joyce8/EMBER2024-capa huggingface dataset:
Function at 0x742fc3
Capabilities:
Get common file path

Disassembly:
push 0x740
mov eax, 0x7b5b1e
call fcn.00774621
push 0x7d
pop ecx
mov esi, str.5aHJ9rLzv5FP3BGYRoMICOwvqYWxthohLxN09jaMJcklKZYAsKiqKWHoZamqI1rjpsWHOjZ17Y9B7Jx70nIvD3OdjbL2hhnwnOY5zgLOjEoXSG8CdS6KKEKLKm5VnmGKoUWoPcwyQqptuL2IMDD4kl2XMvGKEtjmzoUZUBonUzIny43S8F3pR5ENhHv2Zce7L3mRTbpFxJAmVetVYVQUoIGgvxeiywWuQ3PKGs3jCd1Oo2c1R3Tkoi3DjAb3dOC2Dm353vZW2mhkozm9Poc7dXPgHth75d5ygoMFxS3DpHJHgbx6tLb2zrIbDwjNP4T0dnkgzLDXBXt5UzII0vH8mq0ajYUG152AYPhyENk7GKnbosVAC5xCEsCM5iVqLBGDRRCPC4YyPHyuHUi72dpniHS0a6Vwlpju1A17PknuDxteZaCH56V9huqEWZuvE8g55SEImhhBnfCI4RTJwTx9ENKyr2naSjDWoezR8DU4apOBuAvFK4m
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x720]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x42
pop ecx
mov esi, str.sLgeGSCPBaIfspMWaPJSAAFENNur9iFUcjXaVQv1IpzXScXDSluOKtuUeDIF24EOZJryee7rjfbvSDq0f1yTIIlVfho54B1vhzLkBjQrWzXC7Fweyihr7wYEcyB9jMb6wNTOHwofJkYL3ZBFeYA3nofKgGYUurWsb0HvQDoohr2mfEgkpVKGYhGW7cTX2rWxgATm23s48F7acnkazHTXe8uexxPsk59aTtT35nNNKPQMBmIF5Ax1hrrTgr8sfXVaA3WubxaAkv
mov dword [ebp - 0x740], eax
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x324]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x73c], eax
xor eax, eax
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x748], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x744], eax
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x738]
lea eax, [ebp - 0x720]
push eax
call fcn.00405a00
lea eax, [ebp - 0x738]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x74c]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 0
call fcn.006eb1be
lea eax, [ebp - 0x324]
push eax
lea ecx, [ebp - 0x738]
call fcn.00405a00
lea eax, [ebp - 0x738]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x74c]
call fcn.00407ea0
xor edi, edi
lea ecx, [ebp - 0x738]
push edi
push 1
call fcn.006eb1be
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push edi
push eax
call fcn.007512b0
push esi
lea eax, [ebp - 0x52c]
push edi
push eax
call fcn.007512b0
add esp, 0x18
lea eax, [ebp - 0x52c]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x743157
push ebx
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x218]
push str._s_s.url
push eax
call fcn.00407f20
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0x10
mov ebx, str.InternetShortcut
push eax
push dword [ebp - 0x73c]
push 0x8a0c00
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x740]
push str.IconFile
push ebx
call esi
lea eax, [ebp - 0x218]
mov edi, 0x7bdc04
push eax
push edi
push str.HotKey
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push edi
push str.IDList
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push edi
push str.IconIndex
push ebx
call esi
lea ecx, [ebp - 0x74c]
call fcn.006eb210
call fcn.007745cb
ret
Function at 0x743168
Capabilities:
Get common file path

Disassembly:
push 0x714
mov eax, 0x7b5b67
call fcn.00774621
push 0x70
pop ecx
mov esi, str.VVtZzOlIJ4rblJHAN3scOKFVTRi7Y9ZprDe1cZWq5mCnEFUTrCpE57x8NboipvL2bg0z1pAGU6CMLJmlrRuOt1cCqQA3bbbZUqPagy1kgDLXNs8zSDWAr56VMq1JlZZbnxfFhd8mQD1qEoFneq60C3jbbHrmPMuqPhcJ67xHDmVqgBuQHM8KsVLg49Ysof3CISI1QLraKbzE4AbBUW8Z0n9JnJSRN9iFHHUbUdphMUMtsksLdE3tRaLMaf313iKKXKcLsIXzFtQR8FGMcCPu8ahRLjRtA9kHG1AiFmuy2kPOA3Xkx8XvaFiBQ2bHPyOwFJfj2rHRmbzwgiDRc97EJmwuOwXTVuyFZivzDu4FmV8jCZmPUJRVhFFULgI8wJbGEMEWLHaxf7bRh9GafkEuvaZ539XwnFAAx6QsbMtdJMBhQU2tEnHblNoBBokh7Z4BI1
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x6f4]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x43
pop ecx
mov dword [ebp - 0x710], eax
movsw word es:[edi], word [esi]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x714], eax
xor eax, eax
mov dword [ebp - 0x720], eax
movsb byte es:[edi], byte [esi]
mov esi, str.OWZTWiszwrgQJUzJDIc3bFXelTATtHnkkjRuKJaZDrenyHlnEkZERB06mI2Gru1Fu6wOHagaIV4qZAAPanVXHLZOXIodrx0xoCWd7s8SwuUZkkbKjmj7YV0BokvgJkakRi37nryKhiijFHYHmWEUsfwGyyne8oSZxj7urLVGKObr4UC5pGi0dC3kHerwZuxEAbFZvnzFH1rFYIvRixgfJLZQcnEjwgCJahRgGUl4IaYoqiP5Q9K1uQlUcDHcCPwQfKvUZt3orUELO
mov dword [ebp - 0x71c], eax
lea edi, [ebp - 0x120]
mov dword [ebp - 0x718], eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x70c]
lea eax, [ebp - 0x6f4]
push eax
call fcn.00405a00
lea eax, [ebp - 0x70c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x720]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0
call fcn.006eb1be
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x70c]
call fcn.00405a00
lea eax, [ebp - 0x70c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x720]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0
call fcn.006eb1be
mov esi, 0x208
lea eax, [ebp - 0x530]
push esi
xor edi, edi
push edi
push eax
call fcn.007512b0
push esi
lea eax, [ebp - 0x328]
push edi
push eax
call fcn.007512b0
add esp, 0x18
lea eax, [ebp - 0x328]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x7432b5
push ebx
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x530]
push str._s_s.lnk
push eax
call fcn.00407f20
xor eax, eax
push eax
push eax
push eax
push 1
push dword [ebp - 0x710]
push eax
push dword [ebp - 0x714]
lea eax, [ebp - 0x530]
push eax
call fcn.007432c6
add esp, 0x30
lea ecx, [ebp - 0x720]
call fcn.006eb210
call fcn.007745cb
ret
Function at 0x743e53
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x743f21
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x218]
push edi
push edx
push edi
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push edx
push edi
mov dword [ebp - 0x218], edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x743f21
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x851b5c
push edi
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x743f21
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push dword [ebp - 0x214]
call fcn.00743d77
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006e615c
mov esp, ebp
pop ebp
ret

Function at 0x7440e0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x7441ad
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x7441ad
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x7441ac
push edi
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x7441ab
push edi
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x7441a4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
push 0x8b5784
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x7441a4
mov eax, dword [ebp - 0x210]
mov esi, dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.006e615c
mov esp, ebp
pop ebp
ret
Function at 0x7441be
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2bc]
push eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x2bc], ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x74424f
push edi
mov edi, 0x2b4
lea eax, [ebp - 0x2b8]
push edi
push ebx
push eax
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x208
push edi
push eax
push ebx
push dword [ebp - 0x2bc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop edi
setne bl
test bl, bl
je 0x744243
push 0x208
lea eax, [ebp - 0x2ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x2bc]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.006e615c
mov esp, ebp
pop ebp
ret 8

Function at 0x744263
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x10
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x744331
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x218]
push edi
push edx
push edi
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push edx
push edi
mov dword [ebp - 0x218], edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x744331
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x851b5c
push edi
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x744331
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push dword [ebp - 0x214]
call fcn.00743d77
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006e615c
mov esp, ebp
pop ebp
ret
Function at 0x745cc6
Capabilities:
Get common file path

Disassembly:
push 0x510
mov eax, 0x7b5d70
call fcn.00774621
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x510], eax
push 0x60
pop ecx
mov esi, str.FaiBQX3rHWx4KwQJc8U2OcS1oNNAakfjus1N08RvfkWVMoMxkFrH4d4CqYCZQe6CNkjIK2ItpneztYFlwjVzeZDbhQHvy6cE278ZCKIVN4leFb94n5UlX3fZVHs5wryIQyXeytJUdGQEi8WZ7PEb9sqLY2pJCtXMAu3cOYZK0PD8GZ9WmSBn6Szx3CcHdpHQolXOtzq3gQL3SBoiglBlzSCesDB6PkBfUzvhYXXtP2wQc79z3al2qtK5VQlC6QxzHvvcisMq9VuAgoGb2pZ9kTKHRQwgzadmbkFp5mgY6SRO1PFtloTImy9DBiOovv82SHD9yFvQrJDCLzMJYB2QwQXhvnSQ6dWLkE7yFmLH02N5GKuGeKeTIeS6VJU1YrBd
mov dword [ebp - 4], eax
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x4f4]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x4f4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x518]
call fcn.00407ea0
xor esi, esi
lea ecx, [ebp - 0x4f4]
push esi
push 1
call fcn.006eb1be
push 0x208
lea eax, [ebp - 0x4dc]
push esi
push eax
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x4dc]
push esi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x4e8], esi
mov dword [ebp - 0x4e4], esi
mov dword [ebp - 0x4e0], esi
push 0x50
pop ecx
mov esi, str.qBcXazESrEGpis7VVzB28gbnX2fvqFc9VgwEem23Zpj7Cdh1uYX0Uoe8lv8EdzZVdQUXnIJVSDZCejYKcRWSOSB9rdVJv0srj1YHPO3yRZaIFYT2Dki7V9fJl4wUh93JyrPh7jlPkSuyqpkecfUcBPh8DT4pxwgt0LGTmxZVx8OewUKui2WpBJTwygVZDhSoa8XXlYV3ePhrhtIR1H9CCmKF9qyElk1c9U5y3QuNyJR6oOjU6qDYLpXavvaIZ3oBjk5qzriuLd3nkHIOOGbZTjPHJYE7GJXjy7l7RkhGgOqSvrZXkF9femeiAWdAWWK
mov byte [ebp - 4], 2
lea edi, [ebp - 0x150]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x50c]
call fcn.00405a00
lea eax, [ebp - 0x50c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x50c]
mov byte [ebp - 4], 2
call fcn.006eb1be
lea eax, [ebp - 0x4dc]
mov ecx, ebx
push eax
call fcn.004026c0
lea ecx, [ebp - 0x4e8]
call fcn.006eb210
lea ecx, [ebp - 0x518]
call fcn.006eb210
mov eax, ebx
call fcn.007745cb
ret

Function at 0x745df1
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004026c0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.006e615c
mov esp, ebp
pop ebp
ret
Function at 0x745e57
Capabilities:
Get common file path

Disassembly:
push 0x538
mov eax, 0x7b5dc4
call fcn.00774621
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x538], eax
push 0x78
pop ecx
mov esi, str.8rXxlCcnj17lArTpgmzhtyPA1pTSJ2hIV8Ik51NSP2QHN34pQHVaxMleWUTATTHoko8B3zaVHiWmXsiXDpdh3TsJCTCHF7WJ4bM0V6DGs4D9SmaGFpWuWba6fWBX0ueCxm75L8WwKMn8wLMvK1cXeVvhR7m94QBeh2uaiK8cPXSXqKuSCcy17eY3SBnasRrzYYDzAxVcN266UylqNPY73RXPGp9q4P6taWXb509P8PHTsBfOGpchYaEK4W6z73TLWptr8hscxvAaBXgKPjIeFbs62f279nu5Ce1rvvVEk136VbwQQRg9EB1IEQHLEnho03GjET0PLIuDmuXwbkPpvidrGAbBUmVUcr1aN8xKpDCrlH3JKffgeqiLdCFntg46XQhSOsooqWTffGRCsYTyRUQB5ytnMhWfDsUPo8L2Cofj6GFpRIHyLb8KmE1B7xBOsH9u7dRhToQj75BlLsxTt341txkN8CjzT
mov dword [ebp - 4], eax
lea edi, [ebp - 0x504]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x51c]
movsw word es:[edi], word [esi]
call fcn.00405a00
lea eax, [ebp - 0x51c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x540]
call fcn.00407ea0
xor esi, esi
lea ecx, [ebp - 0x51c]
push esi
push 1
call fcn.006eb1be
push 0x208
lea eax, [ebp - 0x320]
push esi
push eax
call fcn.007512b0
add esp, 0xc
lea eax, [ebp - 0x320]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x510], esi
mov dword [ebp - 0x50c], esi
mov dword [ebp - 0x508], esi
push 0x41
pop ecx
mov esi, str.qvAzor8muKP2rcL7ESNWs0zhdxoqY20kF2CrWoyQ4JetdCQT0hnjYWzURROc0UzqVZiUrs4J34AHZGdumIh9ug08QAYENnFKzYGqj64UmuYSrv9W3LWnD3vzQZkTUBHlYlMO8k5sPadACHW5Iws7Xadh7gPmfB4FYhyxMvJjm79JtOqldufjckc8XlIj203wk9r5MeVWoLWrcdiTlDBIzVvEQCmBsJyCGhqnJ796XXCAEvsU1qwCVHSz7pIJxxGckwr8
mov byte [ebp - 4], 2
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x534]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x510]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 2
call fcn.006eb1be
lea eax, [ebp - 0x320]
mov ecx, ebx
push eax
call fcn.004026c0
lea ecx, [ebp - 0x510]
call fcn.006eb210
lea ecx, [ebp - 0x540]
call fcn.006eb210
mov eax, ebx
call fcn.007745cb
ret
Function at 0x745f85
Capabilities:
Check mutex on windows

Disassembly:
push 0x2dc
mov eax, 0x7b2b1d
call fcn.00774621
mov dword [ebp - 0x2dc], ecx
push 0x68
pop ecx
mov esi, str.71g9fJ4x2VXFps5IGOOvrDmD5LW7PpSxnDLj1S5WXNHlczBpEeSJY47qQECiZH1J1NvfSeGggzmBmdgGZyCMSP4Jt1Gl0Nl5ARN7pdrB31XWmLEeSyGQBDac7ukTuvTBCPiDyLhiK7yiJqIvWOfTwJSx2IjpgBGtoiGwRtPTPLXyyeGh3dYMMgzJyRxoD6gx9WmsGALrquonZeK96H6dAMDC1vKwHoE3BBZZwmSJOzonqZ4T4zh8FakzycG6v6pCdL6jOiZwbZQZG5Np82OUfmTCmcfRAZz8nuqY9HtqACPZiq4tPgivRhTkWeRYH8t1ZVqp1B9tGpLeA1MfVcpx2TtAisMYJLvmlOQtllBXNWdbqo6Ch8rEbzzMJsMsQeJxRlIlSUGQaxYesyEmWYqiFWFSvyw2bR4cp5
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x2c0]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x42
pop ecx
mov dword [ebp - 0x2e8], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], eax
movsb byte es:[edi], byte [esi]
mov esi, str.fTdZAz6V3OkBy1PHg2TsBxhAIlzBYWzbWyC92FigYFqgjWjt4VAIDShv968S2RuckoqRxYoeSyVtd4z86jlQ8vo4NrNkY2yWyVI1EFDicGnLlArnBAYs1ddr0mdi1mrdmdnOyzJN4ZuNfwIj7L3fwc0Dkl3UU0rk5Gi7B79YqJmwGgr7oRLWyBPvpzLlF1X1OTYkgj3r7TctoGkN26S28fMnwmbqJloEKnh8kljtHWz4fCXG3LeOdGh4vOnaTFecCvrMEAehI
lea edi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2d8]
lea eax, [ebp - 0x2c0]
push eax
call fcn.00405a00
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0
call fcn.006eb1be
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00405a00
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x2d8]
call fcn.006eb1be
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [ebp - 0x2dc]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [ebx + 4], ecx
lea ecx, [ebp - 0x2e8]
call fcn.006eb210
mov eax, ebx
call fcn.007745cb
ret 4

Function at 0x746fad
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x74778f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x7477ee
push esi
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.006e619d
pop ecx
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.00750d30
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x748d18
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.00402330
mov edx, dword [esi + 0x300]
or eax, 0xffffffff
cmp edx, eax
je 0x748d32
cmp edx, 1
jne 0x748d57
call fcn.00402330
xor eax, eax
push eax
push eax
push esi
push 0x74884d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.006ee8c5
xor eax, eax
pop esi
ret
Function at 0x74a8e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x74a97e
lea ecx, [eax + 0x80]
add eax, 0x100
dec edi
mov dword [ebp - 0x14], ecx
shr edi, 3
inc edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
mov edx, ebx
mov ecx, esi
push 8
sub edx, esi
pop edi
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x74a92e
push 8
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00750d30
push esi
push esi
push dword [ebp - 0x14]
call fcn.00749bd2
mov edx, dword [ebp - 0x18]
add esp, 0x18
xor ecx, ecx
mov al, byte [edx + ecx]
xor byte [esi + ecx], al
inc ecx
cmp ecx, 8
jl 0x74a957
push 8
lea eax, [ebp - 0xc]
push eax
push edx
call fcn.00750d30
add esp, 0xc
add ebx, 8
add esi, 8
sub dword [ebp - 0x10], 1
jne 0x74a925
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006e615c
mov esp, ebp
pop ebp
ret

Function at 0x74d817
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x74d8e4
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x851f80
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x851f80
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x851f80
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x851f80
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.00761c90
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x74d8c0
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.00761c90
pop ecx
pop ecx
test eax, eax
je 0x74d901
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x74d84a
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.00761470
pop ecx
test eax, eax
je 0x74d901
push ebx
mov ecx, edi
call fcn.0074e220
mov al, 1
jmp 0x74d903
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4