joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7412a4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x220]
mov edi, 0x208
push edi
push ebx
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x8b08b8
call fcn.0075fe99
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0075feb4
push edi
lea eax, [ebp - 0x630]
push ebx
push eax
call fcn.0074fc20
push edi
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.0074fc20
add esp, 0x28
mov dword [ebp - 0x634], ebx
mov ecx, 0x104
mov dword [ebp - 0x63c], ebx
lea eax, [ebp - 0x428]
mov dword [ebp - 0x638], ebx
push ecx
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x634]
push eax
push ecx
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x741390
push dword [ebp - 0x634]
push str._08X
push esi
call fcn.00408370
add esp, 0xc
jmp 0x74139d
push 0x8b08c8
push esi
call fcn.0075fe77
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006e70bb
mov esp, ebp
pop ebp
ret 4
Function at 0x74155c
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.0074fc20
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0074fc20
add esp, 0x18
lea eax, [ebp - 0x20c]
push ebx
push 0x2b
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push str._shiqiang_
push eax
call fcn.0075fe06
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
pop ecx
pop ecx
push eax
call esi
test eax, eax
jne 0x7415df
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0075fe77
lea eax, [ebp - 0x414]
push str.wnsoft.ini
push eax
call fcn.0075fe06
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x741674
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x414]
push eax
push dword [edi]
mov ebx, str.Globals
push str.OnlyIdentifier1
push ebx
call esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
add eax, 0x208
push eax
push str.OnlyIdentifier2
push ebx
call esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
add eax, 0x410
push eax
push str.OnlyIdentifier3
push ebx
call esi
lea eax, [ebp - 0x414]
push eax
mov eax, dword [edi]
add eax, 0x618
push eax
push str.OnlyIdentifier4
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006e70bb
mov esp, ebp
pop ebp
ret
Function at 0x74181d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov esi, 0xf003f
push eax
push esi
xor edi, edi
mov ebx, ecx
push edi
push str.software
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x74191b
push edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push edi
push edi
push edi
push str.ShiQiang
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x74191b
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
lea eax, [eax*2 + 2]
push eax
push dword [ebx]
push 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.OnlyIdentifier1
push dword [ebp - 4]
call edi
mov eax, dword [ebx]
add eax, 0x208
push eax
call esi
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebx]
add eax, 0x208
push eax
push 1
push 0
push str.OnlyIdentifier2
push dword [ebp - 4]
call edi
mov eax, dword [ebx]
add eax, 0x410
push eax
call esi
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebx]
add eax, 0x410
push eax
push 1
push 0
push str.OnlyIdentifier3
push dword [ebp - 4]
call edi
mov eax, dword [ebx]
add eax, 0x618
push eax
call esi
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebx]
add eax, 0x618
push eax
push 1
push 0
push str.OnlyIdentifier4
push dword [ebp - 4]
call edi
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x741981
Capabilities:
Get common file path

Disassembly:
push 0x72c
mov eax, 0x7b42ff
call fcn.00772fd1
push 0x67
pop ecx
mov esi, str.RZGJBzore5wKrFWCwmhH0rO9uEQW4xGAHf3XWuQQD4Jcs6ksXa96J9wrvK1zxUmTs744ETuoDXAOORG9HheMZXtH53o0pSOm5VIMnpljTSqiYEhJzJVUUn1WeEO11PnW9NcgnijZG6oEs2QGIzcefDtUYFfBsqnvBtLKQkk8CvG5xjoA1q5zo6CHapfsjFY1BT5MIxnIy3JSM9jLhwrqO3boyyNBO8VyJ6fmIsUEBIKE3Iual0TzkmjXfsp1fG8TU6IvaVlOICQTdrGLpapNGdKWDgP4fdHTQVnHMu8M0SDqLoBm1XWF32xJWXpeAy0NoerE1QdDwAzzjjW88iJaI0ZaDHnnkArYsR4FfH5HW0Q3wcMFI7edvC1YDM70BIPCYkaIQ5g9pb9kCBrTr92KbeqqC8Sz
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x70c]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x52
pop ecx
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
mov esi, str.bkfXv8R8czqKtS8y9YDj9YbaK2vEK9r5oTKYcg8JmiNZ4iIDabS6BhkcVLFnL67lAtfmYtLzWSOfw2vz4s2vvaExPadkYItqwaGkPlCXYOy5FhTHoDo41pVy2FFvd6FNQVVw1YOawgk9IyLmOwbURZfC07dL97xS1N8t2TEEXstc9RArufxne3ESGQI3IFxkYIHkHZ5htKlFa8wL1Vn8ozGNOi0PZbOoD1Pz6xL7q9mFMrOdUVWFL2scwinoOKG69tSOdIyKsgOPJM9u5HnwyqclFBzRXJT5tfcgF0TOFba11YCy3o5DOTY3esKRubNQjS8vCqO6e
mov dword [ebp - 0x728], eax
lea edi, [ebp - 0x364]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x738], eax
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x730], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x724]
lea eax, [ebp - 0x70c]
push eax
call fcn.00405a50
lea eax, [ebp - 0x724]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x738]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x724]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x724]
call fcn.00405a50
lea eax, [ebp - 0x724]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x738]
call fcn.004082f0
xor edi, edi
lea ecx, [ebp - 0x724]
push edi
push 1
call fcn.004096c0
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push edi
push eax
call fcn.0074fc20
push esi
lea eax, [ebp - 0x56c]
push edi
push eax
call fcn.0074fc20
add esp, 0x18
lea eax, [ebp - 0x56c]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x741b15
push ebx
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x218]
push str._s_s.url
push eax
call fcn.00408370
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0x10
mov ebx, str.InternetShortcut
push eax
push dword [ebp - 0x728]
push 0x89bc78
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x72c]
push str.IconFile
push ebx
call esi
lea eax, [ebp - 0x218]
mov edi, 0x7bc9f4
push eax
push edi
push str.HotKey
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push edi
push str.IDList
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push edi
push str.IconIndex
push ebx
call esi
lea ecx, [ebp - 0x738]
call fcn.006ec102
call fcn.00772f7b
ret
Function at 0x741b26
Capabilities:
Get common file path

Disassembly:
push 0x78c
mov eax, 0x7b4348
call fcn.00772fd1
push 0x67
pop ecx
mov esi, str.3GznaMucqRe4bJ2HCxVoGOviGfw48V6Uf10Ls79ddZp7NazckToqU9iXZEGfhYKNpiGPN40HhTcZmOCXMvxkog2ShtuMj669DtIB4x6ej3hCwv4mtr0ZoJ6N2AnZ4N7ID4B2cOVWqfdceflY1fCULexaxuEh4imig9OKddxjgg5uWU7vLOjedLpnJrtUKATWv7ZIKCXTzIWCiFs5I2NNaH9a1vVGonnIc4hoamahXpFckusajhWa1gqwA4yjmO2IKUna8o21AzWtqj3GNWd8NmaRuKHsSe6BaCiiTRwhIzWN4QW4qd3EjUy8KCipgJfFyU6kbyXYljqoRqhkgMLFW02ZX2n4BEDEN6e19HK3ilOEwx0wBjESSzvPVo9t1Si8NQxPKHjmou5ByvARogZ3S6wPFbVCAM
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x5c0]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x6a
pop ecx
mov dword [ebp - 0x788], eax
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x78c], eax
xor eax, eax
mov dword [ebp - 0x798], eax
movsb byte es:[edi], byte [esi]
mov esi, str.YIHPOMiRxbp8BBtJXHWAQTkgigddzBml2c9e0eInCCR3Z1F50VZ2SXbMjeUMBs8WOWe1kr0NgkGJGC9OqpDO7RdHm2UjOLiPhaW8eir2a6g0n89uZF7gt4sqjed3XCcnI0NnIowHgvEu4K1ESSmxEhDKzAKo71Ep5iMhRPfl6l0rg9vQ7RpIwjOnoA3nJyhBYSJzSWaVBrmbKusQEgvfsCvVG2aJ6G1OngbM6sDHHu0EEF136FZngfSzCmiSUE4lFaUd0P2Ea9vGJdbyVNhbmn9jeLbZLWXi7gJRLM9HnzfH8p0wHG6gRfb8TOBPba4KdXPBvq1qcs2GeRVmYMBT3kEEd7EtK6bdTn7drs0oHcv3arKtm2LcSq0Mq1KI6cUbo7DT90qXsWD7MLkze22CCXoYSD6LiKy2Qg3qfRQHfB
mov dword [ebp - 0x794], eax
lea edi, [ebp - 0x76c]
mov dword [ebp - 0x790], eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x784]
lea eax, [ebp - 0x5c0]
push eax
call fcn.00405a50
lea eax, [ebp - 0x784]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x798]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x784]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x76c]
push eax
lea ecx, [ebp - 0x784]
call fcn.00405a50
lea eax, [ebp - 0x784]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x798]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x784]
mov byte [ebp - 4], 0
call fcn.004096c0
mov esi, 0x208
lea eax, [ebp - 0x420]
push esi
xor edi, edi
push edi
push eax
call fcn.0074fc20
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0074fc20
add esp, 0x18
lea eax, [ebp - 0x218]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x741c74
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str._s_s.lnk
push eax
call fcn.00408370
xor eax, eax
push eax
push eax
push eax
push 1
push dword [ebp - 0x788]
push eax
push dword [ebp - 0x78c]
lea eax, [ebp - 0x420]
push eax
call fcn.00741c85
add esp, 0x30
lea ecx, [ebp - 0x798]
call fcn.006ec102
call fcn.00772f7b
ret
Function at 0x742815
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x7428e3
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x218]
push edi
push edx
push edi
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push edx
push edi
mov dword [ebp - 0x218], edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x7428e3
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x852328
push edi
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x7428e3
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push dword [ebp - 0x214]
call fcn.00742739
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006e70bb
mov esp, ebp
pop ebp
ret

Function at 0x742aa2
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x742b6f
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x742b6f
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x742b6e
push edi
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x742b6d
push edi
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x742b66
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
push 0x8b08b4
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x742b66
mov eax, dword [ebp - 0x210]
mov esi, dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.006e70bb
mov esp, ebp
pop ebp
ret
Function at 0x742b80
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2bc]
push eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x2bc], ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x742c11
push edi
mov edi, 0x2b4
lea eax, [ebp - 0x2b8]
push edi
push ebx
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x208
push edi
push eax
push ebx
push dword [ebp - 0x2bc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop edi
setne bl
test bl, bl
je 0x742c05
push 0x208
lea eax, [ebp - 0x2ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x2bc]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.006e70bb
mov esp, ebp
pop ebp
ret 8

Function at 0x742c25
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x10
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x742cf3
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x218]
push edi
push edx
push edi
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push edx
push edi
mov dword [ebp - 0x218], edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x742cf3
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x852328
push edi
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x742cf3
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push dword [ebp - 0x214]
call fcn.00742739
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006e70bb
mov esp, ebp
pop ebp
ret
Function at 0x744688
Capabilities:
Get common file path

Disassembly:
push 0x3c8
mov eax, 0x7b453b
call fcn.00772fd1
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
and dword [ebp - 0x3d4], 0
push 0x208
push 0
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3c8], eax
push 0x64
pop ecx
mov esi, str.2vFdoP5xvhtTxOi2wqwfBfBbWYxvDYan3N76obyVdeg8nXtyhQsdRHb0L1F3lflA1hcTUovkrf10NV9QSloo2xjIUlnSmJ9ew7HxA1lUoDUeK4mGmyCB2QwcPXjyuyK9UBz1IYK9EW3ck9bcb7ICHuzyGQx1oh9SS7HIAsEhG5QRb3iQX4ow7YBscoZCoTHzify9GKFbuRvq5cQf6pFI7Fd79G8na7oZOIzGZOQSe43jWDNoA8nLRK6PRBefyfJQyP8SV1vuk10r6BJ0tEouvUyZCw5YRSHAlMD2fw84UBunSrkfQ0hlznVTeMSqC6aUuwf1RgVVZDSwhKqSIg31O4kSqTHNUQqKmY7ZuscujEsFGCOmKF6nrkLhzeMPpjqVIxnbJzmRkoE290un6
mov dword [ebp - 4], eax
lea edi, [ebp - 0x3ac]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x3c4]
movsw word es:[edi], word [esi]
call fcn.00405a50
lea eax, [ebp - 0x3c4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x3d0]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.004026c0
lea ecx, [ebp - 0x3d0]
call fcn.006ec102
mov eax, ebx
call fcn.00772f7b
ret

Function at 0x74474f
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x3f4
mov eax, 0x7b4579
call fcn.00772fd1
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], eax
push 0x6f
pop ecx
mov esi, str.Y7fw2WdoZuixlaCzObklfqy5GA7CfC2cSTAgd8ae0G4k0FgqdhxqTcfgevVpIR9QuJA1DfOqR6QoJyJyjNoE3rOZ3D6vsPVn7PdhvNKhVvqnPwQExXfiyPtAiQ0x6dVkVjhWNl0rCo6nsfnre39o3EhhSVQuS0qHtF91M1J6GgZMjUL1vvrb5BSg3lDFjCDHI6DOFjk5I1jIT3vJSgFF3MXcGuBMJHCaWCr1ERvAw45gAKizeGg7tk1BsGkgG9sVmH47FPnX2sJSZxnqOb73Zy3xf98SmDY6pYaJyH9alvkknPYx6Y4cR4koiMtQWY3Fz4xYm0ifYaaZpGs3PBg5Co6N2gvfJoEokHvjGfB11QRdhGQu0goXoY68KJ1wqJLpKjsJ0HSS96n4WeqUEbJSCwYjhRB70cYXkIyiSsukn5Y4tgvw0NkKnm71Ntta9
mov dword [ebp - 4], eax
lea edi, [ebp - 0x3d8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3d8]
push eax
lea ecx, [ebp - 0x3f0]
movsw word es:[edi], word [esi]
call fcn.00405a50
lea eax, [ebp - 0x3f0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x3fc]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x3f0]
mov byte [ebp - 4], 0
call fcn.004096c0
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00402330
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.004026c0
lea ecx, [ebp - 0x3fc]
call fcn.006ec102
mov eax, ebx
call fcn.00772f7b
ret
Function at 0x744819
Capabilities:
Get common file path

Disassembly:
push 0x3b4
mov eax, 0x7b45b7
call fcn.00772fd1
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
push 0x5f
pop ecx
mov esi, str.EMWkLSaExe9ickVvQcdbnmzMfhWPKTW0a7JA7nzgUFJOE0vNOadZsbBHHSRlUZEPX1TuCriQRh8noMhkCPzm5LaddTmcvA31qXlw036te9BEK5XgeR6kggvlQJEV4HCBDPP5ti8WTd5v4Hnkliz9m3WPpPX7mPizfAZAIQ2a6QEHi9xZ3OkGx590QYytaqrvFmXq5zY81jQBywPhA6dCprlTgw1rqlE6elBeu7HAxa634Nco62d2o7CzYqdgZVsbYR2ue4y3GOIGP9IrC5O5NmsQvdNTkNZ3OB8jy8Gqn6cCOGpMOFQ2YNk9MydYxwTeTULKtpJiglUywaCBeX9DVowrnhFMJ6nySJO5EvAjaKEXfmrj5PcK3Fki5aGm
mov dword [ebp - 4], eax
lea edi, [ebp - 0x190]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x3b0]
movsb byte es:[edi], byte [esi]
call fcn.00405a50
lea eax, [ebp - 0x3b0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x3bc]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 0
call fcn.004096c0
push 0x208
lea eax, [ebp - 0x398]
push 0
push eax
call fcn.0074fc20
add esp, 0xc
lea eax, [ebp - 0x398]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x398]
mov ecx, ebx
push eax
call fcn.004026c0
lea ecx, [ebp - 0x3bc]
call fcn.006ec102
mov eax, ebx
call fcn.00772f7b
ret
Function at 0x7448dd
Capabilities:
Check mutex on windows

Disassembly:
push 0x2d8
mov eax, 0x7b4600
call fcn.00772fd1
mov dword [ebp - 0x2d8], ecx
push 0x71
pop ecx
mov esi, str.KApeZ9dsRW02O6ZM2s8LqVzCMONFnez5iyji5LEq7ppJY7996zWKZUJqWsZTcH4dTLm1DK7fN3ZrjwlEN5E4DtEvRFc7Oq4aAI9P96df6ol44VxkPRuKeDEzM522B50813Y6YR9aOaZJ48lpHjsu31evaY5mqHlS5EaK7VVQU6mMBLzxIRbiOB7mTJ9feYacbtgpqvamlCBf4DQ2onYNtRGI0GU1Ha48aoLgtPtAb2jLMUowe9Yl2HVLaKOmklg3hPndoZzgtdvD0KAT16Uzyt11v14FFtIhMkfSJU8AmpldlgIw9AdCeL9dsdBw2PV6M4czzWdEmcwTH2LGjDJCUKBFqK1FptwWVaibWPJNa4V9puKWTX1guYIPm2Bj0hRjY9d9rrQZWlzkuWO8ZoSaz35vFA4EV7t599PCsYm2WmEHKdCvnh05JUrVdo38To9Nw14qCH
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x2bc]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x38
pop ecx
mov dword [ebp - 0x2e4], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], eax
movsb byte es:[edi], byte [esi]
mov esi, str.3sT088JARm4YhQtnSB6S15CUu9U4q3imqGmPdP6tNvpbMaMbAs6G7bT7kmEUKK7qLuEa1kWenRnsKP3ztxlY0q0KS0KoQclZhRbyOknqUDEI329XrWRFNXVSLbjvR92kRs1b4VwIngKlR8UHHWzIBlsYK1Hk1mQAHlEdV0ZwLqMLlikhfCojnOj2q5oTUW5E0NahWgMWeebUw3CtHq5tXpGJl7ln6K54tt
lea edi, [ebp - 0xf4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2d4]
lea eax, [ebp - 0x2bc]
push eax
call fcn.00405a50
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2e4]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00405a50
lea eax, [ebp - 0x2d4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2e4]
call fcn.004082f0
push 0
push 1
lea ecx, [ebp - 0x2d4]
call fcn.004096c0
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [ebp - 0x2d8]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [ebx + 4], ecx
lea ecx, [ebp - 0x2e4]
call fcn.006ec102
mov eax, ebx
call fcn.00772f7b
ret 4

Function at 0x745979
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x74615b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x7461ba
push esi
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.006e70fd
pop ecx
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.0074f6a0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret