joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404812
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40483d
push dword [ebp + 8]
push str.DING::CFilePacker::ContainsPackage_552__:_packed_file_does_not_exist:__s_r_n
call fcn.00416f04
pop ecx
pop ecx
xor al, al
pop esi
pop ebx
leave
ret
lea ecx, [ebp - 0x1c]
call fcn.0042cd47
xor ebx, ebx
push ebx
push 0x8000000
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.0042d0bc
test eax, eax
jne 0x404885
lea ecx, [ebp - 0x1c]
call fcn.0042d07f
push eax
push str.DING::CFilePacker::ContainsPackage_563__:_failed_to_open_this_file:__lu_r_n
call fcn.00416f04
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0042d0a5
jmp 0x404837
lea eax, [ebp - 0x40]
call fcn.0040654b
push ebx
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00406589
test al, al
jne 0x4048a8
push 0x47de5c
call fcn.00416f04
jmp 0x40487a
mov esi, dword [ebp - 0x20]
push esi
push str.End_of_EXE_module:__lu
call fcn.00416edc
pop ecx
pop ecx
push 4
lea eax, [ebp - 8]
push eax
push ebx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], ebx
call fcn.0042d18e
test eax, eax
jne 0x4048df
lea ecx, [ebp - 0x1c]
call fcn.0042d07f
push eax
push str.failed_to_read_signature_size_from_end_of_PE___lu__r_n
jmp 0x404874
mov eax, dword [ebp - 8]
add esi, eax
cmp eax, ebx
jne 0x4048eb
add esi, 4
push esi
push str.REAL_End_of_EXE_module:__lu
call fcn.00416edc
pop ecx
pop ecx
push ebx
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.0042cd74
lea ecx, [ebp - 0x1c]
test eax, eax
jne 0x404923
call fcn.0042d07f
push eax
push esi
push str.DING::CFilePacker::ContainsPackage_602__:_failed_to_seek_to__lu___lu__r_n
call fcn.00416f04
add esp, 0xc
jmp 0x40487b
push 4
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
call fcn.0042cdf8
test eax, eax
jne 0x404948
lea ecx, [ebp - 0x1c]
call fcn.0042d07f
push eax
push str.DING::CFilePacker::ContainsPackage_610__:_failed_to_Read_signature___lu__r_n
jmp 0x404874
cmp dword [ebp - 0xc], 0x42506370
je 0x40496b
push str.package_not_found
call fcn.00416edc
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0042d0a5
mov al, bl
jmp 0x404839
mov bl, 1
jmp 0x40495c
Function at 0x4077cb
Capabilities:
Delete directory
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
test esi, esi
je 0x4078da
push esi
call fcn.0045a12c
pop ecx
cmp eax, 4
jb 0x4078da
movzx eax, byte [ebp + 8]
neg eax
sbb eax, eax
and eax, 2
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 4
or eax, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x407bb6
push 1
push 0
push 0x47de90
push esi
call fcn.00408049
mov edi, eax
add esp, 0x18
cmp edi, 0x80070490
jne 0x40782f
xor eax, eax
jmp 0x4078ec
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4078b5
cmp byte [ebp + 8], al
je 0x407895
push esi
push str.delete_on_reboot:__s
call fcn.00416edc
pop ecx
pop ecx
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40788e
test bl, bl
je 0x407880
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.DING::CUtils::DeleteFolder_346__:_MoveFileEx_failed_to_delete_folder:__s___lu__r_n
call fcn.00416f04
add esp, 0xc
movzx eax, bl
neg eax
sbb eax, eax
and eax, 0x80004005
jmp 0x4078ec
mov eax, 0x80070bc2
jmp 0x4078ec
test bl, bl
je 0x4078b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4078b5
push eax
push esi
push str.DING::CUtils::DeleteFolder_360__:_failed_to_delete_folder:__s___lu__r_n
call fcn.00416ef0
add esp, 0xc
test edi, edi
jge 0x4078c0
mov eax, 0x80004005
jmp 0x4078ec
mov al, byte [ebp - 4]
and al, 1
dec al
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x7ff8f43e
add eax, 0x80070bc2
jmp 0x4078ec
push esi
push str.DING::CUtils::DeleteFolder_324__:_invalid_path:__s
call fcn.00416f04
pop ecx
pop ecx
mov eax, 0x80070057
pop edi
leave
ret
Function at 0x407b2e
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
test esi, esi
je 0x407ba3
push esi
call fcn.0045a12c
pop ecx
cmp eax, 4
jb 0x407ba3
push 0
push 0x407f92
push 1
push 0
push 0x47de90
push esi
call fcn.00408049
add esp, 0x18
cmp eax, 0x80070490
jne 0x407b61
xor eax, eax
ret
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x407b5e
push esi
push str.delete_on_reboot:__s
call fcn.00416edc
pop ecx
pop ecx
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x407b9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.DING::CUtils::DeleteEmptyFolders_617__:_MoveFileEx_failed_to_delete_folder:__s___lu__r_n
call fcn.00416f04
add esp, 0xc
mov eax, 0x80070bc2
ret
push esi
push 0x47ffe0
call fcn.00416f04
pop ecx
pop ecx
mov eax, 0x80070057
ret
Function at 0x408c98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
mov esi, 0x497a28
push esi
lea ecx, [ebp - 8]
call fcn.004037fc
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x408cd7
mov esi, 0x8007000e
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
mov eax, esi
pop esi
leave
ret
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0xc]
cmp eax, 4
je 0x408ceb
cmp eax, 5
je 0x408ceb
xor esi, esi
jmp 0x408cc7
push esi
lea ecx, [ebp - 4]
call fcn.004037fc
push str.fallback.dat
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0042e630
add esp, 0xc
test al, al
jne 0x408d19
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x408cc2
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call esi
cmp eax, 0xffffffff
je 0x408e10
push dword [ebp - 4]
call esi
cmp eax, 0xffffffff
jne 0x408e10
mov ecx, dword [ebp - 4]
push 0
call fcn.004082c4
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0042cd47
push 0
push 1
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.0042d0bc
test eax, eax
je 0x408df5
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x480b70
push dword [ebp - 8]
call fcn.0045bcce
add esp, 0xc
cmp eax, 1
jne 0x408dac
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call fcn.00409503
pop ecx
pop ecx
test al, al
jne 0x408dac
lea ecx, [ebp - 0x1c]
call fcn.0042d0a5
jmp 0x408d0c
mov eax, dword [ebp - 8]
mov esi, dword [eax - 0xc]
lea ecx, [ebp - 0x9c]
push 3
mov dword [ebp - 0xa0], ecx
push eax
lea ecx, [ebp - 0xa0]
call fcn.00409f97
push esi
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1c]
call fcn.0042ce6f
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0xa0], eax
je 0x408df5
push dword [ebp - 0xa0]
call fcn.0045b8df
pop ecx
push dword [ebp - 8]
push dword [ebp - 4]
push str._s_created_for__s
call fcn.00416edc
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0042d0a5
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x408ce7
Function at 0x40aff6
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor ecx, ecx
cmp byte [esi], cl
je 0x40b008
mov ecx, 0x10000000
mov eax, dword [esi + 0xc]
push ecx
push 0
push 0
push 1
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0x50], eax
test eax, eax
jne 0x40b04c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.WinHttpOpen_call_failed__Error_lu
call fcn.00416f04
pop ecx
pop ecx
test esi, esi
jle 0x40b045
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x40b0ff
mov eax, dword [esi + 0x2c]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40b070
push eax
push str.setting_timeout_to__lus
call fcn.00416edc
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
pop ecx
pop ecx
mov dword [ebp - 4], eax
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [ebp - 4]
push eax
push 3
push dword [esi + 0x50]
call edi
test eax, eax
je 0x40b0bb
push 4
lea eax, [ebp - 4]
push eax
push 5
push dword [esi + 0x50]
call edi
test eax, eax
je 0x40b0bb
push 4
lea eax, [ebp - 4]
push eax
push 6
push dword [esi + 0x50]
call edi
test eax, eax
je 0x40b0bb
push 4
lea eax, [ebp - 4]
push eax
push 2
push dword [esi + 0x50]
call edi
test eax, eax
jne 0x40b0ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_set_timeout__lu
call fcn.00416ef0
pop ecx
pop ecx
movzx ecx, word [esi + 0x28]
mov eax, dword [esi + 8]
push 0
push ecx
push eax
push dword [esi + 0x50]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 0x54], eax
pop edi
test eax, eax
jne 0x40b0fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.WinHttpConnect_call_failed__Error_lu
jmp 0x40b02e
xor eax, eax
pop esi
leave
ret
Function at 0x40b797
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, edx
cmp byte [ebx], 0
push esi
push edi
mov dword [ebp - 0xb4], eax
je 0x40b7d2
push str.GetResponse_can_not_be_called_in_Asynchronous_mode
call fcn.00416f04
pop ecx
mov eax, 0x8000ffff
jmp 0x40b918
test eax, eax
jne 0x40b7dd
push str.Invalid_stream
jmp 0x40b7c2
and dword [ebp - 0xa8], 0
push ecx
call fcn.0040c32d
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x40b807
push str.Invalid_handle
call fcn.00416f04
pop ecx
mov eax, 0x80070057
jmp 0x40b918
lea ecx, [ebp - 0xa4]
call fcn.0042f538
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xac], ebx
jmp 0x40b89b
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x40b907
cmp eax, dword [ebp - 0xb8]
jbe 0x40b856
push eax
lea ecx, [ebp - 0xa4]
call fcn.0042f656
mov ebx, eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb8], eax
test ebx, ebx
je 0x40b8bd
and dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xb0]
push ecx
push eax
push ebx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x40b8c9
cmp dword [ebp - 0xb0], 0
je 0x40b907
push dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x1c]
and dword [ebp - 0xac], 0
lea eax, [ebp - 0xac]
push eax
push edi
call esi
test eax, eax
jne 0x40b826
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.WinHttpQueryDataAvailable_failed:__lu
jmp 0x40b8d7
mov dword [ebp - 0xa8], 0x8007000e
jmp 0x40b8f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.WinHttpReadData_failed:__lu
call fcn.00416f04
pop ecx
pop ecx
test esi, esi
jle 0x40b8ee
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0xa8], esi
test esi, esi
jge 0x40b907
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 0x10]
lea ecx, [ebp - 0xa4]
call fcn.0042f64b
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459871
leave
ret 4
Function at 0x40eb0b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x134], 0
push esi
push edi
mov esi, ecx
push str.TESTMODE
lea ecx, [esi + 0x40]
mov edi, edx
call fcn.0043e5fb
test eax, eax
je 0x40eb49
push eax
call fcn.0045c13c
pop ecx
mov dword [ebp - 0x134], eax
mov byte [edi], 1
cmp byte [esi + 0x124], 0
je 0x40ebcd
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40ebcd
lea eax, [ebp - 0x130]
call fcn.00416574
mov edi, 0x48aa2c
lea ecx, [esi + 0x5c]
mov dword [ebp - 0x130], edi
mov byte [ebp - 0x10], 0
call fcn.0043112d
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0042df63
pop ecx
pop ecx
test al, al
jne 0x40eb9c
mov esi, 0x8007000e
jmp 0x40ebb8
cmp dword [ebp - 0x134], 0
mov edx, esi
setne al
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x10], al
call fcn.0040496f
mov esi, eax
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], edi
call fcn.004165c0
mov eax, esi
jmp 0x40ebdd
push str.CInstallManager::CheckTestMode_878__:__TEST_specified_but_canceled._make_sure__qn_is_specified.
call fcn.00416f04
pop ecx
mov eax, 0x800704c7
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00459871
leave
ret
Function at 0x40ebeb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov byte [edi], bl
call fcn.0042c1ab
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 1], bl
call fcn.0042c5f9
test al, al
je 0x40ec1d
cmp byte [ebp - 1], bl
je 0x40ec4c
mov esi, dword [ebp + 8]
push str.ADMIN
lea ecx, [esi + 0x40]
call fcn.0043d201
test al, al
jne 0x40ec4c
mov byte [edi], 1
cmp byte [esi + 0x124], bl
je 0x40ec5d
push str.CInstallManager::AdminRelaunch_896__:_admin_priveledges_are_required_to_run_setup
call fcn.00416f04
pop ecx
mov ebx, 0x8000ffff
lea ecx, [ebp - 0x2c]
call fcn.0042c1c4
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
push ebx
call fcn.0042c3d1
pop ecx
test al, al
jne 0x40ed88
call fcn.0040f30f
test al, al
jne 0x40ed88
mov edi, 0x497a28
push edi
lea ecx, [ebp - 8]
call fcn.004037fc
push str.ADMIN
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 8]
push str._s___s
push eax
call fcn.0042dc91
add esp, 0x10
test al, al
jne 0x40ecba
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
mov ebx, 0x8007000e
jmp 0x40ec4c
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x88]
call fcn.0042b0c9
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x88], 0x488c58
call fcn.004037fc
push edi
lea ecx, [ebp - 0x44]
call fcn.004037fc
mov eax, dword [ebp - 8]
lea ecx, [esi + 0x5c]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x10], eax
call fcn.0043112d
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.0042df63
pop ecx
pop ecx
test al, al
je 0x40ed27
push dword [ebp - 0x10]
lea esi, [ebp - 0x88]
call fcn.00413513
cmp eax, ebx
jne 0x40ed5d
mov esi, dword [ebp + 8]
cmp dword [ebp - 0x3c], 0x4c7
jne 0x40ed41
push str.CInstallManager::AdminRelaunch_933__:_admin_priveledges_are_required_to_run_setup__UAC_canceled_
call fcn.00416f04
pop ecx
push esi
call fcn.004110bd
lea esi, [ebp - 0x88]
call fcn.004134f0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jge 0x40ed7b
mov esi, dword [ebp + 8]
jmp 0x40ecbd
mov ebx, dword [ebp - 0x38]
lea esi, [ebp - 0x88]
call fcn.004134f0
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x40ec4c
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x40ed99
push str.CInstallManager::AdminRelaunch_902__:_admin_priveledges_are_required_to_run_setup
call fcn.00416f04
pop ecx
push esi
call fcn.004110bd
mov ebx, 0x80047c10
jmp 0x40ec4c
Function at 0x40f518
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov ecx, dword [esi + 0xc8]
push edi
call fcn.0040f64b
mov edi, eax
test edi, edi
jge 0x40f54b
push edi
push dword [esi + 0xc8]
push str.CInstallManager::CreateDirectories_1224__:_failed_to_create_directory___s___0x_08x_
call fcn.00416f04
add esp, 0xc
mov eax, edi
jmp 0x40f645
push str.7.0.0.59
push str.install_version:__hs
call fcn.00416edc
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.command_line:__s
call fcn.00416edc
push dword [esi + 0xc0]
push str.base_install_folder:__s
call fcn.00416edc
push dword [esi + 0xc8]
push str.install_log_folder:__s
call fcn.00416edc
push dword [esi + 0xcc]
push str.install_temp_folder:__s
call fcn.00416edc
mov ecx, dword [esi + 0xc0]
add esp, 0x20
call fcn.0040f64b
mov edi, eax
test edi, edi
jge 0x40f5c2
push edi
push dword [esi + 0xc0]
push str.CInstallManager::CreateDirectories_1238__:_failed_to_create_directory___s___0x_08x_
jmp 0x40f53c
mov ecx, dword [esi + 0x1bc]
test ecx, ecx
je 0x40f643
push dword [esi + 0xc8]
mov eax, dword [ecx]
push 0x65
call dword [eax + 0x90]
push dword [esi + 0xcc]
mov ecx, dword [esi + 0x1bc]
mov eax, dword [ecx]
push 0x66
call dword [eax + 0x90]
push dword [esi + 0xc0]
mov ecx, dword [esi + 0x1bc]
mov eax, dword [ecx]
push 0x67
call dword [eax + 0x90]
mov ebx, dword [esi + 0x1bc]
mov edi, dword [ebx]
lea ebp, [esi + 0x5c]
mov ecx, ebp
add edi, 0x90
call fcn.0043112d
push eax
push 0x69
mov ecx, ebx
call dword [edi]
mov esi, dword [esi + 0x1bc]
mov edi, dword [esi]
mov ecx, ebp
add edi, 0x90
call fcn.0043113a
push eax
push 0x6a
mov ecx, esi
call dword [edi]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40f920
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x5c
mov eax, 0x4702bc
call fcn.0045d4e7
mov esi, ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 0x39], 1
call fcn.0042a635
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x104
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00403a70
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
push 0xffffffffffffffff
mov ecx, esi
setne byte [ebp - 0x39]
call fcn.0040a796
cmp byte [ebp - 0x39], bl
jne 0x40f979
push str.CInstallManager::GetInstallRootFolder_1357__:__SHGetSpecialFolderPath____FALSE
call fcn.00416f04
pop ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x40f983
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x40fa82
push str.NortonInstaller
push esi
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x40fa82
mov byte [ebp - 0x39], bl
jmp 0x40fa82
lea ecx, [ebp - 0x60]
call fcn.0042a5f3
test al, al
je 0x40fa91
mov byte [ebp - 0x39], bl
lea ecx, [ebp - 0x60]
call fcn.0042a615
mov al, byte [ebp - 0x39]
call fcn.0045d543
ret
Function at 0x410f02
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push str.DeleteCompleteAndExtract
call fcn.00416edc
mov esi, dword [ebp + 8]
pop ecx
add esi, 0xc4
push esi
lea ecx, [ebp - 4]
call fcn.00405a5a
push esi
lea ecx, [ebp - 8]
call fcn.00405a5a
lea eax, [ebp - 4]
push str.complete.dat
push eax
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x410f5f
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
xor al, al
pop esi
leave
ret 4
push ebx
lea eax, [ebp - 8]
push str.extract.dat
push eax
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x410f91
xor bl, bl
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
pop ebx
jmp 0x410f5a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push dword [ebp - 4]
call edi
push dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x410fd7
call esi
cmp eax, 2
je 0x410fd7
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
call esi
push eax
push dword [ebp + 8]
push str.CInstallManager::DeleteCompleteAndExtract_2157__:_failed_to_delete__s___lu_
call fcn.00416ef0
add esp, 0xc
push 0x80
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x411005
call esi
cmp eax, 2
je 0x411005
mov edi, dword [ebp - 8]
call esi
push eax
push edi
push str.CInstallManager::DeleteCompleteAndExtract_2166__:_failed_to_delete__s___lu_
call fcn.00416ef0
add esp, 0xc
mov bl, 1
pop edi
jmp 0x410f76

Function at 0x41100d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [esi + 0x132], 0
je 0x411022
mov al, byte [esi + 0x131]
leave
ret
push ebx
lea ebx, [esi + 0xc4]
push ebx
lea ecx, [ebp - 4]
call fcn.00405a5a
lea eax, [ebp - 4]
push str.finalzed.dat
push eax
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x411056
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, 1
pop ebx
leave
ret
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call edi
cmp eax, 0xffffffff
je 0x41106e
mov byte [esi + 0x131], 0
push ebx
lea ecx, [ebp - 4]
call fcn.0040382b
lea eax, [ebp - 4]
push str.complete.dat
push eax
call fcn.0042e4ce
pop ecx
pop ecx
test al, al
jne 0x41109d
mov bl, 1
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00403af7
mov al, bl
pop edi
jmp 0x411053
push dword [ebp - 4]
call edi
cmp eax, 0xffffffff
je 0x4110ae
mov byte [esi + 0x131], 0
mov bl, byte [esi + 0x131]
mov byte [esi + 0x132], 1
jmp 0x41108d
Function at 0x412efc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push str.entering_delete_mode
mov edi, eax
call fcn.00416edc
pop ecx
lea eax, [ebp - 1]
push eax
lea esi, [edi + 0xe0]
xor ebx, ebx
push 0x5014
mov eax, esi
mov byte [ebp - 1], bl
mov dword [ebp - 0x14], esi
call fcn.004043d3
test al, al
je 0x4130c7
cmp byte [ebp - 1], bl
je 0x4130c7
push 0x497a28
lea ecx, [ebp - 8]
call fcn.004037fc
lea eax, [ebp - 8]
push eax
push 0x5015
mov eax, esi
call fcn.0040440e
test al, al
je 0x4130af
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], ebx
je 0x4130af
call fcn.004130d7
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042a5b5
lea ecx, [ebp - 0x1c]
call fcn.0042a4ab
test al, al
jne 0x412fb3
push str.Start:_wait_for_parent_process
call fcn.00416edc
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042a4a7
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.Finish:_wait_for_parent_process
call fcn.00416edc
pop ecx
push dword [ebp - 8]
push str.deleting_folder:__s
call fcn.00416edc
mov esi, dword [ebp - 8]
push ebx
xor bl, bl
call fcn.004077cb
lea esi, [edi + 0x5c]
add esp, 0xc
mov ecx, esi
call fcn.0043112d
push eax
push str.deleting_file:__s
call fcn.00416edc
pop ecx
pop ecx
push 1
mov ecx, esi
call fcn.0043112d
mov ecx, eax
call fcn.004082c4
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ecx
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
je 0x41305a
and dword [ebp - 0x10], 0
push str.folder_still_exists__sleep_0.5_seconds_and_try_again
call fcn.00416ef0
mov dword [esp], 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x498ad4
call fcn.00434841
push dword [ebp - 8]
push str.deleting_folder:__s
call fcn.00416edc
mov esi, dword [ebp - 8]
push 0
xor bl, bl
call fcn.004077cb
add esp, 0xc
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
je 0x41305a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jb 0x41300a
push 0x497a28
lea ecx, [ebp - 0xc]
call fcn.004037fc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push 0x5024
call fcn.0040440e
test al, al
mov eax, dword [ebp - 0xc]
jne 0x413085
cmp dword [eax - 0xc], 0
jne 0x41309d
push eax
push str.deleting_empty_folders:__s
call fcn.00416edc
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
call fcn.00407b2e
mov eax, dword [ebp - 0xc]
lea ecx, [eax - 0x10]
call fcn.00403af7
lea ecx, [ebp - 0x1c]
call fcn.0042a51f
jmp 0x4130ba
push str.CInstallManager::HandleDeleteMode_2952__:_deleteFolder_value_missing
call fcn.00416f04
pop ecx
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00403af7
jmp 0x4130d2
push str.CInstallManager::HandleDeleteMode_2945__:_deleteMode_value_missing
call fcn.00416f04
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4130d7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4960a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push eax
lea ecx, [ebp - 0x240]
call fcn.0042a5b5
mov dword [ebp - 0x238], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
call fcn.0042a4a7
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x413189
cmp esi, dword [ebp - 0x230]
je 0x41315a
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
call fcn.0042a4a7
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41312e
cmp esi, dword [ebp - 0x230]
jne 0x413189
push dword [ebp - 0x220]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea ecx, [ebp - 0x240]
call fcn.0042a51f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00459871
leave
ret
xor esi, esi
jmp 0x41316f