joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458081
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc30
lea eax, [esp]
push ebp
push esi
push edi
mov edi, 0x208
xor ebp, ebp
push edi
push ebp
push eax
mov esi, ecx
call fcn.0041de00
push edi
lea eax, [esp + 0x224]
push ebp
push eax
call fcn.0041de00
push 0x820
lea eax, [esp + 0x438]
push ebp
push eax
call fcn.0041de00
add esp, 0x24
lea eax, [esp + 0x41c]
push 0x410
push eax
push dword [esi + 0x2a8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ecx
lea eax, [esp + 0x218]
mov ecx, esi
push eax
lea eax, [esp + 0x424]
push eax
call fcn.00457e3c
mov ecx, dword [esi + 0x2a8]
test al, al
jne 0x45810c
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
xor al, al
jmp 0x4581d4
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x214]
push eax
push ecx
call edi
mov eax, dword [esi + 0x58]
add eax, 0x6ac
je 0x45813f
push 0xffffffffffffffff
lea ecx, [esp + 0x218]
push ecx
push 0x104
push eax
call fcn.0042a52a
add esp, 0x10
push 0x410
lea eax, [esp + 0x420]
push eax
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ecx
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea eax, [esp + 0x424]
push eax
call fcn.00457e3c
mov ecx, dword [esi + 0x60]
test al, al
je 0x4580fe
lea eax, [esp + 0xc]
push eax
push ecx
call edi
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.00457caa
test al, al
jne 0x458191
push dword [esi + 0x60]
jmp 0x4580ff
mov eax, dword [esi + 0x58]
add eax, 0x29c
je 0x4581b0
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
push ecx
push 0x104
push eax
call fcn.0042a52a
add esp, 0x10
push ebp
push ebp
push 0xf0
push dword [esi + 0x4f0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x58]
test eax, eax
je 0x4581cf
or dword [ecx], 4
jmp 0x4581d2
and dword [ecx], 0xfffffffb
mov al, 1
pop edi
pop esi
pop ebp
add esp, 0xc30
ret

Function at 0x458260
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push 0x3023
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 3
mov ecx, ebx
call fcn.00416d52
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4582a4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x218]
call fcn.00403624
lea ecx, [ebp - 0x430]
call fcn.00403624
push ecx
push ecx
mov ecx, edi
call fcn.00417d4c
push 7
push dword [edi + 4]
call fcn.0044c200
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push dword [edi + 0x514]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x218]
call fcn.00403fdc
mov eax, dword [edi + 0x58]
add eax, 0x94
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push eax
call fcn.004011fb
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
add esp, 0xc
push dword [ebp - 0x42c]
push dword [edi + 0x514]
call esi
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
push dword [edi + 0x60]
call esi
mov eax, dword [edi + 0x58]
add eax, 0x6ac
push eax
push dword [edi + 0x2a8]
call esi
mov eax, dword [edi + 0x58]
push 0
mov ecx, dword [eax]
shr ecx, 2
and ecx, 1
push ecx
push 0xf1
push dword [edi + 0x4f0]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10

Function at 0x458531
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
sub esp, 0x624
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x414]
push edi
call fcn.00403624
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
mov eax, dword [esp + 0x638]
mov edi, ebp
or eax, 0x20019
mov dword [esp + 0x18], ebp
push eax
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45865e
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push ebp
jmp 0x45861d
cmp dword [esp + 0x10], ebp
jbe 0x458654
push 0x200
lea eax, [esp + 0x21c]
push ebp
push eax
call fcn.0041de00
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x428]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.004011fb
push dword [esp + 0x64c]
mov edx, dword [esp + 0x438]
lea eax, [esp + 0x234]
push 0x1fe
push eax
push str.InstallLocation
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00403e35
add esp, 0x28
test al, al
je 0x45860d
push dword [0x491ebc]
lea eax, [esp + 0x21c]
push eax
call fcn.0042bc09
pop ecx
pop ecx
test eax, eax
je 0x458639
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push dword [esp + 0x30]
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x45858f
jmp 0x458654
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x58]
add eax, 0x414
push 0x104
push eax
call fcn.004244ac
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x58]
pop edi
pop esi
cmp word [eax + 0x414], bp
pop ebp
setne al
add esp, 0x624
ret 4
Function at 0x458954
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x58]
cmp word [eax + 0x414], bx
je 0x4589bd
lea ecx, [ebp - 0x218]
call fcn.00403624
mov eax, dword [esi + 0x58]
add eax, 0x414
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.004011fb
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add esp, 0xc
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push ebx
push 0x20206
push dword [ebp - 0x214]
push edi
call esi
push ebx
push 0x20106
push dword [ebp - 0x214]
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4589c2
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x21c]
push esi
call fcn.00403624
cmp dword [ebp + 8], 0
je 0x458a74
push dword [ebp + 8]
mov eax, ecx
push str._s.
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x458a74
test byte [ebp - 0x46c], 0x10
je 0x458a5b
cmp word [ebp - 0x440], 0x2e
je 0x458a5b
lea eax, [ebp - 0x440]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x470ff8
push eax
call fcn.004011fb
add esp, 0x10
mov ecx, ebx
push dword [ebp - 0x218]
call fcn.004589c2
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x46c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x458a11
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
leave
ret 4
Function at 0x458a7a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
cmp dword [ebp + 8], 0
push ebx
push edi
mov ebx, ecx
je 0x458c03
lea ecx, [ebp - 0x46c]
call fcn.00403624
push dword [ebp + 8]
mov eax, ecx
push str._s.
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x458c03
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x46c]
push 0x470ff8
push eax
call fcn.004011fb
add esp, 0x10
test byte [ebp - 0x254], 0x10
je 0x458bda
mov ecx, 0x46fe84
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x458b29
test dx, dx
je 0x458b25
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x458b29
add eax, 4
add ecx, 4
test dx, dx
jne 0x458b03
xor eax, eax
jmp 0x458b2e
sbb eax, eax
or eax, 1
test eax, eax
je 0x458be6
mov ecx, 0x470ff0
lea eax, [ebp - 0x228]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x458b67
test dx, dx
je 0x458b63
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x458b67
add eax, 4
add ecx, 4
test dx, dx
jne 0x458b41
xor eax, eax
jmp 0x458b6c
sbb eax, eax
or eax, 1
test eax, eax
je 0x458be6
mov eax, dword [ebx + 0x58]
test byte [eax + 0x840], 1
jne 0x458bc1
lea eax, [ebp - 0x228]
push 0x476b64
push eax
call fcn.0042bc09
pop ecx
pop ecx
test eax, eax
je 0x458be6
lea eax, [ebp - 0x228]
push 0x476b70
push eax
call fcn.0042bc09
pop ecx
pop ecx
test eax, eax
je 0x458be6
lea eax, [ebp - 0x228]
push str.config
push eax
call fcn.0042bc09
pop ecx
pop ecx
test eax, eax
je 0x458be6
push dword [ebp - 0x468]
mov ecx, ebx
call fcn.00458a7a
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x458acd
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
leave
ret 4
Function at 0x458ed6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 0
jne 0x458f06
push 0xc8
push 7
push 0
mov ecx, esi
call fcn.0044a80a
mov ecx, esi
call fcn.0044a961
jmp 0x458f21
cmp dword [esp + 0xc], 1
jne 0x458f21
mov ecx, esi
call fcn.0044a946
push 0
push 8
push 8
mov ecx, esi
call fcn.0044a80a
pop esi
ret 8

Function at 0x459113
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 0x208
push 0
push eax
mov ebx, ecx
call fcn.0041de00
pop ecx
mov ecx, ebx
call fcn.00418080
push 6
push dword [ebx + 4]
call fcn.0044c200
push 0x102
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [ebx + 0x60]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub esp, 0x10
lea ecx, [ebx + 0x68]
call fcn.0044a8cc
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x6c]
call edi
mov ebp, 0x104
lea eax, [esp + 0x10]
push ebp
push eax
push 0x10
call fcn.0044c63f
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0xdc]
call esi
sub esp, 0x10
lea ecx, [ebx + 0x100]
call fcn.0044a8cc
push 0
push dword [ebx + 0x104]
call edi
push ebp
lea eax, [esp + 0x14]
push eax
push 0x12
call fcn.0044c63f
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x174]
call esi
sub esp, 0x10
lea ecx, [ebx + 0x198]
call fcn.0044a8cc
push 0
push dword [ebx + 0x19c]
call edi
push ebp
lea ecx, [esp + 0x14]
push ecx
push 0x11
call fcn.0044c63f
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0x20c]
call esi
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x208
ret 0x10

Function at 0x4593f1
Capabilities:
Hide graphical window

Disassembly:
push esi
lea esi, [ecx + 4]
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push 0x3023
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
mov ecx, esi
call fcn.00416d52
xor eax, eax
pop esi
ret
Function at 0x45941f
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x804
push ebx
push ebp
push esi
push edi
mov esi, 0x400
lea eax, [esp + 0x414]
push esi
xor ebp, ebp
mov ebx, ecx
push ebp
push eax
call fcn.0041de00
push esi
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.0041de00
add esp, 0x18
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.00417b0f
push ecx
push ecx
mov ecx, ebx
call fcn.00418537
push 5
push dword [ebx + 4]
call fcn.0044c200
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x14]
mov edi, 0x200
push edi
push eax
push dword [ebx + 0x60]
call esi
mov eax, dword [ebx + 0x58]
mov ebp, 0x84c
add eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push edi
push eax
call fcn.00416d00
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x424]
add esp, 0x10
push eax
push dword [ebx + 0x60]
call edi
push 0x200
lea eax, [esp + 0x18]
push eax
push dword [ebx + 0x84]
call esi
mov eax, dword [ebx + 0x58]
add eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push 0x200
push eax
call fcn.00416d00
add esp, 0x10
lea eax, [esp + 0x414]
push eax
push dword [ebx + 0x84]
call edi
push dword [0x491ebc]
push dword [ebx + 0xa8]
call edi
push 0
push 0
push 0xf1
push dword [ebx + 0xcc]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x804
ret 0x10

Function at 0x45a4a4
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 0x750]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x10]
mov dword [eax], 1
xor eax, eax
ret 0x10
Function at 0x45a832
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
lea eax, [ebp - 0x410]
push ebx
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0041de00
push 0x250
lea eax, [ebp - 0x660]
push esi
push eax
call fcn.0041de00
add esp, 0x18
lea eax, [ebp - 0x410]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x45a933
lea eax, [ebp - 0x410]
mov ebx, 0x104
push eax
push str._sMetaQuotesWebInstall.png
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.00403ccb
add esp, 0x10
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45a933
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x410]
push eax
push str._sMetaQuotesWebInstall_s
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45a91a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x45a91a
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x660]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45a8bc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
leave
ret

Function at 0x45a937
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
add ecx, 0xc404
push esi
xor esi, esi
cmp word [ecx], si
je 0x45a985
call fcn.00418cd6
cmp edx, esi
ja 0x45a985
jb 0x45a960
cmp eax, 0x3e8
jae 0x45a985
lea eax, [ebp - 0x208]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x45a985
push ecx
xor edx, edx
lea ecx, [ebp - 0x208]
call fcn.0045ce0c
pop ecx
pop esi
leave
ret
Function at 0x45a988
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x274
push ebx
push ebp
push esi
push edi
push 0x40
pop ebp
push ebp
xor ebx, ebx
lea eax, [esp + 0x2c]
push ebx
push eax
mov edi, ecx
call fcn.0041de00
or dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x74]
add esp, 0xc
mov dword [esp + 0x18], 0x4679a8
call fcn.00403624
push dword [esp + 0x74]
push dword [esp + 0x70]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x68]
call fcn.00403fdc
push ecx
push 3
push 3
push SysReAllocStringLen
push dword [esp + 0x7c]
lea ecx, [esp + 0x2c]
call fcn.00401442
test al, al
je 0x45ab57
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xffffffff
je 0x45ab5b
mov esi, ebx
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x34]
add eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45aa39
cmp dword [esp + 0x14], ebx
je 0x45aa39
add esi, dword [esp + 0x14]
cmp esi, ebp
jae 0x45aa3b
mov ecx, dword [esp + 0x1c]
jmp 0x45aa04
cmp esi, ebp
jne 0x45ab57
mov ax, word [esp + 0x4c]
mov ecx, dword [esp + 0x1c]
mov word [esp + 0x14], ax
mov ax, word [esp + 0x4e]
mov word [esp + 0x16], ax
cmp ecx, 0xffffffff
je 0x45ab5b
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push ebx
push edx
push eax
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
jne 0x45aa99
call ebp
test eax, eax
jne 0x45ab57
mov eax, dword [esp + 0x20]
and eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x45ab57
lea ebx, [edi + 0xcdb0]
lea esi, [edi + 0xcdc4]
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00418f31
test al, al
je 0x45aacd
lea esi, [edi + 0xcdc4]
cmp dword [esi], 2
jne 0x45aab2
cmp dword [esi], 2
je 0x45aada
push ecx
mov ecx, ebx
call fcn.004189ff
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xffffffff
je 0x45ab5b
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
and dword [esp + 0x24], 0
push 0
push edx
push eax
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
jne 0x45ab12
call ebp
test eax, eax
jne 0x45ab57
mov eax, dword [esp + 0x20]
and eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x45ab57
lea ebx, [edi + 0xce1c]
lea esi, [edi + 0xce30]
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00418f31
test al, al
je 0x45ab42
lea esi, [edi + 0xce30]
cmp dword [esi], 3
jne 0x45ab27
cmp dword [esi], 3
je 0x45ab4f
push ecx
mov ecx, ebx
call fcn.004189ff
mov ecx, dword [esp + 0x1c]
mov bl, 1
jmp 0x45ab5d
mov ecx, dword [esp + 0x1c]
xor bl, bl
and dword [esp + 0x6c], 0
and dword [esp + 0x70], 0
mov dword [esp + 0x68], 0x4654d8
mov dword [esp + 0x18], 0x4679a8
cmp ecx, 0xffffffff
je 0x45ab83
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x274
ret
Function at 0x45c115
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [esp + 0x24]
push ebx
push eax
mov edi, ecx
call fcn.0041de00
or dword [esp + 0x28], 0xffffffff
add esp, 0xc
mov esi, dword [ebp + 8]
mov dword [esp + 0x18], 0x4679a8
test esi, esi
je 0x45c23a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45c160
mov bl, 1
jmp 0x45c23a
push ecx
push 3
push 3
push SysReAllocStringLen
push esi
lea ecx, [esp + 0x2c]
call fcn.00401442
test al, al
je 0x45c23a
cmp dword [esp + 0x1c], 0xffffffff
je 0x45c23a
mov esi, ebx
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [esp + 0x2c]
add eax, esi
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c1bd
cmp dword [esp + 0x10], ebx
je 0x45c1bd
add esi, dword [esp + 0x10]
cmp esi, 0x40
jb 0x45c189
cmp esi, 0x40
jne 0x45c23a
mov ax, word [esp + 0x44]
mov ecx, dword [esp + 0x1c]
mov word [esp + 0x10], ax
mov ax, word [esp + 0x46]
mov word [esp + 0x12], ax
cmp ecx, 0xffffffff
je 0x45c23a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebx
push edx
push eax
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x45c210
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45c23a
mov eax, dword [esp + 0x10]
and eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x45c23a
lea esi, [edi + 0x14]
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.00418f31
test al, al
je 0x45c234
lea esi, [edi + 0x14]
cmp dword [esi], 1
jne 0x45c21c
cmp dword [esi], 1
sete bl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0x4679a8
cmp ecx, 0xffffffff
je 0x45c252
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45c7e2
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x414
lea eax, [esp + 0x208]
push ebx
push ebp
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.0041de00
add esp, 0xc
cmp dword [edi + 0x23c], esi
ja 0x45c81e
cmp dword [edi + 0x238], 0x400
jb 0x45c98e
lea eax, [esp + 0x218]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x45c98e
lea eax, [esp + 0x218]
push eax
push str._sMetaQuotes
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.00403ccb
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x20]
add esp, 0x10
push eax
call ebx
mov ecx, eax
and cl, 0x13
cmp cl, 0x10
je 0x45c883
push ecx
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.0045ce0c
pop ecx
lea eax, [esp + 0x10]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
jne 0x45c896
push esi
lea eax, [esp + 0x14]
push eax
call ebp
lea eax, [esp + 0x218]
push eax
push str._sMetaQuotesWebInstall
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call ebx
mov ecx, eax
and cl, 0x13
cmp cl, 0x10
je 0x45c8da
push ecx
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.0045ce0c
pop ecx
lea eax, [esp + 0x10]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x45c8e7
push esi
lea eax, [esp + 0x14]
push eax
call ebp
push edi
lea eax, [esp + 0x14]
push eax
push str._s_S
lea eax, [esp + 0x224]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
push ecx
lea ecx, [esp + 0x220]
push ecx
lea ecx, [edi + 0x230]
call fcn.004042e0
test al, al
jne 0x45c98a
lea esi, [edi + 0x20]
xor eax, eax
cmp word [esi], ax
je 0x45c98e
push esi
call ebx
cmp eax, 0xffffffff
jne 0x45c948
xor eax, eax
push eax
push esi
call ebp
jmp 0x45c954
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push esi
push str._s_S
lea eax, [esp + 0x224]
push 0x104
push eax
call fcn.00403ccb
add esp, 0xc
lea eax, [esp + 0x220]
lea ecx, [edi + 0x230]
push eax
call fcn.004042e0
test al, al
setne al
jmp 0x45c990
mov al, 1
jmp 0x45c990
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x414
ret