joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d940
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d97b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x220], esi
call fcn.00509f10
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x42da2a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x42d9df
movzx eax, ax
mov ecx, esi
push eax
call fcn.0040cd70
jmp 0x42da0e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d9f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00412300
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409540
int3
Function at 0x42dad0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00509f10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x54a1b8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42dca3
mov dword [ebp - 4], 0
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x42dcbe
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 4], 1
jge 0x42dbb0
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.0040d570
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 8], 0x104
lea edi, [esi - 0x10]
jl 0x42dcc8
xor eax, eax
mov dword [edi + 4], 0x104
mov word [esi + 0x208], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
push esi
push 0x549970
push str.state
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [edi + 8]
push esi
call fcn.00519195
add esp, 8
test eax, eax
js 0x42dcc8
cmp eax, dword [edi + 8]
jg 0x42dcc8
xor ecx, ecx
mov dword [edi + 4], eax
mov word [esi + eax*2], cx
mov ecx, str.AnyUpdate
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42dc46
test dx, dx
je 0x42dc42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42dc46
add eax, 4
add ecx, 4
test dx, dx
jne 0x42dc20
xor eax, eax
jmp 0x42dc4b
sbb eax, eax
or eax, 1
test eax, eax
je 0x42dc87
mov eax, str.bigupdate
mov cx, word [esi]
cmp cx, word [eax]
jne 0x42dc7a
test cx, cx
je 0x42dc76
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x42dc7a
add esi, 4
add eax, 4
test cx, cx
jne 0x42dc54
xor eax, eax
jmp 0x42dc7f
sbb eax, eax
or eax, 1
test eax, eax
je 0x42dc87
xor esi, esi
jmp 0x42dc8c
mov esi, 1
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42dca1
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409540
push 0x80070057
call fcn.00409540
int3
Function at 0x42dce0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.00509f10
add esp, 0xc
cmp word [0x595d00], 0
jne 0x42dd34
push 0x104
push 0x595d00
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x595d00
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
push 0x595d00
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00439eb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret

Function at 0x42dea0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00509f10
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42df00
cmp dword [ebp - 0x114], 6
jb 0x42df00
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret

Function at 0x42e0d0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e0ff
push 5
push 0
push 0
push dword [ebp + 8]
push 0x54a090
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x42e0ff
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x42e5a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5815b8
push 0x50a0b0
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x58f574]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.00509f10
push edi
push str.SYSTEMCurrentControlSetServices_sParameters
push 0xff
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x430]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x42c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e6b9
mov dword [ebp - 0x438], eax
push 0x210
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00509f10
add esp, 0xc
mov dword [ebp - 0x434], 0x210
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push str.ServiceDll
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e6b9
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jle 0x42e6b9
push ecx
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 4], 0xfffffffe
call fcn.0042e6eb
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ef50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dbd6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x220], edi
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x42f0b1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov eax, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x42efc5
movzx eax, ax
push eax
call fcn.0040cd70
jmp 0x42efd1
push 0x39
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
call fcn.00412300
push esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.0042c170
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push 0
push eax
push 0
push 0x20206
push 0
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42f06b
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00509f10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x42f06b
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 1
cmove edi, ecx
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x42f07c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42f094
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409540
int3
Function at 0x4301e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dcd9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58f574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 0
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
shl ebx, 0x10
mov dword [ebp + 0xc], ebx
cmp esi, 0x2d
je 0x430243
cmp esi, 0x2e
je 0x430243
cmp esi, 0x90
je 0x430243
cmp esi, 0x21
jb 0x43023d
cmp esi, 0x28
jbe 0x430243
cmp dword [ebp + 0x10], 0
je 0x43024c
or ebx, 0x1000000
mov dword [ebp + 0xc], ebx
mov dword [ebp - 4], 1
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x43031b
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov esi, 0x40
mov dword [ebp - 0x10], 1
add esi, esi
js 0x430311
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x4302a5
push esi
mov ecx, edi
call fcn.0040d570
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x430311
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
mov word [eax + esi*2], dx
lea eax, [esi + 1]
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4302e0
mov ecx, dword [edi]
test ecx, ecx
jne 0x4302d4
xor eax, eax
jmp 0x4302e4
push dword [ecx - 8]
push ecx
call fcn.00519195
add esp, 8
test eax, eax
js 0x430311
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x430311
mov dword [ecx - 0xc], eax
xor edx, edx
mov ecx, dword [edi]
cmp ebx, esi
mov ebx, dword [ebp + 0xc]
mov word [ecx + eax*2], dx
je 0x430282
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
int3
Function at 0x431bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x118], 0x740068
push edi
mov dword [ebp - 0x114], 0x700074
mov dword [ebp - 0x110], 0x2f003a
mov dword [ebp - 0x10c], 0x73002f
mov dword [ebp - 0x108], 0x35002e
mov dword [ebp - 0x104], 0x740032
mov dword [ebp - 0x100], 0x6f006f
mov dword [ebp - 0xfc], 0x62006c
mov dword [ebp - 0xf8], 0x78006f
mov dword [ebp - 0xf4], 0x63002e
mov dword [ebp - 0xf0], 0x6d006f
mov dword [ebp - 0xec], 0x61002f
mov dword [ebp - 0xe8], 0x79006e
mov dword [ebp - 0xe4], 0x650073
mov dword [ebp - 0xe0], 0x720061
mov dword [ebp - 0xdc], 0x680063
mov dword [ebp - 0xd8], 0x61003f
mov dword [ebp - 0xd4], 0x700070
mov dword [ebp - 0xd0], 0x61003d
mov dword [ebp - 0xcc], 0x79006e
mov dword [ebp - 0xc8], 0x650073
mov dword [ebp - 0xc4], 0x720061
mov dword [ebp - 0xc0], 0x680063
mov dword [ebp - 0xbc], 0x700026
mov dword [ebp - 0xb8], 0x640069
mov dword [ebp - 0xb4], 0x7b003d
mov dword [ebp - 0xb0], 0x690070
mov dword [ebp - 0xac], 0x7d0064
mov dword [ebp - 0xa8], 0x6d0026
mov dword [ebp - 0xa4], 0x640069
mov dword [ebp - 0xa0], 0x7b003d
mov dword [ebp - 0x9c], 0x69006d
mov dword [ebp - 0x98], 0x7d0064
mov dword [ebp - 0x94], 0x6d0026
mov dword [ebp - 0x90], 0x640069
mov dword [ebp - 0x8c], 0x3d0032
mov dword [ebp - 0x88], 0x6d007b
mov dword [ebp - 0x84], 0x640069
mov dword [ebp - 0x80], 0x7d0032
mov dword [ebp - 0x7c], 0x610026
mov dword [ebp - 0x78], 0x700070
mov dword [ebp - 0x74], 0x650076
mov dword [ebp - 0x70], 0x3d0072
mov dword [ebp - 0x6c], 0x61007b
mov dword [ebp - 0x68], 0x700070
mov dword [ebp - 0x64], 0x650076
mov dword [ebp - 0x60], 0x7d0072
mov dword [ebp - 0x5c], 0x6d0026
mov dword [ebp - 0x58], 0x64006f
mov dword [ebp - 0x54], 0x650076
mov dword [ebp - 0x50], 0x3d0072
mov dword [ebp - 0x4c], 0x6d007b
mov dword [ebp - 0x48], 0x64006f
mov dword [ebp - 0x44], 0x650076
mov dword [ebp - 0x40], 0x7d0072
mov dword [ebp - 0x3c], 0x740026
mov dword [ebp - 0x38], 0x700079
mov dword [ebp - 0x34], 0x3d0065
mov dword [ebp - 0x30], 0x74007b
mov dword [ebp - 0x2c], 0x700079
mov dword [ebp - 0x28], 0x7d0065
mov dword [ebp - 0x24], 0x610026
mov dword [ebp - 0x20], 0x740063
mov dword [ebp - 0x1c], 0x6f0069
mov dword [ebp - 0x18], 0x3d006e
mov dword [ebp - 0x14], 0x61007b
mov dword [ebp - 0x10], 0x740063
mov dword [ebp - 0xc], 0x6f0069
mov dword [ebp - 8], 0x7d006e
mov word [ebp - 4], ax
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x431ec4
mov eax, dword [ecx]
push 2
push 0x8a
call dword [eax]
test eax, eax
je 0x431ece
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x8a
jl 0x431eba
mov dword [eax - 0xc], 0x8a
xor eax, eax
mov ecx, dword [esi]
push 0x8a
mov word [ecx + 0x114], ax
lea eax, [ebp - 0x118]
push eax
push 0x8a
push dword [esi]
call fcn.004119b0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00409540
push 0x80004005
call fcn.00409540
call fcn.0040d7f0
int3
Function at 0x438e70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e38a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58f574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x439034
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x43903e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.0040c500
mov ecx, eax
test ecx, ecx
je 0x439048
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x438f52
xor ecx, ecx
jmp 0x438f70
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438f60
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00412300
push edi
mov ecx, ebx
call fcn.00422c80
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x438f8c
xor ecx, ecx
jmp 0x438fa4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438f94
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00412300
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00439930
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00422c80
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x438fe5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x43901e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43901e
cmp dword [esi + 0x10], 0
je 0x439015
push dword [edi]
call fcn.0051d46c
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00409540
push 0x80004005
call fcn.00409540
push 0x80004005
call fcn.00409540
int3
Function at 0x439730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e478
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x439904
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439785
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x439904
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4397a3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x439904
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4397c1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x439904
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4397df
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x439904
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x439904
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x439804
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x439837
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x43984f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x43988d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.0040f020
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.00509410
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x550b4c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043a0e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4398bb
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x4398f4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4398f4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00406c40
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00407a40
lea ecx, [ebp - 0x28]
call fcn.00407a40
lea ecx, [ebp - 0x34]
call fcn.00439080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret 4
Function at 0x439ca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e537
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x58f574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x439cea
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439cf6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.0040f770
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x439d63
push 0x48
call fcn.004c6c46
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x439d57
push 0x48
push 0
push ebx
call fcn.00509f10
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00438e70
jmp 0x439d59
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439d90
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040f770
push 3
push 0x550b4c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040f500
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439ddf
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x439e2e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x439e2e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.0040f770
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00407a40
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x439e64
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439e5a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439ea1
push edx
push ecx
call fcn.004c6c76
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x439e83
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c6f1e
mov esp, ebp
pop ebp
ret 0x14
call fcn.0050d599
int3