joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b7ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.0044b780
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jae 0x44b7e8
and dword [esi + 0x118], 0
xor al, al
jmp 0x44b828
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x44b7dd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x44b826
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [esi + 0x110], 0
jmp 0x44b7dd
mov al, 1
pop esi
ret 8

Function at 0x44c90c
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
je 0x44c97b
cmp dword [ebp + 0xc], 0
je 0x44c97b
cmp dword [ebp + 0x10], 0
je 0x44c97b
cmp dword [ebp + 0x14], 0
je 0x44c97b
mov eax, dword [esi]
test eax, eax
je 0x44c97b
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x44c97b
push 0xf0000000
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x44c97b
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x44c983
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
leave
ret 0x10
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44c9a6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x44c971
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x44c9ce
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x44c971
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x44c9bd
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x44c97d
Function at 0x44d5c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x44d61a
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x44d61a
ja 0x44d5ec
cmp dword [ebp + 8], 0
jbe 0x44d61a
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x4698c0]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x44d5f4
ja 0x44d61a
cmp ecx, dword [ebp + 8]
jb 0x44d5f4
pop esi
pop ebx
leave
ret

Function at 0x44d66e
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44d6a4
test esi, esi
je 0x44d6af
xor edx, edx
test edi, edi
je 0x44d6af
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44d689
jmp 0x44d6af
push 0x4698c0
call fcn.0044d7a8
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x44d6b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44d6f4
cmp dword [ebp + 0xc], 0
je 0x44d6f4
test esi, esi
je 0x44d6ff
xor ecx, ecx
test edi, edi
je 0x44d6ff
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x44d6d7
jmp 0x44d6ff
push 0x4698c0
call fcn.0044d77a
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44d753
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x44d77a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x44d7a6
xor ecx, ecx
test edx, edx
je 0x44d7a6
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x44d78f
pop edi
pop ebx
pop esi
ret

Function at 0x44d7a8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x44d7dc
xor edx, edx
test edi, edi
je 0x44d7dc
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44d7c0
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x44da79
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x45c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov ebx, esi
call fcn.0041de00
mov edi, dword [esp + 0x47c]
add esp, 0xc
test edi, edi
je 0x44dc55
push 0x470fe8
push edi
push 0x470ff8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44dc04
test byte [esp + 0x218], 0x10
lea eax, [esp + 0x244]
je 0x44db62
push 0x46fe84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44dbe6
push 0x470ff0
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44dbe6
lea eax, [esp + 0x244]
push eax
push edi
push 0x470ff8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x10]
mov ecx, 0x4b9588
push 1
push 1
push 0x470fe8
push eax
call fcn.0044da79
add ebx, eax
jmp 0x44dbe6
push eax
push edi
push 0x470ff8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44dbe5
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44db91
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x491ec0]
jae 0x44dbe5
mov esi, dword [0x491ebc]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00439eec
add esp, 0xc
xor esi, esi
test eax, eax
je 0x44dbe5
push 4
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4b9588], 1
inc ebx
lea eax, [esp + 0x218]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44dae3
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x44dc12
inc ebx
jmp 0x44dc51
mov ecx, edi
call fcn.00409665
cmp eax, dword [0x491ec0]
jae 0x44dc51
mov esi, dword [0x491ebc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call fcn.00439eec
add esp, 0xc
test eax, eax
je 0x44dc51
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4b9588], 1
mov eax, ebx
jmp 0x44dc57
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c
ret 0x10
Function at 0x44dc64
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebp
push esi
mov ebp, 0x2b4
push ebp
push 0
push eax
call fcn.0041de00
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x44ddd6
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x44ddd5
push ebx
mov ebx, dword [esp + 0x6d8]
test ebx, ebx
je 0x44ddd4
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebx], 0xffffffff
push ebp
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebp
test eax, eax
jle 0x44dd11
push edi
call ebp
dec eax
shr eax, 1
je 0x44dd05
push SysReAllocString
lea ecx, [esp + 0x228]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044d9ca
mov eax, dword [esp + 0x21c]
jmp 0x44ddd2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push SysReAllocStringLen
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.00415eca
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push SysReAllocStringLen
call esi
lea eax, [esp + 0x18]
push 0x46f928
push eax
call fcn.0041d0fe
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x44ddd4
push eax
call ebp
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebp
push edi
add esi, eax
call ebp
shr eax, 1
je 0x44ddc4
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x44ddb4
xor eax, eax
mov word [edi], ax
jmp 0x44ddc4
push esi
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044d9ca
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.0042b875
pop ecx
mov dword [ebx], eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x6bc
ret 0xc
Function at 0x44dde1
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x44df1b
cmp dword [ebp + 0x10], 0
je 0x44df1b
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0041de00
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push 0x45f760
push 1
push edi
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44df1b
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x44df1b
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x44de63
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0044dc64
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0xc]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
mov esi, 0x4679ec
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
push 0x45f7a0
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x44df09
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44df09
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x44df1d
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x44df23
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x44e094
cmp dword [ebp + 0x10], ebx
je 0x44e094
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44e094
cmp dword [ebp - 4], ebx
je 0x44e094
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041de00
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44e086
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov edi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00403ccb
add esp, 0x14
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
push eax
push 0x45f760
push 1
push ebx
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44e085
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44e085
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
mov eax, dword [ecx]
push edx
push 0x45f7a0
push ecx
call dword [eax]
test eax, eax
js 0x44e065
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44e065
mov eax, dword [ecx]
lea edx, [ebp - 0x414]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x44e05c
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x61c]
push edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
js 0x44e05c
lea eax, [ebp - 0x61c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44e052
test cx, cx
je 0x44e057
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44e052
add esi, 4
add eax, 4
test cx, cx
jne 0x44e02e
jmp 0x44e057
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x44e085
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop edi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x44e096
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x44e09c
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.0041de00
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x44e198
cmp dword [esp + 0x220], 0
je 0x44e198
cmp dword [esp + 0x228], 0
je 0x44e198
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x44e198
mov esi, dword [esp + 0x230]
test esi, esi
je 0x44e198
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44e198
cmp dword [esp + 8], 0
je 0x44e198
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x44e192
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.00403ccb
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.0044dde1
jmp 0x44e19a
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x44e22f
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x428]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041de00
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44e360
cmp dword [ebp + 0x10], ebx
je 0x44e360
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44e360
cmp dword [ebp - 4], ebx
je 0x44e360
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44e34e
push 0x46cf64
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415eca
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415eca
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e32c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0x4654d8
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x210], 0x104
call fcn.00403488
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x46cf7c
call fcn.0041111f
mov bl, al
jmp 0x44e32e
mov bl, 1
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
je 0x44e34e
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0044d9ca
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
test bl, bl
setne al
jmp 0x44e362
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x44e3b9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.0041de00
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x44e436
mov ecx, dword [ebp + 0xc]
call fcn.00409665
cmp eax, 1
jb 0x44e436
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44e436
push 0x46cf64
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415eca
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415eca
sub esp, 0xc
lea eax, [ebp - 0x208]
push eax
call fcn.0044da79
pop ebx
leave
ret 8

Function at 0x44e46f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x44e487
xor eax, eax
jmp 0x44e51e
push SysReAllocString
push esi
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x410]
call fcn.0044d9ca
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x44e4bd
cmp word [eax], 0x5c
je 0x44e4c9
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x44e4b4
jmp 0x44e504
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e504
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44e504
lea eax, [ebp - 0x410]
mov ecx, 0x4b9588
push eax
call fcn.0044e46f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e51b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44e51e
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x454a6a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041de00
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040491d
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.004011fb
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x454aec
mov eax, str.Install_Fail_Start_Program
jmp 0x454b1b
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x454b0a
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x454b14
push dword [ebp - 0xc]
call esi
mov bl, 1
mov eax, str.Install_Executed
push eax
mov ecx, 0x4b40c0
call fcn.0044036a
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x454b2d
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x69c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 3
jne 0x454d2c
xor ebp, ebp
cmp dword [edi + 0xa404], ebp
ja 0x454b5d
cmp dword [edi + 0xa400], 0x40
jb 0x454d2c
lea ecx, [esp + 0x80]
call fcn.00403624
lea ecx, [esp + 0x298]
call fcn.0040491d
lea ecx, [esp + 0x10]
call fcn.0044d7df
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x80]
add eax, 0x29c
push eax
call fcn.00403488
mov edx, dword [esp + 0x84]
test edx, edx
je 0x454bb6
mov eax, dword [esp + 0x88]
inc eax
push eax
push edx
call fcn.0042e3aa
mov edx, dword [esp + 0x8c]
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.0044d753
mov eax, dword [esp + 0x88]
add eax, eax
push eax
push edx
call fcn.0044d82a
lea ecx, [esp + 0x10]
call fcn.0044d8e2
push dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push dword [esp + 0x88]
call fcn.0044d952
push dword [esp + 0x29c]
push ebp
push ebp
push 0x1a
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x298]
call fcn.00403fdc
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
push dword [esp + 0x2a0]
call esi
push 0x4700c0
lea ecx, [esp + 0x29c]
call fcn.00403832
push ebp
push dword [esp + 0x2a0]
call esi
push str.Terminal_
lea ecx, [esp + 0x29c]
call fcn.00403832
push ebp
push dword [esp + 0x2a0]
call esi
push dword [esp + 0x84]
lea ecx, [esp + 0x29c]
call fcn.00403832
push ebp
push dword [esp + 0x2a0]
call esi
push 0x47608c
lea ecx, [esp + 0x29c]
call fcn.00403832
push ebp
push dword [esp + 0x2a0]
call esi
push str._server.ini
lea ecx, [esp + 0x29c]
call fcn.00403832
push ecx
push ecx
push dword [esp + 0x2a4]
lea ebx, [edi + 0xa3f8]
mov ecx, ebx
call fcn.004042e0
test al, al
je 0x454cfd
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x29c]
push str._sconfig_servers.dat
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x29c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call fcn.0043fd1d
push str.Account_Request_Finish
mov ecx, 0x4b40c0
call fcn.0044036a
mov esi, str.Account_Request_Success
jmp 0x454d02
mov esi, str.Account_Request_Error
mov edi, 0x4b40c0
push esi
mov ecx, edi
call fcn.0044036a
push ebp
push esi
push ebp
push ebp
push edi
call fcn.00440140
add esp, 0x14
mov ecx, ebx
call fcn.004048aa
lea ecx, [esp + 0x10]
call fcn.0044d7fe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x69c
ret