joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x1000bae7
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 0x80
push 2
push 1
push 0x40000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.1000a760
mov edi, dword [ebp - 8]
test eax, eax
js 0x1000bb65
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x1000bb25
mov esi, dword [esi]
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000bb43
call fcn.1000a530
mov esi, eax
test esi, esi
js 0x1000bb5e
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1000bb5c
call fcn.1000a530
mov esi, eax
not esi
shr esi, 0x1f
jmp 0x1000bb67
xor esi, esi
not esi
shr esi, 0x1f
jmp 0x1000bb67
xor esi, esi
test edi, edi
je 0x1000bb72
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000bcb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000bd09
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000bd09
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000bcfa
cmp esi, edx
jae 0x1000bd09
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000bce8
cmp esi, edx
jae 0x1000bd09
cmp word [esi], 0
je 0x1000bd09
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000f880
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b0b0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.1000fb50
push dword [ebp - 0x5c]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000f8d2
xor esi, esi
jmp 0x1000fa3d
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x5c]
call fcn.1000a980
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0x20
push str.45476F8083D74BA28A2DD8ED399737B7
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000c5f0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1001f2d0
mov edx, dword [ebp - 0x44]
add esp, 0xc
mov byte [ebp - 4], 2
mov edi, eax
cmp edx, 0x10
jb 0x1000f980
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000f976
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000fa7c
push edx
push ecx
call fcn.100386fb
add esp, 8
test edi, edi
je 0x1000f9ab
mov ecx, esi
call fcn.10010b30
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.1000e9b0
lea ecx, [esi + 0xb0]
call fcn.1000dab0
mov esi, 1
jmp 0x1000f9ad
xor esi, esi
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x1000f9e5
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000f9db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000fa81
push edx
push ecx
call fcn.100386fb
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x1000fa2b
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000fa21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000fa86
push edx
push ecx
call fcn.100386fb
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov edi, dword [ebp - 0x5c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1000fa5f
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
call fcn.1005a1fe
call fcn.1005a1fe
call fcn.1005a1fe
int3
Function at 0x1000fdf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x1000fe59
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x1000fe75
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
pop esi
test eax, eax
je 0x1000fe59
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x1000fe75
cmp dword [edi + 4], 0
je 0x1000fe75
cmp dword [edi + 0xc], 0
je 0x1000fe75
mov eax, 1
pop edi
pop ebp
ret 4
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x10014f90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b808
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1009d258]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x40]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 1
call fcn.10035d00
cmp dword [ebp + 0x24], 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push eax
call fcn.10035d30
push eax
push 0x100820dc
push dword [ebp - 0x10]
call fcn.10035c20
cmp dword [ebp + 0x3c], 0x10
lea eax, [ebp + 0x28]
cmovae eax, dword [ebp + 0x28]
push eax
call fcn.10035d30
push eax
push 0x100820d0
push dword [ebp - 0x10]
call fcn.10035c20
movd xmm0, esi
add esp, 0x18
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10035ca0
mov esi, dword [ebp - 0x10]
push eax
push str.script_type
push esi
call fcn.10035c20
movd xmm0, edi
add esp, 0xc
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10035ca0
push eax
push str.event
push esi
call fcn.10035c20
add esp, 0x14
call fcn.10007a00
mov ecx, eax
test ecx, ecx
je 0x1001516b
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.10035f40
mov edi, eax
mov dword [ebx + 0x10], 0
mov ecx, edi
mov dword [ebx + 0x14], 0xf
add esp, 4
mov byte [ebx], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100150a0
sub ecx, edx
push ecx
push edi
mov ecx, ebx
call fcn.1000c5f0
test edi, edi
je 0x100150bf
push edi
call fcn.10059fee
add esp, 4
push dword [ebp - 0x10]
call fcn.10035db0
add esp, 4
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100150e3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0x24]
cmp edx, 0x10
jb 0x10015113
mov ecx, dword [ebp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015109
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015175
push edx
push ecx
call fcn.100386fb
add esp, 8
mov edx, dword [ebp + 0x3c]
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0xf
mov byte [ebp + 0x10], 0
cmp edx, 0x10
jb 0x10015155
mov ecx, dword [ebp + 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001514b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001517a
push edx
push ecx
call fcn.100386fb
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
push 0x80004005
call fcn.10007bc0
call fcn.1005a1fe
call fcn.1005a1fe
int3
Function at 0x100173b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b1ab
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
call fcn.10021c00
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10017517
mov ebx, dword [esi + 0x68]
lea ecx, [ebp - 0x40]
sub ebx, dword [esi + 0x64]
push 0x5e
push str.d:jenkins.jenkinsworkspacewhaleclean_runextention_run_extention_runextentiontrayclient.cpp
sar ebx, 5
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
call fcn.1000c5f0
push 3
push 0x10081b28
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000c5f0
mov byte [ebp - 4], 1
call fcn.10021c00
mov edi, eax
lea ecx, [ebp - 0xe0]
push 0x33f
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10008f20
mov esi, eax
push str.config_ready__sequential_count_
push esi
mov byte [ebp - 4], 2
call fcn.10008870
add esp, 8
mov ecx, esi
push ebx
call fcn.1000f3d0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xe0]
call fcn.1000a0c0
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100174d2
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100174c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001757f
push edx
push ecx
call fcn.100386fb
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x10017514
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001750a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017584
push edx
push ecx
call fcn.100386fb
add esp, 8
mov esi, dword [ebp - 0x44]
mov eax, dword [esi + 0x68]
sub eax, dword [esi + 0x64]
test eax, 0xffffffe0
je 0x10017563
cmp dword [esi + 0x74], 0
jne 0x1001753b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x74], eax
cmp dword [esi + 0x70], 0
jne 0x10017563
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push 0
push esi
push 0x100178d0
push 0
push 0
call fcn.100662a7
add esp, 0x18
mov dword [esi + 0x70], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
call fcn.1005a1fe
call fcn.1005a1fe
int3
Function at 0x1001a1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x690051
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x1009fba8
mov dword [ebp - 0x5c], 0x6f0068
push edi
mov dword [ebp - 0x58], 0x20006f
mov edx, 0x2d
mov dword [ebp - 0x54], 0x360033
sub esi, eax
mov dword [ebp - 0x50], 0x200030
mov dword [ebp - 0x4c], 0x6f0053
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x280020
mov dword [ebp - 0x38], 0x650042
mov dword [ebp - 0x34], 0x6a0069
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x290067
mov dword [ebp - 0x28], 0x430020
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x79006e
mov dword [ebp - 0x18], 0x4c0020
mov dword [ebp - 0x14], 0x6d0069
mov dword [ebp - 0x10], 0x740069
mov dword [ebp - 0xc], 0x640065
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x1001a2a0
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001a2a0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001a282
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
Function at 0x10020e60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c1fa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1009d258]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10007a00
mov ecx, eax
test ecx, ecx
je 0x10021024
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10007a00
mov ecx, eax
test ecx, ecx
je 0x1002102e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10007a00
mov ecx, eax
test ecx, ecx
je 0x10021038
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10020f42
xor ecx, ecx
jmp 0x10020f60
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020f50
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.1000bb80
push edi
mov ecx, ebx
call fcn.10009c80
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10020f7c
xor ecx, ecx
jmp 0x10020f94
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10020f84
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.1000bb80
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10021980
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10009c80
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10020fd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1002100e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1002100e
cmp dword [esi + 0x10], 0
je 0x10021005
push dword [edi]
call fcn.1006744f
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10007bc0
push 0x80004005
call fcn.10007bc0
push 0x80004005
call fcn.10007bc0
int3
Function at 0x100216a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10021874
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100216f5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x10021874
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10021713
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x10021874
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10021731
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x10021874
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1002174f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x10021874
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10021874
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10021774
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x100217a7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x100217bf
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x100217fd
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.1000c110
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.10056300
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x10085d4c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10022450
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002182b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x10021864
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10021864
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.1000eb90
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10009920
lea ecx, [ebp - 0x28]
call fcn.10009920
lea ecx, [ebp - 0x34]
call fcn.10021070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret 4
Function at 0x10021cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c3a7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x10021d3a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021d46
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.1001b910
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x10021db3
push 0x48
call fcn.100386cb
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10021da7
push 0x48
push 0
push ebx
call fcn.10056e00
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.10020e60
jmp 0x10021da9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021de0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.1001b910
push 3
push 0x10085d4c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1001ed67
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10021e2f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x10021e7e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10021e7e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1001b910
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10009920
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10021eb4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10021eaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10021ef1
push edx
push ecx
call fcn.100386fb
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x10021ed3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret 0x14
call fcn.1005a1fe
int3
Function at 0x10023bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c638
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0x740068
mov dword [ebp - 0x68], 0x700074
mov dword [ebp - 0x64], 0x2f003a
mov dword [ebp - 0x60], 0x6c002f
mov dword [ebp - 0x5c], 0x2e0033
mov dword [ebp - 0x58], 0x750070
mov dword [ebp - 0x54], 0x6c0062
mov dword [ebp - 0x50], 0x630069
mov dword [ebp - 0x4c], 0x6c002e
mov dword [ebp - 0x48], 0x76006f
mov dword [ebp - 0x44], 0x320065
mov dword [ebp - 0x40], 0x6f0077
mov dword [ebp - 0x3c], 0x6b0072
mov dword [ebp - 0x38], 0x63002e
mov dword [ebp - 0x34], 0x2f006e
mov dword [ebp - 0x30], 0x630070
mov dword [ebp - 0x2c], 0x75002f
mov dword [ebp - 0x28], 0x640070
mov dword [ebp - 0x24], 0x740061
mov dword [ebp - 0x20], 0x2f0061
mov dword [ebp - 0x1c], 0x750064
mov dword [ebp - 0x18], 0x70006d
mov word [ebp - 0x14], ax
call fcn.10007a00
mov ecx, eax
test ecx, ecx
je 0x10023cfd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000a550
test al, al
jne 0x10023cdd
lea ecx, [ebp - 0x6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023cc2
sub ecx, edx
lea eax, [ebp - 0x6c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000bb80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10007bc0
int3