joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c200
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625e81
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x224], ebx
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.jiandeskData
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c296
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [esi + 0x4c]
mov ecx, esi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0045c8f0
push dword [ebp - 0x21c]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
test edx, edx
jne 0x45c2c5
xor ecx, ecx
jmp 0x45c2df
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45c2d0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x21c]
call fcn.0040b220
movss xmm0, dword [esi + 0x50]
or edi, 0xffffffff
mulss xmm0, dword [0x63b310]
cvttss2si esi, xmm0
cmp esi, 0x64
je 0x45c36f
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45c430
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push esi
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push str._v2_after__x_d.png
push eax
call fcn.00407320
mov esi, dword [ebp - 0x220]
lea ecx, [ebp - 0x21c]
add esp, 0xc
push esi
push str..png
call fcn.0040a6f0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45c384
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x45c384
push str._v2_after.png
push str..png
lea ecx, [ebp - 0x21c]
call fcn.0040a6f0
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45c43a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.004090c0
test al, al
jne 0x45c3ee
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45c3d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040b220
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x45c410
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
int3
Function at 0x45c450
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625e81
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x224], ebx
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.jiandeskData
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c4e6
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [esi + 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0045c8f0
push dword [ebp - 0x21c]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
test edx, edx
jne 0x45c515
xor ecx, ecx
jmp 0x45c52f
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45c520
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x21c]
call fcn.0040b220
movss xmm0, dword [esi + 0x50]
or edi, 0xffffffff
mulss xmm0, dword [0x63b310]
cvttss2si esi, xmm0
cmp esi, 0x64
je 0x45c5bf
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45c680
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push esi
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push str._v2_now__x_d.png
push eax
call fcn.00407320
mov esi, dword [ebp - 0x220]
lea ecx, [ebp - 0x21c]
add esp, 0xc
push esi
push str..png
call fcn.0040a6f0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45c5d4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x45c5d4
push str._v2_now.png
push str..png
lea ecx, [ebp - 0x21c]
call fcn.0040a6f0
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45c68a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.004090c0
test al, al
jne 0x45c63e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45c620
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040b220
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x45c660
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
int3
Function at 0x45c6a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625e81
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x224], ebx
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.jiandeskData
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c736
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [esi + 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0045c8f0
push dword [ebp - 0x21c]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
test edx, edx
jne 0x45c765
xor ecx, ecx
jmp 0x45c77f
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45c770
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x21c]
call fcn.0040b220
movss xmm0, dword [esi + 0x50]
or edi, 0xffffffff
mulss xmm0, dword [0x63b310]
cvttss2si esi, xmm0
cmp esi, 0x64
je 0x45c80f
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45c8d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push esi
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push str._v2_tomor__x_d.png
push eax
call fcn.00407320
mov esi, dword [ebp - 0x220]
lea ecx, [ebp - 0x21c]
add esp, 0xc
push esi
push str..png
call fcn.0040a6f0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45c824
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x45c824
push str._v2_tomor.png
push str..png
lea ecx, [ebp - 0x21c]
call fcn.0040a6f0
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45c8da
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.004090c0
test al, al
jne 0x45c88e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45c870
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040b220
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x45c8b0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
int3
Function at 0x45c8f0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x625ec6
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x460]
mov esi, dword [ebp + 0xc]
push 0x3c
push 0
push eax
mov dword [ebp - 0x424], edi
call fcn.005e3920
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x460], 0x3c
push 0
push eax
call fcn.005e3920
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.005e3920
add esp, 0x24
mov dword [ebp - 0x430], 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0x428], 0x104
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x460]
push eax
push 0
push 0
push dword [esi]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x45c9e8
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45ca5d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x6331a8
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.004090c0
test al, al
jne 0x45ca3e
push 0
push 0x6331a8
jmp 0x45ca37
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x45ca67
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.004090c0
test al, al
jne 0x45ca3e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45ca20
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040b220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
int3
Function at 0x45f8f0
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0xc], 0
jne 0x45f940
cmp dword [edi + 0x10], 0
jne 0x45f940
cmp dword [edi + 0x14], 0
jne 0x45f940
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [edi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push edi
push 0x45f980
push 0
push 0
mov dword [edi + 0x14], eax
call fcn.005f84ce
add esp, 0x18
mov dword [edi + 0xc], eax
pop edi
ret

Function at 0x4628d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
xor esi, esi
push esi
push 0x63bbac
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x462939
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push esi
push esi
push str.CtxMenu
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x462930
cmp dword [ebp - 8], 1
mov eax, 0x80004005
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46bda0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x46bf68
test eax, eax
je 0x46bf68
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x46bf68
push ecx
push ebx
push eax
call fcn.005e3920
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x46bf68
cmp edi, 0xffffffff
je 0x46bf61
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004776e0
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x46bf61
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x46bef7
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x46bf61
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x46bef7
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x46be90
cmp edi, esi
jae 0x46bef7
nop
sub esi, edi
sbb ecx, eax
js 0x46bea5
jg 0x46bea0
cmp esi, 0x400000
jb 0x46bea5
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x46bef7
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00477730
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x46beeb
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x46be90
jg 0x46bef7
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x46be90
lea eax, [ebp - 0x6c]
push eax
call fcn.004775d0
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x63f12c
push 3
push edi
call fcn.0041a650
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x46bf10
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.005fcb43
add esp, 8
mov esi, 1
test ebx, ebx
je 0x46bf4d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x46bf5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa103
mov esp, ebp
pop ebp
ret

Function at 0x47aa30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x47aa3f
pop ebp
jmp fcn.0047b870
xor eax, eax
pop ebp
ret 0xc
Function at 0x47bb70
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6282e3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x47bc15
cmp word [esi], di
je 0x47bc15
test eax, eax
je 0x47bbd1
cmp word [eax], di
je 0x47bbd1
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x47bc15
jmp 0x47bc10
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x47bc15
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x47bc8c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x47bc77
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x47bc45
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x47bc66
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x47bcac
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x47bc77
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x47bc8c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 0x30
call fcn.004630c1
int3

Function at 0x47c800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x47c815
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47c820
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x47c8a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62841a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x47ca64
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x47ca6e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x47ca78
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x47c982
xor ecx, ecx
jmp 0x47c9a0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47c990
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040b220
push edi
mov ecx, ebx
call fcn.0041aac0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x47c9bc
xor ecx, ecx
jmp 0x47c9d4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47c9c4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.0040b220
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.0047d2e0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0041aac0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47ca15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x47ca4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47ca4e
cmp dword [esi + 0x10], 0
je 0x47ca45
push dword [edi]
call fcn.005fd032
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
int3
Function at 0x47d0e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628508
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x47d2b4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x47d135
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x47d2b4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x47d153
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x47d2b4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x47d171
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x47d2b4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x47d18f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x47d2b4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x47d2b4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x47d1b4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x47d1e7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x47d1ff
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x47d23d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.00417490
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.005e2e20
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x63ff7c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0047da80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47d26b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x47d2a4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x47d2a4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.00420140
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.0040efb0
lea ecx, [ebp - 0x28]
call fcn.0040efb0
lea ecx, [ebp - 0x34]
call fcn.0047cab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4