joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d3b3
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x894
push ebx
push ebp
push esi
push edi
push 0x428
lea eax, [esp + 0x47c]
mov ebx, ecx
push 0
push eax
call fcn.0041d750
add esp, 0xc
mov dword [esp + 0x10], 0x4f98e8
lea eax, [esp + 0x58]
or esi, 0xffffffff
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], esi
push dword [esp + 0x8ac]
push 0x104
push eax
call fcn.00403089
mov edi, dword [esp + 0x8a8]
mov dword [esp + 0x48], 0x50a84c
test edi, edi
je 0x44d5f1
cmp dword [esp + 0x8ac], 0
je 0x44d5f1
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x44d5f1
push edi
push 0x104
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0x26c]
call fcn.00403089
mov dword [esp + 0x260], 0x50a84c
cmp dword [esp + 0x268], ebp
jbe 0x44d5f1
push ecx
push 3
push 1
push closesocket
push dword [esp + 0x274]
lea ecx, [esp + 0x24]
call fcn.00401140
test al, al
je 0x44d5ed
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esi, dword [esp + 0x14]
xorps xmm0, xmm0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x488], ebp
mov dword [esp + 0x490], eax
mov dword [esp + 0x48c], ebp
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x44d4dd
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x44d4e6
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x898], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x89c], ecx
test edx, edx
je 0x44d52d
test eax, eax
je 0x44d549
mov ecx, ebp
test edx, edx
je 0x44d52d
cmp word [eax + ecx*2], 0x5c
jne 0x44d528
push 0x2f
pop edx
mov word [eax + ecx*2], dx
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
inc ecx
cmp ecx, edx
jb 0x44d512
test eax, eax
je 0x44d549
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x49c]
push 0x200
push eax
call fcn.0042a644
add esp, 0x10
lea eax, [esp + 0x478]
mov ecx, ebx
push eax
call fcn.0044cced
test al, al
je 0x44d5f1
cmp dword [ebx + 0x2b0], ebp
jne 0x44d583
push 0x4f186c
push 0x400080
call fcn.0041b84d
mov dword [ebx + 0x2b0], eax
pop ecx
pop ecx
test eax, eax
je 0x44d5f1
cmp esi, 0xffffffff
je 0x44d5e2
mov ebp, dword [ebx + 0x2b0]
test ebp, ebp
je 0x44d5e2
xor edi, edi
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, 0x400000
sub eax, edi
push eax
lea eax, [edi + ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44d5ca
cmp dword [esp + 0x10], 0
je 0x44d5ca
add edi, dword [esp + 0x10]
cmp edi, 0x400000
jb 0x44d594
test edi, edi
je 0x44d5e2
push edi
push dword [ebx + 0x2b0]
mov ecx, ebx
call fcn.0044cc2a
test al, al
jne 0x44d583
jmp 0x44d5f1
mov ecx, ebx
call fcn.0044c8c1
mov bl, al
jmp 0x44d5f3
mov esi, dword [esp + 0x14]
xor bl, bl
and dword [esp + 0x4c], 0
and dword [esp + 0x50], 0
mov dword [esp + 0x48], 0x50a8cc
cmp esi, 0xffffffff
je 0x44d611
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x894
ret 8
Function at 0x44e0a0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
push ebx
push edi
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x248], ax
xor edi, edi
lea eax, [ebp - 0x246]
push edi
push eax
call fcn.0041d750
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x248]
call fcn.0040e9b2
test al, al
jne 0x44e16c
call fcn.00409121
test al, al
je 0x44e16c
call fcn.004090c4
test al, al
jne 0x44e16c
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0041d750
add esp, 0xc
xor eax, eax
mov word [ebp - 0x450], ax
lea eax, [ebp - 0x44e]
push ebx
push edi
push eax
call fcn.0041d750
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x450]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4f992c
push 0x103
push eax
push edi
mov dword [ebp - 0x30], 0x50e67c
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb al, al
inc al
jmp 0x44e16e
mov al, 1
pop edi
pop ebx
leave
ret
Function at 0x44fb63
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.0044fb29
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jae 0x44fb91
and dword [esi + 0x118], 0
xor al, al
jmp 0x44fbd1
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x44fb86
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x44fbcf
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [esi + 0x110], 0
jmp 0x44fb86
mov al, 1
pop esi
ret 8

Function at 0x45177d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x4517ce
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x4517ce
ja 0x4517a0
cmp dword [ebp + 8], 0
jbe 0x4517ce
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x4fb800]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x4517a8
ja 0x4517ce
cmp ecx, dword [ebp + 8]
jb 0x4517a8
pop esi
pop ebx
leave
ret

Function at 0x451822
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x451858
test esi, esi
je 0x451863
xor edx, edx
test edi, edi
je 0x451863
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x45183d
jmp 0x451863
push 0x4fb800
call fcn.0045195c
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x451867
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4518a8
cmp dword [ebp + 0xc], 0
je 0x4518a8
test esi, esi
je 0x4518b3
xor ecx, ecx
test edi, edi
je 0x4518b3
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x45188b
jmp 0x4518b3
push 0x4fb800
call fcn.0045192e
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x451907
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x45192e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x45195a
xor ecx, ecx
test edx, edx
je 0x45195a
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x451943
pop edi
pop ebx
pop esi
ret
Function at 0x45195c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x451990
xor edx, edx
test edi, edi
je 0x451990
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x451974
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x4580bf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041d750
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004047c8
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.00403732
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x458141
mov eax, str.Install_Fail_Start_Program
jmp 0x458170
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x45815f
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x458169
push dword [ebp - 0xc]
call esi
mov bl, 1
mov eax, str.Install_Executed
push eax
mov ecx, 0x556880
call fcn.00444579
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x458182
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x69c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 3
jne 0x458381
xor ebp, ebp
cmp dword [edi + 0xa3fc], ebp
ja 0x4581b2
cmp dword [edi + 0xa3f8], 0x40
jb 0x458381
lea ecx, [esp + 0x80]
call fcn.0040338e
lea ecx, [esp + 0x298]
call fcn.004047c8
lea ecx, [esp + 0x10]
call fcn.00451993
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x80]
add eax, 0x29c
push eax
call fcn.004031f2
mov edx, dword [esp + 0x84]
test edx, edx
je 0x45820b
mov eax, dword [esp + 0x88]
inc eax
push eax
push edx
call fcn.0042e95a
mov edx, dword [esp + 0x8c]
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.00451907
mov eax, dword [esp + 0x88]
add eax, eax
push eax
push edx
call fcn.004519fa
lea ecx, [esp + 0x10]
call fcn.00451ab2
push dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push dword [esp + 0x88]
call fcn.00451b22
push dword [esp + 0x29c]
push ebp
push ebp
push 0x1a
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x298]
call fcn.00403e87
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
push dword [esp + 0x2a0]
call esi
push 0x50d510
lea ecx, [esp + 0x29c]
call fcn.004035e9
push ebp
push dword [esp + 0x2a0]
call esi
push str.Terminal_
lea ecx, [esp + 0x29c]
call fcn.004035e9
push ebp
push dword [esp + 0x2a0]
call esi
push dword [esp + 0x84]
lea ecx, [esp + 0x29c]
call fcn.004035e9
push ebp
push dword [esp + 0x2a0]
call esi
push 0x5134ac
lea ecx, [esp + 0x29c]
call fcn.004035e9
push ebp
push dword [esp + 0x2a0]
call esi
push str._server.ini
lea ecx, [esp + 0x29c]
call fcn.004035e9
push ecx
push ecx
push dword [esp + 0x2a4]
lea ebx, [edi + 0xa3f0]
mov ecx, ebx
call fcn.0040418b
test al, al
je 0x458352
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x29c]
push str._sconfig_servers.dat
push eax
call fcn.00403732
add esp, 0xc
push dword [esp + 0x29c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call fcn.00443f2c
push str.Account_Request_Finish
mov ecx, 0x556880
call fcn.00444579
mov esi, str.Account_Request_Success
jmp 0x458357
mov esi, str.Account_Request_Error
mov edi, 0x556880
push esi
mov ecx, edi
call fcn.00444579
push ebp
push esi
push ebp
push ebp
push edi
call fcn.0044434f
add esp, 0x14
mov ecx, ebx
call fcn.00404755
lea ecx, [esp + 0x10]
call fcn.004519ce
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x69c
ret
Function at 0x45838c
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x14]
push edi
call fcn.0040338e
mov eax, dword [ebp + 0x58]
xor ebx, ebx
add eax, 0x6ac
mov dword [esp + 0x10], ebx
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.00403732
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, 0x20206
mov ecx, 0x20106
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x58]
push ebx
cmp dword [eax + 4], 2
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4585cb
mov esi, dword [ebp + 0x58]
add esi, 0x94
mov ecx, esi
call fcn.00408f92
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [esp + 0x24]
call edi
mov esi, dword [ebp + 0x58]
add esi, 0x29c
mov ecx, esi
call fcn.00408f92
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.InstallLocation
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x1c]
push str._s_terminal.ico
push eax
call fcn.00403732
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45849b
mov ecx, dword [ebp + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [esp + 0x20]
push 0x50e448
push eax
call fcn.00403732
add esp, 0x10
mov eax, dword [esp + 0x20]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push ebx
push str.DisplayIcon
push dword [esp + 0x24]
call edi
push 0x20
push 0x50a1b0
push 1
push ebx
push str.Publisher
push dword [esp + 0x24]
call edi
push 0x36
mov esi, 0x51336c
push esi
push 1
push ebx
push str.HelpLink
push dword [esp + 0x24]
call edi
push 0x36
push esi
push 1
push ebx
push str.UrlInfoAbout
push dword [esp + 0x24]
call edi
mov esi, dword [esp + 0x234]
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
push dword [esi + 4]
push 1
push ebx
push str.UninstallString
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
push 0xa
cmp dword [eax + 8], 9
jae 0x45853f
push str.5.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x513420
jmp 0x458559
push str.4.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x51346c
push 1
push ebx
push 0x513424
push dword [esp + 0x24]
call edi
push 4
push 0x513440
push 1
push ebx
push 0x513444
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xa4a8]
call fcn.00401887
test al, al
jne 0x4585c9
push dword [ebp + 0xa4ac]
lea eax, [esp + 0x1c]
push 0x513470
push eax
call fcn.00403732
mov eax, dword [ebp + 0x58]
add esp, 0xc
add eax, 0x29c
push 1
push dword [esi + 4]
push ecx
push ecx
push dword [esp + 0x2c]
push dword [esi + 4]
push eax
call fcn.004626b2
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x220
ret 4
Function at 0x4585da
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.0040338e
lea ecx, [ebp - 0x430]
call fcn.0040338e
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.00403e87
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.00403732
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x458661
lea eax, [ebp - 0x430]
mov ecx, esi
push eax
mov bl, 1
call fcn.0045838c
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x458667
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.0040338e
lea ecx, [ebp - 0x648]
call fcn.0040338e
lea ecx, [ebp - 0x430]
call fcn.0040338e
mov eax, dword [esi + 0x58]
xor bl, bl
cmp dword [eax + 8], 0xb
je 0x4586ac
cmp dword [eax + 8], 0xd
je 0x4586ac
cmp dword [eax + 8], 3
jne 0x4586ed
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._s_terminal.ico
push eax
call fcn.00403732
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4586ed
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x4586ed
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push 0x50e448
push eax
call fcn.00403732
mov ecx, dword [esi + 0x58]
add esp, 0x10
push dword [ebp - 0x42c]
lea eax, [ecx + 0x94]
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.004627f4
test eax, eax
je 0x45877f
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x45876a
push dword [ebp - 0x20c]
push eax
call fcn.0042a771
pop ecx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
pop ecx
jmp 0x458771
and dword [ebp - 0x210], 0
push eax
lea ecx, [esi + 0x88c]
call fcn.00416ebc
mov bl, al
mov ecx, dword [esi + 0x58]
cmp dword [ecx + 8], 0xb
je 0x458792
cmp dword [ecx + 8], 3
jne 0x458861
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x4587a8
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
mov edx, 0x4f992c
mov eax, 0x512ccc
cmp dword [ecx + 4], 2
cmovne eax, edx
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push str._smetaeditor_s.exe
push eax
call fcn.00403732
add esp, 0x10
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x458861
push dword [ebp - 0x42c]
mov ecx, dword [esi + 0x58]
mov edx, str.MetaEditor_5
push dword [ebp - 0x20c]
mov eax, str.MetaEditor_4
push dword [ebp - 0x214]
cmp dword [ecx + 8], 0xb
cmovne eax, edx
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.004627f4
test eax, eax
je 0x458861
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x45884c
push dword [ebp - 0x20c]
push eax
call fcn.0042a771
pop ecx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
pop ecx
jmp 0x458853
and dword [ebp - 0x210], 0
push eax
lea ecx, [esi + 0x88c]
call fcn.00416ebc
mov bl, al
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x458991
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x10a4
call fcn.0041c880
cmp dword [esp + 0x10b0], 0
push ebx
push ebp
push esi
push edi
jne 0x4589b0
xor al, al
jmp 0x458b9b
push ecx
lea eax, [esp + 0xb4]
push eax
call fcn.004445e8
test al, al
je 0x4589f3
mov ecx, dword [esp + 0x10bc]
push str..exe
call fcn.00403644
test eax, eax
jle 0x4589f3
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x10c8]
push eax
push dword [esp + 0x10c8]
call fcn.00461492
mov ebx, dword [esp + 0x10b8]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
cmp eax, 0xffffffff
je 0x458a9e
lea ecx, [esp + 0x40]
call fcn.00451993
push ebx
lea ecx, [esp + 0x44]
call fcn.004516e9
lea ecx, [esp + 0x40]
call fcn.00451ab2
lea esi, [esp + 0x98]
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00451907
push dword [esp + 0x10c4]
push dword [esp + 0x10c4]
call fcn.004519fa
lea ecx, [esp + 0x40]
call fcn.00451ab2
lea esi, [esp + 0x98]
mov ecx, ebp
lea edi, [esp + 0x30]
movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x30]
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x458a95
inc ecx
cmp ecx, 4
jne 0x458a77
lea ecx, [esp + 0x40]
call fcn.004519ce
mov al, 1
jmp 0x458b9b
lea ecx, [esp + 0x40]
call fcn.004519ce
or dword [esp + 0x1c], 0xffffffff
mov esi, 0x40000000
push ecx
push 2
push 3
push esi
push dword [ebx + 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x4f98e8
call fcn.00401140
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
jne 0x458b13
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x458ae8
push 0x80
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ecx
push 2
push 3
push esi
push dword [ebx + 4]
lea ecx, [esp + 0x2c]
call fcn.00401140
test al, al
jne 0x458b13
push str.Install_Fail_File_Write_Open
mov ecx, 0x556880
call fcn.00444579
mov esi, dword [esp + 0x1c]
jmp 0x458b7a
mov esi, dword [esp + 0x1c]
mov eax, ebp
mov dword [esp + 0x14], eax
cmp esi, 0xffffffff
je 0x458b4e
cmp eax, dword [esp + 0x10c4]
jae 0x458b55
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10cc]
push dword [esp + 0x10cc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10c4]
je 0x458b7e
push str.Install_Fail_File_Write
mov ecx, 0x556880
call fcn.00444579
cmp esi, 0xffffffff
je 0x458b71
push esi
call edi
or esi, 0xffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
jmp 0x458b91
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x458b8f
push esi
call edi
or esi, 0xffffffff
mov bl, 1
cmp esi, 0xffffffff
je 0x458b99
push esi
call edi
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10a4
ret 0x10
Function at 0x4597e2
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
mov edi, 0x29c
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x459814
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.00461b60
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.004625ad
xor ebx, ebx
test eax, eax
je 0x459833
mov ecx, dword [esi + 0x58]
add ecx, edi
call fcn.0040e9b2
test al, al
jne 0x45986f
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x45986f
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x94]
push eax
lea eax, [esp + 0x14]
push eax
push 0x50e448
lea eax, [ecx + 0x29c]
push 0x103
push eax
call fcn.0041664a
add esp, 0x14
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.004625ad
test eax, eax
je 0x459926
push dword [esi + 0x60]
mov ecx, esi
call fcn.00458e4d
test al, al
jne 0x4598af
push str.Install_Fail_Extract_Core
mov ecx, 0x556880
call fcn.00444579
lea ecx, [esi + 0x49d0]
call fcn.00460feb
jmp 0x459935
mov ecx, esi
call fcn.00458867
test al, al
je 0x459935
mov ecx, esi
call fcn.00458f96
mov byte [esi + 0xa6c2], al
test al, al
je 0x459935
mov ecx, esi
call fcn.00458f50
test al, al
je 0x459935
mov ecx, esi
call fcn.00458667
mov edi, 0x556880
test al, al
jne 0x4598f2
push str.Install_Fail_Create_Shortcut
mov ecx, edi
call fcn.00444579
mov ecx, esi
call fcn.004585da
test al, al
jne 0x459909
push str.Install_Fail_Create_Uninstall
mov ecx, edi
call fcn.00444579
mov ecx, esi
call fcn.00458182
mov ecx, esi
call fcn.004580bf
test al, al
je 0x459935
mov ecx, esi
call fcn.004594a1
mov al, 1
jmp 0x459948
push str.Install_Fail_Create_Folder
mov ecx, 0x556880
call fcn.00444579
push ebx
push 7
push 0x464
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45999c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x49d0]
call fcn.00460d02
mov ecx, esi
call fcn.00459a25
cmp byte [ebp + 8], 0
je 0x4599f6
mov byte [esi + 0xa6c0], 1
mov dword [esi + 0xa3bc], 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
lea ecx, [esi + 4]
call fcn.0041669c
jmp 0x459a1d
xor ebx, ebx
push ebx
push dword [esi + 0xa744]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
mov ecx, esi
call fcn.0045a531
mov word [esi + 0xa6c0], 0x100
mov dword [esi + 0xa3bc], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4