joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x418ec0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x418ef2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x418eef
inc esi
cmp esi, edx
jb 0x418ee0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x41901c
cmp ecx, 3
jbe 0x418f32
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x418f70
cmp cl, 0xff
je 0x418f70
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x418ed4
dec ecx
shl eax, cl
and eax, 7
je 0x418f0a
movzx ecx, byte [eax + 0x59ae28]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x59ae20], 0
mov cl, byte [edx + 4]
je 0x418f5a
test cl, cl
je 0x418f5a
cmp cl, 0xff
jne 0x418f0a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x418ed4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x418f9e
lea edx, [edi + ebx]
add edx, esi
jmp 0x418fa4
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x418fe2
movzx edi, byte [eax + 0x59ae28]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x418fce
cmp cl, 0xff
jne 0x418fe2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x418f91
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x418ed4
pop edi
pop esi
cmp ecx, 3
jbe 0x419031
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bf10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.0041d3c0
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.0041d370
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.0041d410
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x41bf4c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x41bfa0
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x41bf90
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41bf90
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x41c320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5977e6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x61e0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x41c37a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x41c397
mov eax, dword [esi + 0x20]
jmp 0x41c39a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41c3b4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41c3ce
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x41c3e8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.0043dfbd
push eax
call fcn.0044a4a0
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0043afd0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x41c4a7
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.0043afd0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x41c498
test eax, eax
je 0x41c498
add eax, eax
cmp eax, 0x412
jae 0x41c493
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x41c49e
call fcn.0041b5e2
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.00402990
mov eax, dword [esi + 0x30]
test eax, eax
je 0x41c4d3
cmp dword [esi + 0x34], 8
jb 0x41c4b9
mov ecx, dword [esi + 0x20]
jmp 0x41c4bc
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x41c4d3
push 1
push 0x615b68
lea ecx, [esi + 0x20]
call fcn.00407140
cmp dword [esi + 0x30], 0
jne 0x41c4e8
push 3
push 0x59af60
lea ecx, [esi + 0x20]
call fcn.004029e0
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ae59
mov esp, ebp
pop ebp
ret
Function at 0x41c510
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x41c52c
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x41c525
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x41c549
push eax
call fcn.0041b120
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x41c55f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004030a0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41c575
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x41c590
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004030a0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41c5a6
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x41c5c1
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004030a0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41c5d7
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x41c5f2
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.004030a0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x41c608
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x41c622
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.004030a0
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x41c641
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x41dd90
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x41ddce
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41ddce
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x4205ff
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x597dcc
call fcn.00590558
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x42062a
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x420708
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x615ac8
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.004029e0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.0043afd0
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x615b30
push eax
call fcn.004078b0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x4206bd
call fcn.0042051b
jmp 0x4206c2
call fcn.004205d5
push eax
lea ecx, [ebp - 0x828]
call fcn.00402640
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.00402920
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0043deea
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00402920
mov eax, esi
call fcn.00590513
ret 0xc

Function at 0x420712
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x597e16
call fcn.00590558
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.0043afd0
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x42076f
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.004026c0
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4207b5
mov eax, dword [esi]
jmp 0x4207b7
mov eax, esi
push ebx
push eax
call fcn.0044a77b
pop ecx
pop ecx
test eax, eax
jne 0x420803
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x4207e7
call fcn.0042051b
jmp 0x4207ec
call fcn.004205d5
push eax
mov ecx, esi
call fcn.00402640
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00402920
mov eax, esi
call fcn.00590513
ret 0x10
Function at 0x4213b6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x61e0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.0043afd0
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4213ef
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x59c440
push eax
call fcn.004078b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421427
lea eax, [ebp - 0x20c]
push eax
call fcn.0042bb9f
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0043afd0
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x59c414
push eax
call fcn.004078b0
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x421466
mov eax, esi
jmp 0x421473
lea eax, [ebp - 0x414]
push eax
call fcn.0044a7dd
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.004029e0
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.0043afd0
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x59c414
push eax
call fcn.004078b0
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x4214c5
mov eax, esi
jmp 0x4214d2
lea eax, [ebp - 0x61c]
push eax
call fcn.0044a7dd
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.004029e0
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0043afd0
lea eax, [ebp - 0xa44]
push 0x615b4c
push eax
call fcn.0042c324
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x421513
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x59af68
push eax
call fcn.004078b0
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.00402920
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421554
lea eax, [ebp - 0x824]
push eax
call fcn.0042bb9f
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.0043afd0
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x59c414
push eax
call fcn.004078b0
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x42159e
lea eax, [ebp - 0xa2c]
push eax
call fcn.0044a7dd
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.004029e0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041ae59
mov esp, ebp
pop ebp
ret
Function at 0x421aff
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x597edb
call fcn.00590558
mov ebx, ecx
call fcn.004204b0
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.00402990
mov esi, str.WindowsResetMaster.ini
push esi
call fcn.0044a7dd
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00407140
push str.resetgf
push 0x59c4f0
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00420712
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00402640
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00402920
push str.resetgf
mov ecx, esi
call fcn.0042000b
test eax, eax
jne 0x421bee
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0043afd0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x421b9f
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.resetgf
push eax
push edi
push 0x59c4f0
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x421bd0
xor eax, eax
jmp 0x421bdd
lea eax, [ebp - 0x218]
push eax
call fcn.0044a7dd
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004029e0
jmp 0x421bf3
mov edi, str.resetgf
push edi
mov ecx, esi
call fcn.0042000b
test eax, eax
jne 0x421cb6
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0043afd0
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00402720
and dword [ebp - 4], 0
push str.WindowsResetMaster.ini
call fcn.0044a7dd
pop ecx
push eax
push str.WindowsResetMaster.ini
lea ecx, [ebp - 0x230]
call fcn.00407140
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x59c4f0
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x421c87
xor eax, eax
jmp 0x421c94
lea eax, [ebp - 0x218]
push eax
call fcn.0044a7dd
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004029e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push 1
call fcn.00402920
push edi
mov ecx, esi
call fcn.0042000b
test eax, eax
jne 0x421cf2
push edi
push 0x59c4f0
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004205ab
push eax
mov ecx, esi
call fcn.00402640
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00402920
call fcn.00590513
ret
Function at 0x422145
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597f54
mov eax, dword fs:[0]
push eax
mov eax, 0x122c
call fcn.0041b470
mov eax, dword [0x61e0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x1238], esi
cmp dword [0x623200], ebx
jne 0x422274
call fcn.0042b9fa
test al, al
je 0x4221ac
push edx
push ecx
pop ecx
pop ecx
push ecx
push esp
push esi
pop ebp
pop ebp
push ebp
pop ecx
pop eax
push ecx
push eax
push edi
push eax
pop ebx
pop ebx
push esp
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0043afd0
lea eax, [ebp - 0x218]
push str.C:LogResLog.dll
push eax
call fcn.0044a7bb
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42225a
cmp dword [0x61e0e8], 8
lea ecx, [ebp - 0x1231]
mov eax, 0x61e0d4
cmovae eax, dword [0x61e0d4]
push eax
lea eax, [ebp - 0x1230]
push eax
call fcn.00422085
mov edi, str.ResLog.dll
mov dword [ebp - 4], ebx
push edi
call fcn.0044a7dd
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1230]
call fcn.00407140
cmp dword [ebp - 0x121c], 8
lea eax, [ebp - 0x1230]
cmovae eax, dword [ebp - 0x1230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0044a7bb
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1230]
call fcn.00402920
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x623200], eax
test eax, eax
je 0x422352
push ebx
push 0x615ac8
mov ecx, esi
call fcn.004029e0
call fcn.0042b4db
test al, al
je 0x4222a3
pop ecx
pop eax
pop edx
pop esi
pop ebx
push edi
push esi
push esi
pop edx
pop eax
pop esp
push ebx
pop ecx
pop ebx
pop ebp
pop edx
push ebx
pop eax
pop eax
pop ebp
push eax
pop ebp
push esi
xor ebx, ebx
call fcn.0042b451
test al, al
je 0x4222bd
pop esi
push edx
push edx
pop edi
pop esi
pop eax
pop esi
push edi
push esi
pop edx
pop edi
push ebx
pop esp
push edi
pop ecx
push eax
pop edx
call fcn.0042b7d2
test al, al
je 0x4222e0
push edx
pop edi
push esp
push eax
push eax
pop esp
pop ebp
pop edi
pop eax
push edx
pop edx
push esi
push ecx
push eax
push edx
push ebp
pop edi
push ebx
pop edi
pop eax
push esi
pop edx
pop edx
pop esp
pop ebp
push edi
push 0x800
lea eax, [ebp - 0x1218]
push eax
push dword [ebp + 8]
push dword [0x623200]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x42232f
cmp word [ebp - 0x1218], 0
je 0x422318
lea eax, [ebp - 0x1218]
push eax
call fcn.0044a7dd
pop ecx
mov ebx, eax
push ebx
lea ecx, [ebp - 0x1218]
push ecx
mov ecx, dword [ebp - 0x1238]
call fcn.004029e0
mov al, 1
jmp 0x422354
call fcn.0042b970
test al, al
je 0x422352
push eax
push edi
pop edi
push ecx
pop ebx
push edi
pop edi
pop eax
pop esp
pop eax
pop edx
push eax
pop ebp
pop esp
pop ecx
push esi
pop edx
pop ebx
push edi
pop ebx
push eax
pop ecx
push ebx
pop edi
push esi
push eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ae59
mov esp, ebp
pop ebp
ret
Function at 0x422567
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.0041b470
mov eax, dword [0x61e0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2008], eax
call fcn.0041b858
test eax, eax
je 0x422730
xor ebx, ebx
push ebx
call fcn.0043dfbd
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.0044b415
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00422067
add esp, 0x28
call fcn.0042b970
test al, al
je 0x422618
push eax
push edi
pop edi
push ecx
pop ebx
push edi
pop edi
pop eax
pop esp
pop eax
pop edx
push eax
pop ebp
pop esp
pop ecx
push esi
pop edx
pop ebx
push edi
pop ebx
push eax
pop ecx
push ebx
pop edi
push esi
push eax
xor ebx, ebx
mov esi, dword [ebp - 0x2008]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
inc edi
test eax, eax
cmovne ebx, edi
call fcn.0042b9fa
test al, al
je 0x42264c
push ecx
push ebp
push eax
pop esp
pop ecx
push edx
pop esp
pop ebp
pop ecx
push esp
push ebx
push edx
pop edi
pop esp
pop ebp
pop edx
push edx
push ecx
pop ecx
xor edi, edi
inc edi
push 0x59c5ac
push esi
call fcn.004467fd
mov esi, eax
mov dword [ebp - 0x2010], esi
pop ecx
pop ecx
test esi, esi
je 0x422730
test ebx, ebx
jne 0x42268a
push esi
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push edi
push eax
call fcn.0044b133
add esp, 0x10
call fcn.0042b4db
test al, al
je 0x4226b6
pop ebp
push ebx
push edx
pop esp
push edi
push eax
pop edx
pop edi
pop edi
push edi
pop esp
pop ebp
pop ebp
push edx
push edi
pop eax
pop eax
push ebp
push ebp
pop edi
push esp
pop ebp
pop esi
pop eax
pop eax
push ebp
pop ebx
push ebx
pop ebp
mov esi, dword [ebp - 0x2010]
call fcn.0042b7d2
test al, al
je 0x4226d3
pop ebp
push ecx
pop eax
push ebp
push ecx
push edx
push esp
pop ebx
push ebp
push ebx
pop esp
push ebp
pop eax
push esi
pop ebp
push ebx
push edi
pop ebx
pop eax
pop edi
lea eax, [ebp - 0x2004]
push eax
call fcn.0044a7dd
push esi
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.0044b133
push esi
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.0044b133
push esi
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.0044b133
push esi
call fcn.004465fb
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ae59
mov esp, ebp
pop ebp
ret
Function at 0x4229ec
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
call fcn.0042b9fa
test al, al
je 0x422a0f
push edx
push ecx
pop ecx
pop ecx
push ecx
push esp
push esi
pop ebp
pop ebp
push ebp
pop ecx
pop eax
push ecx
push eax
push edi
push eax
pop ebx
pop ebx
push esp
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret 4