f
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 2
test ebx, ebx
je 0x42e9a7
lea esi, [ebx + 0x20]
mov dword [ebx + 0x14], eax
push edi
mov ecx, esi
mov dword [ebx + 0x18], fcn.0042ed78
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x1c], eax
mov dword [ebp - 0x28], esi
call fcn.0041bdbd
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov esi, dword [ebp - 0x24]
jmp 0x42e9a9
mov ebx, eax
mov ecx, dword [ebp - 0x20]
push ebx
push esi
mov byte [ebp - 4], 1
call fcn.0040f53f
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
test al, al
je 0x42ea15
push dword [esi]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412652
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.0043c180
push 0
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [edi + 0x14]
call fcn.0042ed78
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0040f320
push dword [ebp - 0x14]
push dword [0x4ab27c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x38]
call fcn.0042ee7d
call fcn.0043ae63
ret 8
Function at 0x42ea25
Capabilities:
Set thread local storage value

Disassembly:
push 0x2c
mov eax, 0x47d91e
call fcn.0043aeb9
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx]
call fcn.00412683
test eax, eax
je 0x42ea57
and dword [ebp - 4], 0
push edi
push edi
call fcn.0042f247
pop ecx
pop ecx
jmp 0x42eb1e
mov ecx, dword [edi]
push 0xf0
mov dword [ebp - 0x38], edi
call fcn.0040fa36
mov esi, eax
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x42eaa8
push edi
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], fcn.0042ecd6
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], eax
call fcn.0042eef9
jmp 0x42eaaa
mov esi, eax
push esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
push ebx
call fcn.0040f53f
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
test al, al
je 0x42eb16
push dword [ebx]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412652
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.0043c180
push 0
lea eax, [ebp - 0x24]
push eax
push esi
push dword [edi + 0x14]
call fcn.0042ecd6
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0040f320
push dword [ebp - 0x14]
push dword [0x4ab27c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x38]
call fcn.0042ee42
call fcn.0043ae63
ret 8
Function at 0x42eb26
Capabilities:
Set thread local storage value

Disassembly:
push 0x2c
mov eax, 0x47d96e
call fcn.0043aeb9
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx]
call fcn.00412683
test eax, eax
je 0x42eb58
and dword [ebp - 4], 0
push edi
push edi
call fcn.0042f263
pop ecx
pop ecx
jmp 0x42ec1f
mov ecx, dword [edi]
push 0xe0
mov dword [ebp - 0x38], edi
call fcn.0040fa36
mov esi, eax
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x42eba9
push edi
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], fcn.0042ec2c
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], eax
call fcn.0042eeae
jmp 0x42ebab
mov esi, eax
push esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
push ebx
call fcn.0040f53f
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
test al, al
je 0x42ec17
push dword [ebx]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412652
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 4
call fcn.0043c180
push 0
lea eax, [ebp - 0x24]
push eax
push esi
push dword [edi + 0x14]
call fcn.0042ec2c
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0040f320
push dword [ebp - 0x14]
push dword [0x4ab27c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x38]
call fcn.0042edfa
call fcn.0043ae63
ret 8
Function at 0x42ef54
Capabilities:
Set thread local storage value

Disassembly:
push 0x34
mov eax, 0x47dac4
call fcn.0043aeb9
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], esi
mov ecx, dword [esi]
call fcn.00412683
test eax, eax
je 0x42ef89
and dword [ebp - 4], 0
push edi
push edi
call fcn.0042c538
pop ecx
pop ecx
jmp 0x42f06a
push edi
push 0x70
mov dword [ebp - 0x38], edi
call fcn.0040d36f
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 2
test ebx, ebx
je 0x42eff4
lea esi, [ebx + 0x20]
mov dword [ebx + 0x14], eax
mov dword [ebx], eax
lea ecx, [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x18], fcn.0042f077
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
mov dword [esi], eax
lea eax, [edi + 8]
push eax
call fcn.0041fd91
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov esi, dword [ebp - 0x2c]
jmp 0x42eff6
mov ebx, eax
mov ecx, dword [ebp - 0x20]
push ebx
push esi
mov byte [ebp - 4], 1
call fcn.0040f53f
and dword [ebp - 0x30], 0
and dword [ebp - 0x34], 0
test al, al
je 0x42f062
push dword [esi]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412652
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [esi]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 4
call fcn.0043c180
push 0
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [edi + 0x14]
call fcn.0042f077
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040f320
push dword [ebp - 0x14]
push dword [0x4ab27c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x38]
call fcn.0042f101
call fcn.0043ae63
ret 8
Function at 0x42f164
Capabilities:
Set thread local storage value

Disassembly:
push 0x2c
mov eax, 0x47db4e
call fcn.0043aeb9
mov edi, ecx
mov dword [ebp - 0x34], edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebx]
call fcn.00412683
test eax, eax
je 0x42f198
and dword [ebp - 4], 0
push esi
push esi
call fcn.0042dba9
pop ecx
pop ecx
jmp 0x42f23f
push esi
push 0x48
mov dword [ebp - 0x30], esi
call fcn.0040d36f
and dword [ebp - 0x28], 0
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x42f1ca
push esi
mov ecx, eax
call fcn.0042a664
mov esi, eax
jmp 0x42f1cc
xor esi, esi
push esi
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040f53f
and dword [ebp - 0x28], 0
and dword [ebp - 0x2c], 0
test al, al
je 0x42f237
push dword [ebx]
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412652
mov edi, dword [ebp - 0x34]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 4
call fcn.0043c180
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [edi + 0x14]
call fcn.0042adc3
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.0040f320
push dword [ebp - 0x14]
push dword [0x4ab27c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.0042ad92
call fcn.0043ae63
ret 8

Function at 0x43dc65
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x46a343
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046a1c2

Function at 0x46d899
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046d559
Function at 0x4f1f58
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404c24
xor eax, eax
push ebp
push 0x4f2051
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ee048
test al, al
je 0x4f2025
xor eax, eax
push ebp
push 0x4f1fc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004eeaa4
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.004094dc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f1fd1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ee74c
test al, al
jne 0x4f1fff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
push eax
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3200], 0
je 0x4f203b
cmp dword [ebp + 8], 0x20
je 0x4f203b
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c34
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
jmp 0x4f203b
mov eax, dword [ebp - 4]
add eax, 0x4d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3208]
call fcn.004047d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2058
lea eax, [ebp - 0xc]
call fcn.00404784
ret

Function at 0x4f26e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x4f272c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
xor eax, edx
and eax, 0xff
mov edx, dword [0x50ca40]
movzx eax, word [edx + eax*2]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 8
xor eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
inc dword [ebp - 4]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jg 0x4f26f5
mov esp, ebp
pop ebp
ret
Function at 0x10006a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053e3d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10071074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x5c
call fcn.1001f78c
mov ebx, eax
mov dword [ebp - 0x14], ebx
push 0x50
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
push 0
push edi
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], vtable.std::_Ref_count_obj_struct_FileInfo_.0
mov dword [ebp - 0x18], edi
call fcn.10031a30
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
add esp, 0x10
mov word [edi], ax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 7
mov word [edi + 0x30], ax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.10007a30
mov dword [esi], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053f60
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10071074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.100080e0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.10006500
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10008e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10008e99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008e99
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10008e8a
cmp esi, edx
jae 0x10008e99
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10008e78
cmp esi, edx
jae 0x10008e99
cmp word [esi], 0
je 0x10008e99
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10013bf0
Capabilities:
Check for peb beingdebugged flag
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055047
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10071074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], esi
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 7
mov word [esi + 0x30], ax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], 7
mov word [esi + 0x48], ax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 7
mov word [esi + 0x60], ax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 7
mov word [esi + 0x78], ax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], 7
mov word [esi + 0x90], ax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], 7
mov word [esi + 0xa8], ax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], 7
mov word [esi + 0xc0], ax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], 7
mov word [esi + 0xd8], ax
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], 7
mov word [esi + 0xf0], ax
mov dword [esi + 0x118], eax
mov dword [esi + 0x11c], 7
mov word [esi + 0x108], ax
push 0x208
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xb
push eax
call fcn.10031a30
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10013d50
sub edx, ecx
lea eax, [ebp - 0x218]
sar edx, 1
lea ecx, [esi + 0x108]
push edx
push eax
call fcn.10006820
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f4ee
mov esp, ebp
pop ebp
ret
Function at 0x10014bd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x10071074]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0xc0]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10014cc0
cmp dword [esp + 0x18], 0
je 0x10014c64
cmp dword [esi + 0x40], 0
je 0x10014c64
push 0x208
lea eax, [esp + 0x24]
push 0
push eax
call fcn.10031a30
add esp, 0xc
lea eax, [esp + 8]
cmp dword [esp + 0x1c], 8
cmovae eax, dword [esp + 8]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esi, 0x30
cmp dword [esi + 0x14], 8
jb 0x10014c45
mov esi, dword [esi]
push esi
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10014c64
mov bl, 1
jmp 0x10014c66
xor bl, bl
mov edx, dword [esp + 0x1c]
cmp edx, 8
jb 0x10014c9e
mov ecx, dword [esp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10014c94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10014cb4
push edx
push ecx
call fcn.1001fb02
add esp, 8
mov ecx, dword [esp + 0x22c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.1001f4ee
mov esp, ebp
pop ebp
ret
call fcn.10037731
int3
Function at 0x1001d680
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055b3a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10071074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10002410
mov ecx, eax
test ecx, ecx
je 0x1001d844
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10002410
mov ecx, eax
test ecx, ecx
je 0x1001d84e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10002410
mov ecx, eax
test ecx, ecx
je 0x1001d858
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x1001d762
xor ecx, ecx
jmp 0x1001d780
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d770
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10010fc0
push edi
mov ecx, ebx
call fcn.1001d940
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1001d79c
xor ecx, ecx
jmp 0x1001d7b4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d7a4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10010fc0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1001e3c0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1001d940
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001d7f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1001d82e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001d82e
cmp dword [esi + 0x10], 0
je 0x1001d825
push dword [edi]
call fcn.1003d210
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10008d60
push 0x80004005
call fcn.10008d60
push 0x80004005
call fcn.10008d60
int3
Function at 0x1001e1c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055c58
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10071074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001e394
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001e215
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1001e394
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001e233
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1001e394
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001e251
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1001e394
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001e26f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1001e394
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001e394
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001e294
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1001e2c7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1001e2df
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1001e31d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10004110
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.10030f30
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x1005a564
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10010ad0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001e34b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1001e384
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1001e384
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.100064b0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10002c10
lea ecx, [ebp - 0x28]
call fcn.10002c10
lea ecx, [ebp - 0x34]
call fcn.1001d910
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f4ee
mov esp, ebp
pop ebp
ret 4