joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1342
Capabilities:
Get common file path

Disassembly:
push 0x728
mov eax, 0x545b57
call fcn.00506b61
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x500]
push 0x62
pop ecx
mov esi, str.sW5zcFc2BGgCu6cSLomZVjqndlLbVd99a8joDxLzSLC3eCTnDmefIJbKeYlWrUkRLChwTQH5L7CS35z9Sdg7dgCm5qQJqV0MlpZBs1a0MqEalOhhMJ45Pp1LATVHvCycQFoPSTmIfsHqHSA24dGF8dtwos62sadscw7V80WI2V9LlTCWAM3E99eAFDfnfaVnzlG2sNGIiN01vAAcMlVD6M6wNoEboudBzEQmI5S77WqbtISXzog3cg21ACBsBfjtEJYcP1fMf4U6xo2tA2u9nvCPOLPPkkxCDZDRfRvHr1CZY0KJekBONXMtOtkhkOFmPfdoi60HZqkrBTPzTWPYSLImuOW3ksuMUkoS4hQ3Rf1sBIIMFBRvqlI6MUL6lM4dE1eZBACwP
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x728], eax
mov eax, dword [ebp + 0x10]
push 0x57
movsw word es:[edi], word [esi]
mov dword [ebp - 0x724], eax
lea edi, [ebp - 0x374]
xor eax, eax
mov esi, str.bGzaJez22aMmyCQqok3FPMpZ5SgmG7BrwU3WgSjmpL0LDrjs5UVUaeqcPCXUEAYFcaugaaew4qqYC9T6SlU6RHXC3BK1Awnu1d9j9otAqJaos5IBwxi2YIKB50MIGuyddLHULOAxhEDkwxZZTN8KF4vq9Qnt1YCQ1qWyGHuWYKDPClsOfqhwiuv1Mfx97h1Q5NQp5y11pnqXs5dCCPV3I6MdSSofLEGpRNgJ8afPm1S1ThcV4rMvPbmJPVO73GbJzhDCZrnqFTHzxprczCvaIWGPrIYeOmBzqcpJDuuka9KkutgHGFQd37MC6VCHd46CtsBKEHAXwjxD0tKz2yBtVaspf2G
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x72c], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x720]
lea eax, [ebp - 0x500]
push eax
call fcn.00405820
lea eax, [ebp - 0x720]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x734]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x720]
mov byte [ebp - 4], 0
call fcn.0046d37e
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x720]
call fcn.00405820
lea eax, [ebp - 0x720]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x734]
call fcn.00407e30
xor edi, edi
lea ecx, [ebp - 0x720]
push edi
push 1
call fcn.0046d37e
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push edi
push eax
call fcn.004e37a0
push esi
lea eax, [ebp - 0x708]
push edi
push eax
call fcn.004e37a0
add esp, 0x18
lea eax, [ebp - 0x708]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4d14d5
push ebx
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x218]
push str._s_s.url
push eax
call fcn.00407eb0
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0x10
mov ebx, str.InternetShortcut
push eax
push dword [ebp - 0x724]
push 0x629950
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x728]
push str.IconFile
push ebx
call esi
lea eax, [ebp - 0x218]
mov edi, 0x569d24
push eax
push edi
push str.HotKey
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push edi
push str.IDList
push ebx
call esi
lea eax, [ebp - 0x218]
push eax
push edi
push str.IconIndex
push ebx
call esi
lea ecx, [ebp - 0x734]
call fcn.0046d3d0
call fcn.00506b0b
ret
Function at 0x4d14e6
Capabilities:
Get common file path

Disassembly:
push 0x6d4
mov eax, 0x545ba0
call fcn.00506b61
push 0x6b
pop ecx
mov esi, str.lrtKeEjuXNEX06kIBiiL4ZK564GC1Xjv8pyItZGgfYeEWiCWsjPxKotGTHcdvgDC80EDLaYiGSpmg2gstDnuHUTTooebXcwbLI369B62KDBVqqpkmToZmwMoCRj0o39aZ9PjJ3y6J3BHb6bP4bDV4Mf5FyzHRBroYrZbuxVmoiz61pTrW7bUtABXlAUVoP65s25mn7x3WN1ZmX2AtScdatNIuYnw8Kpl4SqdFiGURnR2uShGGmfvcyekmnzr5xCk6WpBaNbqCyEb5JxyvZToq26glsKTbU7w0v0BDQZhupncOoK8RRZIqUyaoTRC8U00jcs35XkWSKhqBBjF5QzudeQMxzqDkfVIp907at33wLVfgeB2eF2gU4rqc1zfpkgZQyZBp0Db3M2FQNzJw8GzYYXwaeSxXLLH6EjFJAWqKu6n5D
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x6b4]
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp + 0x10]
push 0x39
movsw word es:[edi], word [esi]
mov dword [ebp - 0x6d4], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x6e0], eax
movsb byte es:[edi], byte [esi]
mov esi, str.5GVXDCeSB3k3H4dE77bDHFalhq29Hygrqt3sXoKO9dT3prHwc88wEACrveBaxKAtMJcxsRyiQYGNducvRVy3yBbnnWIT9emQKg6JCA7BDgV0nQSCMiOXnQOAHCjrDKCcKitxrBMoIYHZ7QnCkoNYCX44lfr0RKe0I5eJElVABu5giojTeAr1TDjWBrsswKzlEnj1JpQaecUwEhGqZjKLWUhVx5Ne3PUl6jO
mov dword [ebp - 0x6dc], eax
lea edi, [ebp - 0xf4]
mov dword [ebp - 0x6d8], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x6cc]
lea eax, [ebp - 0x6b4]
push eax
call fcn.00405820
lea eax, [ebp - 0x6cc]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x6e0]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x6cc]
mov byte [ebp - 4], 0
call fcn.0046d37e
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x6cc]
call fcn.00405820
lea eax, [ebp - 0x6cc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x6e0]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x6cc]
mov byte [ebp - 4], 0
call fcn.0046d37e
mov esi, 0x208
lea eax, [ebp - 0x504]
push esi
xor edi, edi
push edi
push eax
call fcn.004e37a0
push esi
lea eax, [ebp - 0x2fc]
push edi
push eax
call fcn.004e37a0
add esp, 0x18
lea eax, [ebp - 0x2fc]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4d1631
push ebx
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x504]
push 0x5bea34
push eax
call fcn.00407eb0
xor eax, eax
push eax
push eax
push eax
push 1
push dword [ebp - 0x6d0]
push eax
push dword [ebp - 0x6d4]
lea eax, [ebp - 0x504]
push eax
call fcn.004d1642
add esp, 0x30
lea ecx, [ebp - 0x6e0]
call fcn.0046d3d0
call fcn.00506b0b
ret
Function at 0x4d21d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x4d22a0
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x218]
push edi
push edx
push edi
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push edx
push edi
mov dword [ebp - 0x218], edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4d22a0
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x5dbdf0
push edi
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x4d22a0
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push dword [ebp - 0x214]
call fcn.004d20f6
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4d245f
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4d252c
push 0x5dbf7c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4d252c
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4d252b
push edi
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4d252a
push edi
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4d2523
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
push 0x63d88c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4d2523
mov eax, dword [ebp - 0x210]
mov esi, dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret
Function at 0x4d253d
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2bc]
push eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x2bc], ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x4d25ce
push edi
mov edi, 0x2b4
lea eax, [ebp - 0x2b8]
push edi
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x208
push edi
push eax
push ebx
push dword [ebp - 0x2bc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
pop edi
setne bl
test bl, bl
je 0x4d25c2
push 0x208
lea eax, [ebp - 0x2ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x2bc]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret 8

Function at 0x4d25e2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x10
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x4d26b0
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x218]
push edi
push edx
push edi
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], edi
push edx
push edi
mov dword [ebp - 0x218], edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4d26b0
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x5dbdf0
push edi
push dword [ebp - 0x218]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x4d26b0
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
push dword [ebp - 0x214]
call fcn.004d20f6
mov eax, dword [ebp - 0x214]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret
Function at 0x4d4045
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004024f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4d40ab
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004024f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4d4111
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004024f0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret
Function at 0x4d66cb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x546170
call fcn.00506b2d
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.004c035c
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004c054c
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4d670b
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d676b
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4d6746
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d676b
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.004c043e
call fcn.00506af6
ret 0xc
Function at 0x4d6b95
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x546200
call fcn.00506b61
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x4d6c8c
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x4d6c11
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402650
and dword [ebp - 4], 0
push 0x63d88c
call fcn.004f3a59
pop ecx
push eax
push 0x63d88c
lea ecx, [ebp - 0x230]
call fcn.00404290
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004d6857
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x4d6c7d
call fcn.00402590
mov eax, edi
jmp 0x4d6d3e
or dword [ebp - 4], 0xffffffff
call fcn.00402590
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x4d6d3c
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x4d6cd3
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00402650
mov esi, 0x63d88c
mov dword [ebp - 4], 1
push esi
call fcn.004f3a59
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00404290
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004d6857
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.00402590
test esi, esi
je 0x4d6d3c
mov eax, esi
jmp 0x4d6d3e
xor eax, eax
call fcn.00506b0b
ret 4
Function at 0x4d78c6
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0x83c
mov eax, 0x546344
call fcn.00506b61
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], ebx
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
je 0x4d7931
lea eax, [ebp - 0x218]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.00402650
mov dword [ebp - 4], ebx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push ebx
call fcn.004f3a59
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x848]
call fcn.00404290
xor ebx, ebx
cmp word [esi], bx
jne 0x4d796b
mov eax, ebx
jmp 0x4d7972
push esi
call fcn.004f3a59
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.00404290
mov esi, str..lnk
push esi
call fcn.004f3a59
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.00404290
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x4d7a80
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.004e37a0
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.004e37a0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.004f3a37
add esp, 0x20
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.004d62b3
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.004f3a59
pop ecx
test eax, eax
jne 0x4d7a6e
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f3a37
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x4d7a80
xor esi, esi
inc esi
jmp 0x4d7a82
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x848]
call fcn.00402590
mov eax, esi
call fcn.00506b0b
ret 4
Function at 0x4d7a9a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x65db08]
test al, al
jne 0x4d7b33
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4d7b2a
lea eax, [ebp - 0x20c]
push eax
call fcn.004ee398
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.004e2b55
pop ecx
pop ecx
test eax, eax
jne 0x4d7b22
lea eax, [ebp - 0x20c]
push str.cocuments_and_settingslocalService
push eax
call fcn.004e2b55
pop ecx
pop ecx
test eax, eax
je 0x4d7b2a
mov byte [0x65db08], bl
jmp 0x4d7b30
mov bl, byte [0x65db08]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret
Function at 0x4d8505
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4d8570
lea eax, [ebp - 0x20c]
push 0x63d88c
push eax
call fcn.004f39c6
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004d7b41
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret 4

Function at 0x4d859a
Capabilities:
Check mutex on windows

Disassembly:
push 0x3c4
mov eax, 0x5464dc
call fcn.00506b61
mov dword [ebp - 0x3c4], ecx
push 0x6d
pop ecx
mov esi, str.LwnDxgBKT40nh2iJE8zjoLlKhVQ5WWtsSUK3RKf8eriCOipJgcvwCGdPDk5Vy3jmlsBe0RIaxh7Yn8ZE3dnehuPVle63EfM7i3BJKAbL0Kn1qRoZVzPfM02Nm4FZjItVsP0MTEimgc6C888PgKJBHbYk8Hgj7yq2dcIUSjBXhIbsJkx8sl5r6E1HJmIgU9CDXSxpBzelbaIS5xOu14C1nWc60dVouL1Fv1Q18OVFxqrXZA8Gu2KoKVTEy5FCOvtNnCfGGT9MJBnDIgQ8fqFzD0kwS3VTIaXSVl8JF1IQvhRDOjcmGIv7bObvt45FcfRcx64hTcVA3CR8hydS3ZoaJXwoaX5nEtvkNcWxaxil8gLW36L4xkDgKqaJUeb2Y7j30tWS2yVRAPdKvkVjCOom6mjPn5jKJZreufwCoc4Tn4Gy6ZtVQMZv
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x77
pop ecx
mov dword [ebp - 0x3d0], eax
movsb byte es:[edi], byte [esi]
mov esi, str.DHEl5SGRssw5ozWS1dXXVnp4edlfMNF03v7dq6RCJAHsQb1Hb3BqeCp1nvDlTVjF33scA5AtsCAnoi5ZN0TJuHyz03AnmxG3XRf4Aa0Q6mwqIpN59WrejLLRGE8SV5D4Zt4FtNlTUJfRvzAuCNNUrUpOfMxCX7nOO37njq8CFi2edE5xTEZdGA3lijVwnSzx66bDDbKvASUsRltFLhlcWNUNjytDJblk3OsiaOpby5Eb5XCAcuA0fIO0qxQjw9hDhJsnZYwACWk31exZy5auQv7QEPVOC3qqgYiXifHWmuftb4L7LgCXQio1KTT3ZHJBfjIAoY20Fc0tOaKoskP7NukhZg4KVuTr20m1eJ5GG577h7dBA5DMaXq70K9yol0zB5MwcrHoF82PvmXNZMjcQ19tvPDsa69kVuAQNNHgYFajrlJV2TizskEMVbqe7A8gcITdLKUEmg7YRxaLEo6npijKX65h3i
mov dword [ebp - 0x3cc], eax
lea edi, [ebp - 0x3a8]
mov dword [ebp - 0x3c8], eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x3c0]
lea eax, [ebp - 0x1c8]
push eax
call fcn.00405820
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x3d0]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0
call fcn.0046d37e
lea eax, [ebp - 0x3a8]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.00405820
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3d0]
call fcn.00407e30
push 0
push 1
lea ecx, [ebp - 0x3c0]
call fcn.0046d37e
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [ebp - 0x3c4]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [ebx + 4], ecx
lea ecx, [ebp - 0x3d0]
call fcn.0046d3d0
mov eax, ebx
call fcn.00506b0b
ret 4
Function at 0x4d926a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4d92c9
push esi
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.0046831d
pop ecx
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.004e3220
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret