joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424f91
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
xor eax, eax
push 0x1fe
mov word [ebp - 0x208], ax
xor edi, edi
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.004127c0
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 4], edi
test esi, esi
je 0x4250d3
cmp dword [ebp + 0x10], edi
je 0x4250d3
lea eax, [ebp - 4]
push eax
push 0x4365e0
push 1
push edi
push 0x436610
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4250d3
mov edx, dword [ebp - 4]
test edx, edx
je 0x4250d3
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x42501b
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00424e13
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp - 4]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push pe_nt_image_headers32
lea edx, [ebp - 0x208]
mov dword [ebp - 8], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
mov esi, 0x43ddcc
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
lea edx, [ebp + 0xc]
push edx
mov dword [ebp + 0xc], edi
mov ecx, dword [eax]
push 0x436620
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x4250c1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4250c1
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
test esi, esi
setns al
jmp 0x4250d5
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x4250db
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
xor ecx, ecx
push 0x206
mov word [esp + 0x10], ax
push ecx
lea eax, [esp + 0x16]
push eax
mov dword [esp + 0x14], ecx
call fcn.004127c0
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x4251c3
cmp dword [esp + 0x220], 0
je 0x4251c3
cmp dword [esp + 0x228], 0
je 0x4251c3
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x4251c3
mov esi, dword [esp + 0x230]
test esi, esi
je 0x4251c3
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4251c3
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4251c3
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.00409cf6
add esp, 0x14
xor eax, eax
cmp word [esi], ax
push eax
cmove esi, dword [esp + 0x224]
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.00424f91
jmp 0x4251c5
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x425236
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
xor eax, eax
push 0x206
mov word [ebp - 0x428], ax
xor ebx, ebx
lea eax, [ebp - 0x426]
push ebx
push eax
call fcn.004127c0
add esp, 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42537d
cmp dword [ebp + 0x10], ebx
je 0x42537d
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x42537d
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x425351
push 0x43e878
mov edx, 0x208
lea ecx, [ebp - 0x428]
call fcn.00409f6a
push dword [ebp + 0xc]
mov edx, 0x208
lea ecx, [ebp - 0x428]
call fcn.00409f6a
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42533a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], eax
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x4405f0
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], 0x104
call fcn.0040968b
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x4405f0
call fcn.00409ea7
mov bl, al
jmp 0x42533c
mov bl, 1
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp + 0x14]
lea edx, [eax + eax]
call fcn.00409fa4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x425374
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
test bl, bl
setne al
jmp 0x42537f
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x4253d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x208], ax
xor edi, edi
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.004127c0
add esp, 0xc
cmp dword [ebp + 0xc], edi
je 0x425464
mov ecx, dword [ebp + 0xc]
call fcn.004078b4
cmp eax, 1
jb 0x425464
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x425464
mov edi, 0x208
push 0x43e878
mov edx, edi
lea ecx, [ebp - 0x208]
call fcn.00409f6a
push dword [ebp + 0xc]
mov edx, edi
lea ecx, [ebp - 0x208]
call fcn.00409f6a
push 1
push 1
push 0x43e870
lea eax, [ebp - 0x208]
push eax
mov ecx, 0x44b24c
call fcn.00424c08
pop edi
leave
ret 8

Function at 0x425469
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
jmp fcn.0055bf17

Function at 0x425494
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x410
push ebp
push esi
mov esi, dword [esp + 0x41c]
mov ebp, ecx
test esi, esi
jne 0x4254ad
xor eax, eax
jmp 0x42552c
push esi
mov edx, 0x410
lea ecx, [esp + 0xc]
call fcn.00409fa4
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [esp + eax*2 + 6]
jmp 0x4254d6
cmp word [eax], 0x5c
je 0x4254e0
sub eax, 2
lea ecx, [esp + 8]
cmp eax, ecx
ja 0x4254cd
jmp 0x425512
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425512
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x425512
lea eax, [esp + 8]
push eax
mov ecx, ebp
call fcn.00425494
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425529
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x42552c
xor eax, eax
inc eax
pop esi
pop ebp
add esp, 0x410
ret 4
Function at 0x42af5d
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x274
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [esp + 0x28]
push ebx
push eax
mov ebp, ecx
mov dword [esp + 0x2c], ebx
call fcn.004127c0
mov dword [esp + 0x1c], ebx
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x68]
stosd dword es:[edi], eax
call fcn.00405a51
mov ecx, dword [ebp + 0x54]
lea eax, [ecx + 0x41e]
push eax
lea eax, [ecx + 0x216]
push eax
lea eax, [esp + 0x70]
push str.__s_s___install
push eax
call fcn.0040940c
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [esp + 0x8c]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x42b00a
lea esi, [ebp + 0x1ac7]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.startprograminstall_u
push 0x80
push esi
call fcn.0040a8a5
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
jmp 0x42b0d0
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x10], ebx
je 0x42b02b
push 0xea60
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [esp + 0x10]
call esi
cmp dword [esp + 0x14], ebx
je 0x42b037
push dword [esp + 0x14]
call esi
mov eax, dword [ebp + 0x54]
cmp dword [eax + 8], 3
jne 0x42b0ce
push dword [esp + 0x74]
push dword [esp + 0x70]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [esp + 0x68]
call fcn.004059e7
push 0x2e
lea ecx, [esp + 0x6c]
call fcn.004059b8
test eax, eax
jle 0x42b075
push eax
lea ecx, [esp + 0x6c]
call fcn.0040599c
push 0x5c
lea ecx, [esp + 0x6c]
call fcn.004059b8
test eax, eax
jle 0x42b090
inc eax
push eax
push ecx
lea ecx, [esp + 0x70]
call fcn.0040a64c
lea ecx, [esp + 0x68]
call fcn.00409673
test al, al
jne 0x42b0ce
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x42b0b5
push dword [esp + 0x74]
push eax
call fcn.00410544
mov eax, dword [esp + 0x74]
pop ecx
pop ecx
push eax
push ecx
push 0x440214
mov edx, str.SoftwareMetaQuotes_SoftwareMetaTrader_5Settings
mov ecx, SysReAllocStringLen
call fcn.00409d4e
add esp, 0xc
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x274
ret
Function at 0x42b37c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.00405a51
lea ecx, [ebp - 0x430]
call fcn.00405a51
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.004059e7
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.0040940c
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x42b403
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
mov bl, 1
call fcn.0042b0dd
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x42b409
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x430]
call fcn.00405a51
lea ecx, [ebp - 0x648]
call fcn.00405a51
lea ecx, [ebp - 0x218]
call fcn.00405a51
mov eax, dword [esi + 0x54]
xor ebx, ebx
cmp dword [eax + 8], 6
je 0x42b44e
cmp dword [eax + 8], 7
je 0x42b44e
cmp dword [eax + 8], 3
jne 0x42b48e
add eax, 0x216
push eax
lea eax, [ebp - 0x218]
push str._s_terminal.ico
push eax
call fcn.0040940c
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42b48e
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], ebx
test eax, eax
je 0x42b48e
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x54]
lea eax, [ecx + 0x41e]
push eax
lea eax, [ecx + 0x216]
push eax
lea eax, [ebp - 0x648]
push 0x43e864
push eax
call fcn.0040940c
mov ecx, dword [esi + 0x54]
add esp, 0x10
lea eax, [ecx + 0xe]
push dword [ebp - 0x214]
push dword [ebp - 0x424]
push dword [ebp - 0x42c]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x216]
push eax
call fcn.004251d0
test eax, eax
je 0x42b500
lea ecx, [ebp - 0x430]
call fcn.004059e7
push dword [ebp - 0x42c]
lea ecx, [esi + 0x1600]
call fcn.0040ac6e
mov bl, al
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x42b63b
Capabilities:
Check if file exists
Delete file
Get file attributes
Print debug messages
Set file attributes

Disassembly:
sub esp, 0x9c
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb4]
push edi
mov ebp, ecx
test esi, esi
jne 0x42b659
xor al, al
jmp 0x42b81d
mov edi, dword [esp + 0xb0]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x42b6fa
lea ecx, [esp + 0x38]
call fcn.00424b0a
push edi
lea ecx, [esp + 0x3c]
call fcn.00424978
lea ecx, [esp + 0x38]
call fcn.00424907
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
call fcn.004248f1
call fcn.00424abf
push dword [esp + 0xbc]
push esi
call fcn.00424a07
lea ecx, [esp + 0x38]
call fcn.00424907
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
call fcn.004248f1
mov ecx, ebx
lea edx, [esp + 0x18]
mov ebx, eax
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4]
jne 0x42b6f1
inc ecx
cmp ecx, 4
jne 0x42b6d3
lea ecx, [esp + 0x38]
call fcn.00424ae6
mov al, 1
jmp 0x42b81d
lea ecx, [esp + 0x38]
call fcn.00424ae6
or dword [esp + 0x1c], 0xffffffff
push ecx
push 2
push ecx
push 0x40000000
push dword [edi + 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x43e504
call fcn.00409509
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
jne 0x42b792
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42b742
push 0x80
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push ecx
push 2
push ecx
push 0x40000000
push dword [edi + 4]
lea ecx, [esp + 0x2c]
call fcn.00409509
test al, al
jne 0x42b792
mov eax, dword [esp + 0xb4]
lea esi, [ebp + 0x1ac7]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.openfailed_u_S
push 0x80
push esi
call fcn.0040a8a5
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov esi, dword [esp + 0x1c]
jmp 0x42b811
push dword [esp + 0xbc]
lea ecx, [esp + 0x1c]
push esi
call fcn.004093d4
cmp eax, dword [esp + 0xbc]
je 0x42b7f7
mov eax, dword [esp + 0xb4]
lea esi, [ebp + 0x1ac7]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.writefailed_u_S
push 0x80
push esi
call fcn.0040a8a5
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov esi, dword [esp + 0x1c]
cmp esi, 0xffffffff
je 0x42b7ec
push esi
call ebx
or esi, 0xffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x42b811
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, 0xffffffff
je 0x42b80c
push esi
call ebx
or esi, 0xffffffff
mov byte [esp + 0x14], 1
cmp esi, 0xffffffff
je 0x42b819
push esi
call ebx
mov al, byte [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x42bb45
Capabilities:
Delete file
Get common file path
Print debug messages

Disassembly:
sub esp, 0x448
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ebp, 0x206
push ebp
mov word [esp + 0x254], ax
xor ebx, ebx
lea eax, [esp + 0x256]
push ebx
push eax
mov esi, ecx
call fcn.004127c0
add esp, 0xc
lea eax, [esp + 0x250]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x42bbb0
add esi, 0x1ac7
push str.temppathnotfound
mov edx, 0x80
mov ecx, esi
call fcn.0040aa6d
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
xor al, al
jmp 0x42bd89
lea ecx, [esp + 0x2c]
call fcn.0040ac2d
xor eax, eax
push ebp
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push ebx
or edi, 0xffffffff
push eax
mov dword [esp + 0x30], 0x43e504
mov dword [esp + 0x34], edi
call fcn.004127c0
mov ecx, dword [esp + 0x468]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
push 0
mov bl, 1
call fcn.0040a90a
test al, al
je 0x42bd76
mov ebp, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test bl, bl
je 0x42bd6e
inc dword [esp + 0x1c]
cmp dword [esp + 0x14], 5
je 0x42bc53
mov eax, dword [esi + 0x54]
cmp dword [eax + 4], 1
jne 0x42bc42
cmp dword [esp + 0x14], 8
jne 0x42bd00
cmp dword [eax + 4], 2
jne 0x42bc53
cmp dword [esp + 0x14], 9
jne 0x42bd00
lea eax, [esp + 0x48]
push eax
push 0
push 0x43fd80
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
je 0x42bd4e
push ecx
push 2
push ecx
push 0x40000000
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
call fcn.00409509
test al, al
je 0x42bd2a
push dword [esp + 0x18]
lea ecx, [esp + 0x28]
push dword [esp + 0x24]
call fcn.004093d4
cmp eax, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
sete bl
cmp edi, 0xffffffff
je 0x42bcbf
push edi
call ebp
or edi, 0xffffffff
mov dword [esp + 0x28], edi
test bl, bl
je 0x42bcf5
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [esp + 0x50]
push eax
mov ecx, esi
call fcn.0042b82a
mov bl, al
test bl, bl
je 0x42bcf5
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x1600]
call fcn.0040a619
mov bl, al
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [esp + 0x45c]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.0040a90a
test al, al
jne 0x42bc1b
jmp 0x42bd6e
add esi, 0x1ac7
push str.tempwritefailed
mov edx, 0x80
mov ecx, esi
call fcn.0040aa6d
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov edi, dword [esp + 0x28]
jmp 0x42bd6c
add esi, 0x1ac7
push str.tempfilenotfound
mov edx, 0x80
mov ecx, esi
call fcn.0040aa6d
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
xor bl, bl
cmp edi, 0xffffffff
je 0x42bd76
push edi
call ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x43e50c
call fcn.004096ff
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret 4
Function at 0x42bddc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa7c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x870]
call fcn.00405a51
lea ecx, [esp + 0x658]
call fcn.00405a51
lea ecx, [esp + 0x440]
call fcn.00405a51
lea ecx, [esp + 0x228]
call fcn.00405a51
lea ecx, [esp + 0x10]
call fcn.00405a51
push dword [esi + 0x18b8]
mov eax, dword [esi + 0x54]
push dword [esi + 0x18b0]
add eax, 0x626
push eax
call fcn.00425384
test eax, eax
je 0x42c043
lea ecx, [esi + 0x18ac]
call fcn.004059e7
xor ebx, ebx
push 0x23
lea edi, [ebx + 1]
mov ebp, 0x43e864
pop ebx
push edi
lea eax, [esp + 0x22c]
push str.link_name__u
push eax
call fcn.0040940c
mov ecx, dword [esi + 0x58]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.004312ae
test al, al
je 0x42c03e
mov ecx, dword [esp + 0x14]
mov edx, str.PROGRAM
call fcn.0040114f
test eax, eax
jne 0x42bec7
mov ecx, dword [esi + 0x58]
lea eax, [esp + 0x10]
push eax
push str.company_program_brief
call fcn.004312ae
test al, al
je 0x42c03e
push str..lnk
lea ecx, [esp + 0x14]
call fcn.0040aa12
push dword [esp + 0x14]
lea eax, [esp + 0x874]
push dword [esi + 0x18b0]
push ebp
push eax
call fcn.0040940c
push edi
lea eax, [esp + 0x23c]
push str.file_name__u
push eax
call fcn.0040940c
mov ecx, dword [esi + 0x58]
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.004312ae
test al, al
je 0x42c03e
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x42bf36
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x54]
mov edx, eax
call fcn.0042ae0e
pop ecx
test al, al
je 0x42c03e
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [esp + 0x448]
push ebp
push eax
call fcn.0040940c
push edi
lea eax, [esp + 0x23c]
push str.icon_file__u
push eax
call fcn.0040940c
mov ecx, dword [esi + 0x58]
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.004312ae
test al, al
je 0x42c03e
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x42bfa5
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x54]
mov edx, eax
call fcn.0042ae0e
pop ecx
test al, al
je 0x42c03e
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x216
push eax
lea eax, [esp + 0x660]
push ebp
push eax
call fcn.0040940c
push edi
lea eax, [esp + 0x23c]
push str.icon_index__u
push eax
call fcn.0040940c
mov ecx, dword [esi + 0x58]
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x230]
call fcn.004312ae
test al, al
je 0x42c03e
push dword [esp + 0x14]
call fcn.00410279
pop ecx
push dword [esp + 0x444]
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42c02f
mov eax, dword [esi + 0x54]
push ebp
push dword [esp + 0x660]
add eax, 0x216
push ecx
push ecx
push dword [esp + 0x884]
push dword [esp + 0x458]
push eax
call fcn.00424f91
inc edi
mov ebp, 0x43e864
cmp edi, 0x40
jb 0x42be5b
xor ebx, ebx
inc ebx
jmp 0x42c05a
push str.creategroup
lea ecx, [esi + 0x1ac7]
mov edx, 0x80
call fcn.0040aa6d
xor bl, bl
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xa7c
ret
Function at 0x42c63f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esi + 0x54]
mov edi, 0x216
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42c685
mov eax, dword [esi + 0x54]
add eax, edi
push eax
mov ecx, 0x44b24c
call fcn.00425494
test eax, eax
jne 0x42c685
push str.createfolder
jmp 0x42c695
mov ecx, esi
call fcn.0042bdd1
test al, al
jne 0x42c6d3
push 0x43f8e0
lea ecx, [esi + 0x1ac7]
mov edx, 0x80
call fcn.0040aa6d
push 2
lea eax, [esi + 0x1bf0]
push eax
call fcn.0042c9e3
push ebx
push 7
push 0x464
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0042b506
test al, al
nop
nop
mov ecx, esi
call fcn.0042bddc
mov byte [esi + 0x1ac6], al
test al, al
je 0x42c6a5
mov ecx, esi
call fcn.0042bd96
test al, al
je 0x42c6a5
mov eax, dword [esi + 0x54]
mov edi, 0x80
test byte [eax], 1
nop
nop
mov ecx, esi
call fcn.0042b409
test al, al
nop
nop
push str.createdesktop
lea ecx, [esi + 0x1ac7]
mov edx, edi
call fcn.0040aa6d
mov ecx, esi
call fcn.0042b37c
test al, al
nop
nop
push str.createuninstall
lea ecx, [esi + 0x1ac7]
mov edx, edi
call fcn.0040aa6d
mov ecx, esi
call fcn.0042af5d
test al, al
je 0x42c6a5
mov ecx, esi
call fcn.0042c2c0
mov bl, 1
jmp 0x42c6c4

Function at 0x42c9e3
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 0
jne 0x42ca11
push 0xc8
push 7
push 0
mov ecx, esi
call fcn.004207aa
mov ecx, esi
call fcn.0042072c
cmp dword [esp + 0xc], 1
jne 0x42ca2c
mov ecx, esi
call fcn.00420711
push 0
push 8
push 8
mov ecx, esi
call fcn.004207aa
cmp dword [esp + 0xc], 2
jne 0x42ca47
mov ecx, esi
call fcn.00420711
push 0
push 9
push 9
mov ecx, esi
call fcn.004207aa
pop esi
ret 8

Function at 0x42ca4b
Capabilities:
Create process on windows
Delete file

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x1ac5], 0
jne 0x42ca8b
cmp byte [esi + 0x1ac4], 0
je 0x42ca8b
mov ecx, dword [esi + 0x54]
test byte [ecx], 2
je 0x42cacb
push 1
lea eax, [ecx + 0x216]
push eax
xor edi, edi
push edi
lea eax, [ecx + 0x41e]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42cacb
cmp byte [esi + 0x1ac6], 0
je 0x42caa2
mov eax, dword [esi + 0x54]
add eax, 0x626
push eax
call fcn.00425469
xor edi, edi
cmp dword [esi + 0x1608], edi
jbe 0x42cacb
mov eax, dword [esi + 0x1610]
imul eax, edi
add eax, dword [esi + 0x1604]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x1608]
jb 0x42caac
pop edi
xor eax, eax
pop esi
pop ecx
ret