joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007c90
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061446
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10081100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
call fcn.10011250
mov esi, dword [ebp + 8]
mov edi, eax
lea ecx, [edi + 0x10]
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], ecx
mov word [edi + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [esi]
movups xmmword [ecx], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add ecx, 0x18
mov dword [ebp - 0x20], ecx
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
movups xmm0, xmmword [esi + 0x18]
movups xmmword [ecx], xmm0
movq xmm0, qword [esi + 0x28]
movq qword [ecx + 0x10], xmm0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0x18], eax
xor eax, eax
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
movups xmm0, xmmword [esi + 0x34]
movups xmmword [ecx + 0x1c], xmm0
movq xmm0, qword [esi + 0x44]
movq qword [ecx + 0x2c], xmm0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 7
mov word [esi + 0x34], ax
mov dword [ecx + 0x44], eax
mov dword [ecx + 0x48], eax
movups xmm0, xmmword [esi + 0x4c]
movups xmmword [ecx + 0x34], xmm0
movq xmm0, qword [esi + 0x5c]
movq qword [ecx + 0x44], xmm0
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], 7
mov word [esi + 0x4c], ax
lea eax, [ecx + 0x4c]
mov byte [ebp - 4], 4
mov ecx, eax
mov dword [ebp + 8], eax
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.10011210
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [esi + 0x64]
mov dword [edx], ecx
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [edx + 4]
mov dword [edx + 4], eax
mov eax, edi
mov dword [esi + 0x68], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b470
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100618d1
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
mov edi, dword [ebp + 8]
jne 0x1000b4ad
call fcn.1000e5c0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1003d850
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 0x5c]
push dword [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x218]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x21c], eax
call fcn.1001a920
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx ecx, al
sub ecx, 1
jne 0x1000b679
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x48
push str.d:jenkins.jenkinsworkspacelib_commoncefhelpercef_helperconfig.cpp
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], 0
mov ebx, eax
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
call fcn.10004a50
push 3
push 0x10066764
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.10004a50
mov byte [ebp - 4], 1
call fcn.1001a920
mov edi, eax
lea ecx, [ebp - 0x2e4]
push 0xcc
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10002920
mov esi, eax
push str.copy_pepflashplayer.dll_return
push esi
mov byte [ebp - 4], 2
call fcn.10003570
add esp, 8
mov ecx, esi
push dword [ebp - 0x21c]
call fcn.1000a7d0
push str.__errcode
push esi
call fcn.10003570
add esp, 8
mov ecx, esi
push ebx
call fcn.1000a970
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x2e4]
call fcn.10003620
mov edx, dword [ebp - 0x220]
cmp edx, 0x10
jb 0x1000b628
mov ecx, dword [ebp - 0x234]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000b61e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b69d
push edx
push ecx
call fcn.10020dd1
add esp, 8
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
cmp edx, 0x10
jb 0x1000b679
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000b66f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b6a2
push edx
push ecx
call fcn.10020dd1
add esp, 8
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 4
call fcn.10040839
call fcn.10040839
int3
Function at 0x1000f880
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006200c
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
mov edi, dword [ebp + 8]
jne 0x1000f8bc
call fcn.1000e5c0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1003d850
lea eax, [esi + 0x44]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x1000f8dd
mov eax, dword [eax]
push eax
push dword [esi + 4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000f9e2
call fcn.1001a920
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1000f9de
push 0x48
push str.d:jenkins.jenkinsworkspacelib_commoncefhelpercef_helperconfig.cpp
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], al
call fcn.10004a50
push 3
push 0x10066764
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.10004a50
mov byte [ebp - 4], 1
call fcn.1001a920
mov edi, eax
lea ecx, [ebp - 0x2e4]
push 0x61
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10002920
mov esi, eax
push str.local_libcef.dll_not_exist
push esi
mov byte [ebp - 4], 2
call fcn.10003570
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x2e4]
call fcn.10003620
lea ecx, [ebp - 0x234]
call fcn.10003260
lea ecx, [ebp - 0x24c]
call fcn.10003260
xor eax, eax
jmp 0x1000fa3d
test edi, edi
jne 0x1000f9eb
lea eax, [edi + 1]
jmp 0x1000fa3d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.10009b90
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 3
push edi
push eax
call fcn.100147d0
mov edx, dword [ebp - 0x21c]
add esp, 8
mov esi, eax
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1000fa3b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 4
Function at 0x10013aa0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100624a1
mov eax, dword fs:[0]
push eax
sub esp, 0x4dc
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.1003d850
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x100839f0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1003d850
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x10013b37
mov ebx, dword [ebx]
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call fcn.1001bac0
add esp, 4
test eax, eax
jne 0x10013c6b
call fcn.1001a920
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10013c4b
push 0x52
push str.d:jenkins.jenkinsworkspacelib_commoncefhelpercef_helper_nethttpdownload.cpp
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], al
call fcn.10004a50
push 3
push 0x10066764
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.10004a50
mov byte [ebp - 4], 1
call fcn.1001a920
mov edi, eax
lea ecx, [ebp - 0x4e8]
push 0x23
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.10002920
mov esi, eax
push str.check_net_sign_fail.
push esi
mov byte [ebp - 4], 2
call fcn.10003570
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.10007600
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x4e8]
call fcn.10003620
lea ecx, [ebp - 0x438]
call fcn.10003260
lea ecx, [ebp - 0x450]
call fcn.10003260
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
jne 0x10013cd0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10013c4b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10013cd0
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x10013c4b
cmp dword [edi + 4], 0
je 0x10013c4b
cmp dword [edi + 0xc], 0
je 0x10013c4b
mov eax, 1
jmp 0x10013c4d
Function at 0x10014d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x414], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x410], ecx
push edi
mov edi, dword [ebp + 0x18]
test ecx, ecx
je 0x10014e31
test ebx, ebx
je 0x10014e31
test eax, eax
je 0x10014e31
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.1003d850
add esp, 0xc
mov dword [ebp - 0x40c], 1
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0x400
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x414]
push ebx
push dword [ebp - 0x410]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10014e31
lea eax, [ebp - 0x404]
jmp 0x10014e3b
test edi, edi
mov eax, 0x1006696c
cmovne eax, edi
push eax
mov ecx, esi
call fcn.10013550
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10021142
mov esp, ebp
pop ebp
ret
Function at 0x10019b70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100629aa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10081100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10003d10
mov ecx, eax
test ecx, ecx
je 0x10019d34
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10003d10
mov ecx, eax
test ecx, ecx
je 0x10019d3e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10003d10
mov ecx, eax
test ecx, ecx
je 0x10019d48
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10019c52
xor ecx, ecx
jmp 0x10019c70
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10019c60
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.100106c0
push edi
mov ecx, ebx
call fcn.10019e30
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10019c8c
xor ecx, ecx
jmp 0x10019ca4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10019c94
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.100106c0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.1001a6a0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10019e30
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10019ce5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x10019d1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10019d1e
cmp dword [esi + 0x10], 0
je 0x10019d15
push dword [edi]
call fcn.100495c6
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10003ae0
push 0x80004005
call fcn.10003ae0
push 0x80004005
call fcn.10003ae0
int3
Function at 0x1001a4a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062a98
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1001a674
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001a4f5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x1001a674
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001a513
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x1001a674
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001a531
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x1001a674
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001a54f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x1001a674
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1001a674
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001a574
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x1001a5a7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1001a5bf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1001a5fd
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.100046a0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.1003cd50
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x1006a864
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1001ae50
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001a62b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x1001a664
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1001a664
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10013550
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.100032b0
lea ecx, [ebp - 0x28]
call fcn.100032b0
lea ecx, [ebp - 0x34]
call fcn.10019e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 4
Function at 0x1001aa10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062b57
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1001aa5a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001aa66
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10012840
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x1001aad3
push 0x48
call fcn.1001ed80
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1001aac7
push 0x48
push 0
push ebx
call fcn.1003d850
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.10019b70
jmp 0x1001aac9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ab00
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10012840
push 3
push 0x1006a864
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.100126b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001ab4f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x1001ab9e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x1001ab9e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10012840
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.100032b0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001abd4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001abca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001ac11
push edx
push ecx
call fcn.10020dd1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x1001abf3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 0x14
call fcn.10040839
int3
Function at 0x1001e510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063271
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10081100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.10003d10
mov ecx, eax
test ecx, ecx
je 0x1001e6a4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e665
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001e657
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001e665
add eax, 0x10
push 0x1006b324
push eax
mov dword [ebp - 0x20], eax
call fcn.100217a6
mov esi, eax
add esp, 8
test esi, esi
je 0x1001e665
push dword [ebp - 0x20]
push 0
push esi
call fcn.1003d850
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001e61a
push esi
call fcn.100211b6
add esp, 4
jmp 0x1001e665
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e620
sub ecx, edx
sar ecx, 1
je 0x1001e64e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e636
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.100106c0
push esi
call fcn.100211b6
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001e665
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001e684
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021142
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10003ae0
int3