joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c976
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x44c9c7
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x44c9c7
ja 0x44c999
cmp dword [ebp + 8], 0
jbe 0x44c9c7
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x4698c0]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x44c9a1
ja 0x44c9c7
cmp ecx, dword [ebp + 8]
jb 0x44c9a1
pop esi
pop ebx
leave
ret

Function at 0x44ca1b
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44ca51
test esi, esi
je 0x44ca5c
xor edx, edx
test edi, edi
je 0x44ca5c
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44ca36
jmp 0x44ca5c
push 0x4698c0
call fcn.0044cb55
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x44ca60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44caa1
cmp dword [ebp + 0xc], 0
je 0x44caa1
test esi, esi
je 0x44caac
xor ecx, ecx
test edi, edi
je 0x44caac
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x44ca84
jmp 0x44caac
push 0x4698c0
call fcn.0044cb27
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44cb00
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x44cb27
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x44cb53
xor ecx, ecx
test edx, edx
je 0x44cb53
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x44cb3c
pop edi
pop ebx
pop esi
ret

Function at 0x44cb55
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x44cb89
xor edx, edx
test edi, edi
je 0x44cb89
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44cb6d
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x44ce26
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x45c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov ebx, esi
call fcn.0041cc70
mov edi, dword [esp + 0x47c]
add esp, 0xc
test edi, edi
je 0x44d002
push 0x470ef0
push edi
push 0x470f00
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c17
add esp, 0x14
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44cfb1
test byte [esp + 0x218], 0x10
lea eax, [esp + 0x244]
je 0x44cf0f
push 0x46fd3c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44cf93
push 0x470ef8
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44cf93
lea eax, [esp + 0x244]
push eax
push edi
push 0x470f00
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c17
add esp, 0x14
lea eax, [esp + 0x10]
mov ecx, 0x4c7270
push 1
push 1
push 0x470ef0
push eax
call fcn.0044ce26
add ebx, eax
jmp 0x44cf93
push eax
push edi
push 0x470f00
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c17
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44cf92
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44cf3e
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x491ec0]
jae 0x44cf92
mov esi, dword [0x491ebc]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00438d5c
add esp, 0xc
xor esi, esi
test eax, eax
je 0x44cf92
push 4
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4c7270], 1
inc ebx
lea eax, [esp + 0x218]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44ce90
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x44cfbf
inc ebx
jmp 0x44cffe
mov ecx, edi
call fcn.0040952c
cmp eax, dword [0x491ec0]
jae 0x44cffe
mov esi, dword [0x491ebc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call fcn.00438d5c
add esp, 0xc
test eax, eax
je 0x44cffe
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4c7270], 1
mov eax, ebx
jmp 0x44d004
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c
ret 0x10
Function at 0x44d011
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebp
push esi
mov ebp, 0x2b4
push ebp
push 0
push eax
call fcn.0041cc70
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x44d183
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x44d182
push ebx
mov ebx, dword [esp + 0x6d8]
test ebx, ebx
je 0x44d181
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebx], 0xffffffff
push ebp
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebp
test eax, eax
jle 0x44d0be
push edi
call ebp
dec eax
shr eax, 1
je 0x44d0b2
push SysReAllocString
lea ecx, [esp + 0x228]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044cd77
mov eax, dword [esp + 0x21c]
jmp 0x44d17f
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push closesocket
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.00415cdf
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push closesocket
call esi
lea eax, [esp + 0x18]
push 0x46f7e0
push eax
call fcn.0041bf6e
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x44d181
push eax
call ebp
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebp
push edi
add esi, eax
call ebp
shr eax, 1
je 0x44d171
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x44d161
xor eax, eax
mov word [edi], ax
jmp 0x44d171
push esi
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044cd77
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.0042a6e5
pop ecx
mov dword [ebx], eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x6bc
ret 0xc
Function at 0x44d18e
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x44d2c8
cmp dword [ebp + 0x10], 0
je 0x44d2c8
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0041cc70
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push 0x45f760
push 1
push edi
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44d2c8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x44d2c8
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x44d210
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0044d011
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0xc]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
mov esi, 0x4679ec
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
push 0x45f7a0
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x44d2b6
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44d2b6
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x44d2ca
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x44d2d0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x44d441
cmp dword [ebp + 0x10], ebx
je 0x44d441
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d441
cmp dword [ebp - 4], ebx
je 0x44d441
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041cc70
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44d433
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov edi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00403c17
add esp, 0x14
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
push eax
push 0x45f760
push 1
push ebx
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44d432
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44d432
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
mov eax, dword [ecx]
push edx
push 0x45f7a0
push ecx
call dword [eax]
test eax, eax
js 0x44d412
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44d412
mov eax, dword [ecx]
lea edx, [ebp - 0x414]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x44d409
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x61c]
push edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
js 0x44d409
lea eax, [ebp - 0x61c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44d3ff
test cx, cx
je 0x44d404
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44d3ff
add esi, 4
add eax, 4
test cx, cx
jne 0x44d3db
jmp 0x44d404
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x44d432
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop edi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x44d443
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x44d449
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.0041cc70
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x44d545
cmp dword [esp + 0x220], 0
je 0x44d545
cmp dword [esp + 0x228], 0
je 0x44d545
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x44d545
mov esi, dword [esp + 0x230]
test esi, esi
je 0x44d545
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d545
cmp dword [esp + 8], 0
je 0x44d545
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x44d53f
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.00403c17
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.0044d18e
jmp 0x44d547
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x44d5dc
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x428]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041cc70
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44d70d
cmp dword [ebp + 0x10], ebx
je 0x44d70d
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d70d
cmp dword [ebp - 4], ebx
je 0x44d70d
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44d6fb
push 0x46cfbc
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415cdf
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415cdf
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d6d9
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0x4654d8
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x210], 0x104
call fcn.00403485
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x46cfd4
call fcn.00410f08
mov bl, al
jmp 0x44d6db
mov bl, 1
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
je 0x44d6fb
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0044cd77
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
test bl, bl
setne al
jmp 0x44d70f
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x44d766
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.0041cc70
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x44d7e3
mov ecx, dword [ebp + 0xc]
call fcn.0040952c
cmp eax, 1
jb 0x44d7e3
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44d7e3
push 0x46cfbc
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415cdf
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415cdf
sub esp, 0xc
lea eax, [ebp - 0x208]
push eax
call fcn.0044ce26
pop ebx
leave
ret 8

Function at 0x44d81c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x44d834
xor eax, eax
jmp 0x44d8cb
push SysReAllocString
push esi
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x410]
call fcn.0044cd77
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x44d86a
cmp word [eax], 0x5c
je 0x44d876
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x44d861
jmp 0x44d8b1
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d8b1
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44d8b1
lea eax, [ebp - 0x410]
mov ecx, 0x4c7270
push eax
call fcn.0044d81c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d8c8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44d8cb
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x453e13
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041cc70
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00404959
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.004011fb
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x453e95
mov eax, str.Install_Fail_Start_Program
jmp 0x453ec4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x453eb3
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x453ebd
push dword [ebp - 0xc]
call esi
mov bl, 1
mov eax, str.Install_Executed
push eax
mov ecx, 0x4b40d0
call fcn.0043f6ff
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x453ed6
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x69c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 3
jne 0x4540d5
xor ebp, ebp
cmp dword [edi + 0x879c], ebp
ja 0x453f06
cmp dword [edi + 0x8798], 0x40
jb 0x4540d5
lea ecx, [esp + 0x80]
call fcn.00403621
lea ecx, [esp + 0x298]
call fcn.00404959
lea ecx, [esp + 0x10]
call fcn.0044cb8c
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x80]
add eax, 0x29c
push eax
call fcn.00403485
mov edx, dword [esp + 0x84]
test edx, edx
je 0x453f5f
mov eax, dword [esp + 0x88]
inc eax
push eax
push edx
call fcn.0042d21a
mov edx, dword [esp + 0x8c]
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.0044cb00
mov eax, dword [esp + 0x88]
add eax, eax
push eax
push edx
call fcn.0044cbd7
lea ecx, [esp + 0x10]
call fcn.0044cc8f
push dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push dword [esp + 0x88]
call fcn.0044ccff
push dword [esp + 0x29c]
push ebp
push ebp
push 0x1a
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x298]
call fcn.00403f28
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
push dword [esp + 0x2a0]
call esi
push 0x46ffc0
lea ecx, [esp + 0x29c]
call fcn.00403806
push ebp
push dword [esp + 0x2a0]
call esi
push str.Terminal_
lea ecx, [esp + 0x29c]
call fcn.00403806
push ebp
push dword [esp + 0x2a0]
call esi
push dword [esp + 0x84]
lea ecx, [esp + 0x29c]
call fcn.00403806
push ebp
push dword [esp + 0x2a0]
call esi
push 0x475f0c
lea ecx, [esp + 0x29c]
call fcn.00403806
push ebp
push dword [esp + 0x2a0]
call esi
push str._server.ini
lea ecx, [esp + 0x29c]
call fcn.00403806
push ecx
push ecx
push dword [esp + 0x2a4]
lea ebx, [edi + 0x8790]
mov ecx, ebx
call fcn.0040422c
test al, al
je 0x4540a6
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x29c]
push str._sconfig_servers.dat
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x29c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call fcn.0043f034
push str.Account_Request_Finish
mov ecx, 0x4b40d0
call fcn.0043f6ff
mov esi, str.Account_Request_Success
jmp 0x4540ab
mov esi, str.Account_Request_Error
mov edi, 0x4b40d0
push esi
mov ecx, edi
call fcn.0043f6ff
push ebp
push esi
push ebp
push ebp
push edi
call fcn.0043f4d5
add esp, 0x14
mov ecx, ebx
call fcn.00416b82
lea ecx, [esp + 0x10]
call fcn.0044cbab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x69c
ret
Function at 0x4540e0
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x14]
push edi
call fcn.00403621
mov eax, dword [ebp + 0x58]
xor ebx, ebx
add eax, 0x6ac
mov dword [esp + 0x10], ebx
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, 0x20206
mov ecx, 0x20106
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x58]
push ebx
cmp dword [eax + 4], 2
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45431f
mov esi, dword [ebp + 0x58]
add esi, 0x94
mov ecx, esi
call fcn.0040952c
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [esp + 0x24]
call edi
mov esi, dword [ebp + 0x58]
add esi, 0x29c
mov ecx, esi
call fcn.0040952c
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.InstallLocation
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x1c]
push str._s_terminal.ico
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4541ef
mov ecx, dword [ebp + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [esp + 0x20]
push 0x470f00
push eax
call fcn.004011fb
add esp, 0x10
mov eax, dword [esp + 0x20]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push ebx
push str.DisplayIcon
push dword [esp + 0x24]
call edi
push 0x20
push 0x46c8e0
push 1
push ebx
push str.Publisher
push dword [esp + 0x24]
call edi
push 0x36
mov esi, 0x475dcc
push esi
push 1
push ebx
push str.HelpLink
push dword [esp + 0x24]
call edi
push 0x36
push esi
push 1
push ebx
push str.UrlInfoAbout
push dword [esp + 0x24]
call edi
mov esi, dword [esp + 0x234]
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
push dword [esi + 4]
push 1
push ebx
push str.UninstallString
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
push 0xa
cmp dword [eax + 8], 9
jae 0x454293
push str.5.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x475e80
jmp 0x4542ad
push str.4.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x475ecc
push 1
push ebx
push 0x475e84
push dword [esp + 0x24]
call edi
push 4
push 0x475ea0
push 1
push ebx
push 0x475ea4
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8848]
call fcn.00401b89
test al, al
jne 0x45431d
push dword [ebp + 0x884c]
lea eax, [esp + 0x1c]
push 0x475ed0
push eax
call fcn.004011fb
mov eax, dword [ebp + 0x58]
add esp, 0xc
add eax, 0x29c
push 1
push dword [esi + 4]
push ecx
push ecx
push dword [esp + 0x2c]
push dword [esi + 4]
push eax
call fcn.0044d18e
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x220
ret 4
Function at 0x45432e
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.00403621
lea ecx, [ebp - 0x430]
call fcn.00403621
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.00403f28
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4543b5
lea eax, [ebp - 0x430]
mov ecx, esi
push eax
mov bl, 1
call fcn.004540e0
pop esi
mov al, bl
pop ebx
leave
ret