joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a4c8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45a4df
add esp, 0xfffffff0
call fcn.00403df8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420b34
mov eax, dword [0x4991cc]
cmp word [eax + 2], 0
jne 0x45a507
mov eax, dword [0x4991cc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bbb8
mov eax, dword [0x499320]
cmp word [eax + 2], 0
jne 0x45a521
mov eax, dword [0x499320]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045bdb0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417618]
call fcn.00403aa4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417618]
call fcn.00403aa4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423118]
call fcn.0042aa2c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45a6a8
mov eax, dword [0x499050]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042adfc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45c360
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x499050]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e648
test eax, eax
je 0x45a616
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004099a4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e670
test eax, eax
je 0x45a62a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404b38
mov eax, dword [0x498dd8]
cmp byte [eax], 0
jne 0x45a65e
mov eax, ebx
call fcn.0045a7d0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045c53c
mov eax, ebx
call fcn.0045cf00
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45a69e
call fcn.00403e50
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45aa50
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49abe4]
cmp dword [eax + 0x30], 0
je 0x45aafa
cmp dword [ebx + 0x94], 0
jne 0x45aaf4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45a9e0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45aaf4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45aaba
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45aaf4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419d04
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45aac9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b65c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b691
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049b8
jmp 0x45b69e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040491c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c718
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c759
mov eax, esi
call fcn.00442e10
test al, al
je 0x45c759
mov eax, dword [ebx + 0x84]
call fcn.00442b0c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c759
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442b0c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45d474
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416bb0]
call fcn.004052a8
xor eax, eax
push ebp
push 0x45d5b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x497f98], 0
jne 0x45d4c7
mov ecx, dword [0x498e04]
mov dl, 1
mov eax, dword [0x407d6c]
call fcn.0040d834
call fcn.00404260
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403170
mov eax, ebx
call fcn.00405158
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45d5c8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004063bc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405168
test eax, eax
jle 0x45d55f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45d558
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404b50
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404b38
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408c9c
test eax, eax
jne 0x45d558
mov ebx, 0x15
jmp 0x45d564
mov ebx, 0x10
jmp 0x45d564
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x497f98]
call fcn.0045d370
mov eax, dword [ebp - 8]
call fcn.0045d370
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004063d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d5bf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004048ec
lea eax, [ebp - 0x10]
mov edx, dword [0x416bb0]
call fcn.00405378
ret
Function at 0x480560
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x480568
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48075a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x480770
mov eax, esi
call fcn.0046ceb4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040491c
lea ecx, [ebp - 0x10]
mov edx, 0x480784
mov eax, esi
call fcn.0046ceb4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040491c
lea ecx, [ebp - 0x14]
mov edx, 0x48079c
mov eax, esi
call fcn.0046ceb4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040491c
lea ecx, [ebp - 0x18]
mov edx, 0x4807b8
mov eax, esi
call fcn.0046ceb4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040491c
lea ecx, [ebp - 0x1c]
mov edx, 0x4807d4
mov eax, esi
call fcn.0046ceb4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040491c
lea ecx, [ebp - 0x24]
mov edx, 0x4807ec
mov eax, esi
call fcn.0046ceb4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408d0c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409378
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x480804
mov eax, esi
call fcn.0046ceb4
mov eax, dword [ebp - 0x28]
call fcn.0046a66c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x480814
mov eax, esi
call fcn.0046ceb4
mov eax, dword [ebp - 0x2c]
call fcn.0046a66c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48082c
mov eax, esi
call fcn.0046ceb4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409378
inc eax
je 0x4806fd
lea ecx, [ebp - 0x34]
mov edx, 0x48082c
mov eax, esi
call fcn.0046ceb4
mov eax, dword [ebp - 0x34]
call fcn.0040933c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a950
fstp qword [ebp - 0x3c]
wait
call fcn.0040ace0
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x480718
lea ecx, [ebp - 0x40]
mov edx, 0x48082c
mov eax, esi
call fcn.0046ceb4
mov eax, dword [ebp - 0x40]
call fcn.0046a66c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48083c
mov eax, esi
call fcn.0046ceb4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040491c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480761
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048ec
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048ec
ret
Function at 0x4878fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x487956
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004878ec
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00468f58
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00468b58
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48795d
lea eax, [ebp - 4]
call fcn.004048c8
ret

Function at 0x48cf00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x4992e0]
mov eax, dword [eax]
call fcn.0045b90c
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x48cf28
cmp ebx, eax
jle 0x48cf0b
pop esi
pop ebx
ret

Function at 0x494880
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x4992e0]
mov eax, dword [eax]
call fcn.0045b90c
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x4948a8
cmp ebx, eax
jle 0x49488b
pop esi
pop ebx
ret

Function at 0x494c4c
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d78
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x494d39
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
push edi
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027b4
mov ebx, eax
cmp dword [edi], 0
jbe 0x494c96
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x494d0c
mov eax, dword [ebx + 0xc]
and eax, 1
cmp eax, 1
jne 0x494cbb
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 4]
call fcn.00404ac0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404ecc
test eax, eax
jle 0x494cd8
mov eax, dword [ebp - 0xc]
call fcn.00404d88
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [edi]
mov eax, ebx
call fcn.004027d4
xor eax, eax
mov dword [edi], eax
push edi
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [edi]
call fcn.004027b4
mov ebx, eax
cmp dword [edi], 0
jbe 0x494d00
mov eax, dword [edi]
mov dword [ebx], eax
push edi
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x494ca5
mov edx, dword [edi]
mov eax, ebx
call fcn.004027d4
push esi
call sub.wininet.dll_FindCloseUrlCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494d40
lea eax, [ebp - 0xc]
call fcn.004048c8
lea eax, [ebp - 4]
call fcn.004048c8
ret
Function at 0x4951d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4952a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor edx, edx
push ebp
push 0x49527f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0049570c
mov ecx, 0x4952c4
mov edx, dword [ebp - 0xc]
mov eax, dword [0x49b6e0]
call fcn.0048b124
mov ebx, eax
test ebx, ebx
jle 0x495275
mov esi, 1
push esi
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4952c4
mov edx, dword [ebp - 0xc]
mov eax, dword [0x49b6e0]
call fcn.0048b028
mov eax, dword [ebp - 0x10]
call fcn.0040933c
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
inc esi
dec ebx
jne 0x49523a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49528d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4952af
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004048ec
ret
Function at 0x18001509
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
lea edi, [esp + 0x30]
mov eax, ebp
call fcn.18002195
mov edi, dword [esp + 0x30]
cmp dword [edi - 0xc], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
je 0x180015e1
push edi
push 1
push str.EnableLogging
mov esi, str.LoggingSettings
push esi
call ebx
push edi
push 1
test eax, eax
push str.ShowTime
setne al
push esi
mov byte [ebp + 0x7c], al
call ebx
push edi
push 0
test eax, eax
push str.LogToFile
setne al
push esi
mov byte [ebp + 0x7e], al
call ebx
push edi
push 0
test eax, eax
push str.LogToOutputDebug
setne al
push esi
mov byte [ebp + 0x7f], al
call ebx
push edi
push 1
test eax, eax
push str.AppendToFile
setne al
push esi
mov byte [ebp + 0x84], al
call ebx
test eax, eax
setne al
mov byte [ebp + 0x85], al
push 0x104
lea eax, [ebp + 0x80]
lea edi, [esp + 0x24]
call fcn.18002b40
push dword [esp + 0x30]
push 0x104
push dword [eax + 4]
push str.CatalinaUpdate.log
push str.LogFilePath
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
call fcn.18003bbe
mov edi, dword [esp + 0x30]
jmp 0x1800160c
push str.CatalinaUpdate.log
lea eax, [ebp + 0x80]
push eax
mov byte [ebp + 0x7c], 1
mov byte [ebp + 0x7e], 1
mov byte [ebp + 0x7f], 0
mov byte [ebp + 0x84], 0
mov byte [ebp + 0x85], 1
call fcn.18003dfb
cmp byte [ebp + 0x7d], 0
je 0x18001616
mov byte [ebp + 0x7e], 1
xor eax, eax
mov byte [ebp], 1
mov dword [ebp + 4], 7
mov dword [esp + 0x10], eax
mov ecx, dword [eax + 0x180b0b60]
mov edx, dword [eax + 0x180b0b64]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x1800168d
cmp edx, 0xb
jge 0x1800168d
xor esi, esi
lea edi, [esp + 0x14]
mov eax, ebp
inc esi
call fcn.18002195
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], 0
je 0x1800166b
push edi
push esi
push dword [esp + 0x20]
push str.LoggingLevel
call ebx
mov esi, eax
mov eax, dword [esp + 0x1c]
lea eax, [ebp + eax*8]
test esi, esi
setne cl
mov byte [eax], cl
mov dword [eax + 4], esi
lea eax, [edi - 0x10]
call fcn.18003e1e
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
add eax, 8
mov dword [esp + 0x10], eax
cmp eax, 0x50
jb 0x18001627
call fcn.18009b20
mov dword [ebp + 0x88], eax
lea eax, [edi - 0x10]
mov dword [ebp + 0x8c], edx
call fcn.18003e1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x180016bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x180b41a8]
push esi
mov ecx, 0x180b41a8
call dword [eax + 0xc]
add eax, 0x10
push 0x104
lea esi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.18003cf7
mov esi, eax
push esi
xor eax, eax
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x18001719
push 0x1809c304
mov eax, edi
call fcn.18003b93
or eax, 0xffffffff
lea esi, [ebp - 4]
call fcn.18003bbe
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.18003e1e
jmp 0x1800174f
push str.CatalinaGroupUpdateLog
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x180016f5
push ebx
mov ebx, dword [ebp - 4]
add ebx, 0xfffffff0
mov eax, ebx
call fcn.18003940
add eax, 0x10
mov dword [edi], eax
or eax, 0xffffffff
lea esi, [ebp - 4]
call fcn.18003bbe
mov eax, ebx
call fcn.18003e1e
pop ebx
mov eax, edi
pop esi
leave
ret

Function at 0x18001838
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebx + 0x7f], 0
je 0x18001909
cmp dword [ebx + 0xd4], 0
push esi
push edi
jne 0x180018f6
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.18001754
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x18001897
lea eax, [ebp - 8]
lea edi, [ebp - 0xc]
call fcn.1800a64d
mov edi, dword [ebp - 0xc]
push edi
call fcn.1800acf4
pop ecx
test al, al
jne 0x180018a1
push edi
call fcn.18004560
pop ecx
test eax, eax
jge 0x180018a1
lea eax, [edi - 0x10]
call fcn.18003e1e
lea eax, [esi - 0x10]
call fcn.18003e1e
jmp 0x18001907
mov al, byte [ebx + 0x85]
push 0x20
mov byte [ebp - 4], al
call fcn.18076e14
pop ecx
test eax, eax
je 0x180018c2
push esi
push eax
mov al, byte [ebp - 4]
call fcn.1800226b
jmp 0x180018c4
xor eax, eax
mov dword [ebx + 0xd4], eax
test eax, eax
jne 0x180018e6
push esi
push dword [ebx + 0x5c]
push str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
call fcn.180098e8
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [edi - 0x10]
call fcn.18003e1e
lea eax, [esi - 0x10]
call fcn.18003e1e
mov esi, dword [ebx + 0xd4]
test esi, esi
je 0x18001907
mov edx, ebx
call fcn.18002131
pop edi
pop esi
leave
ret

Function at 0x18001ac9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, 1
push esi
cmp byte [edi + 0x86], al
jne 0x18001b04
lea esi, [ebp - 4]
call fcn.1800124a
push dword [eax]
push str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
call fcn.180098e8
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.18003e1e
xor al, al
jmp 0x18001b27
cmp byte [edi + 0x58], al
je 0x18001b27
lea esi, [edi + 0x60]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 4]
mov ecx, edi
call fcn.180019d1
mov bl, al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov al, bl
pop ebx
pop esi
leave
ret
Function at 0x18001e45
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x18001f1b
cmp dword [ebp + 0xc], 0
jne 0x18001e68
cmp dword [ebp + 0x14], 2
jg 0x18001f1b
mov eax, dword [0x180b41a8]
mov esi, 0x180b41a8
mov ecx, esi
call dword [eax + 0xc]
mov edi, eax
mov eax, dword [0x180b41a8]
add edi, 0x10
mov ecx, esi
mov dword [ebp - 8], edi
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
mov ebx, eax
add ebx, 0x10
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 1
add esi, 0x60
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0xc]
test al, al
jne 0x18001ebe
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jle 0x18001e9e
jmp 0x18001ee8
push dword [ebp + 0x1c]
lea ecx, [ebp - 0xc]
push dword [ebp + 0x18]
lea edx, [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.18001d77
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 4], 0x14
jle 0x18001f0b
push str.LOG_SYSTEM:_Couldnt_acquire_lock__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x1809bf60
call esi
lea eax, [ebx - 0x10]
call fcn.18003e1e
lea eax, [edi - 0x10]
call fcn.18003e1e
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x1800226b
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, 0x180b41a8
mov ebx, 0x989680
lea esi, [ebp + 0xc]
mov ecx, edi
mov dword [ebp], fcn.18002409
mov dword [ebp + 4], ebx
mov byte [ebp + 8], 0
mov byte [ebp + 9], 0
mov byte [ebp + 0xa], al
mov byte [ebp + 0xb], 1
call fcn.18003998
push dword [esp + 0x18]
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x14]
call fcn.18003b93
and dword [ebp + 0x18], 0
lea esi, [ebp + 0x1c]
mov ecx, edi
call fcn.18003998
movzx esi, byte [0x180b5839]
neg esi
sbb esi, esi
and esi, 0x180b5ae0
je 0x18002334
lea edi, [esp + 0x14]
mov eax, esi
call fcn.18002195
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x18002316
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.MaxLogFileSize
mov edi, str.LoggingSettings
push edi
call ebx
push dword [esp + 0x14]
mov dword [ebp + 4], eax
push 1
push str.LogFileWide
push edi
call ebx
test eax, eax
setne al
mov byte [ebp + 0xb], al
jmp 0x1800231d
mov dword [ebp + 4], ebx
mov byte [ebp + 0xb], 1
lea eax, [esi + 0x5c]
lea edi, [ebp + 0x1c]
call fcn.180038ff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.18003e1e
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 8