joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d1ce
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x894
push ebx
push ebp
push esi
push edi
push 0x428
lea eax, [esp + 0x47c]
mov ebx, ecx
push 0
push eax
call fcn.0041d6f0
add esp, 0xc
mov dword [esp + 0x10], 0x4f88f0
lea eax, [esp + 0x58]
or esi, 0xffffffff
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], esi
push dword [esp + 0x8ac]
push 0x104
push eax
call fcn.00403075
mov edi, dword [esp + 0x8a8]
mov dword [esp + 0x48], 0x50984c
test edi, edi
je 0x44d40c
cmp dword [esp + 0x8ac], 0
je 0x44d40c
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x44d40c
push edi
push 0x104
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0x26c]
call fcn.00403075
mov dword [esp + 0x260], 0x50984c
cmp dword [esp + 0x268], ebp
jbe 0x44d40c
push ecx
push 3
push 1
push closesocket
push dword [esp + 0x274]
lea ecx, [esp + 0x24]
call fcn.00401140
test al, al
je 0x44d408
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esi, dword [esp + 0x14]
xorps xmm0, xmm0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x488], ebp
mov dword [esp + 0x490], eax
mov dword [esp + 0x48c], ebp
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x44d2f8
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x44d301
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x898], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x89c], ecx
test edx, edx
je 0x44d348
test eax, eax
je 0x44d364
mov ecx, ebp
test edx, edx
je 0x44d348
cmp word [eax + ecx*2], 0x5c
jne 0x44d343
push 0x2f
pop edx
mov word [eax + ecx*2], dx
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
inc ecx
cmp ecx, edx
jb 0x44d32d
test eax, eax
je 0x44d364
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x49c]
push 0x200
push eax
call fcn.0042a5e4
add esp, 0x10
lea eax, [esp + 0x478]
mov ecx, ebx
push eax
call fcn.0044cb08
test al, al
je 0x44d40c
cmp dword [ebx + 0x2b0], ebp
jne 0x44d39e
push 0x4f086c
push 0x400080
call fcn.0041b7ed
mov dword [ebx + 0x2b0], eax
pop ecx
pop ecx
test eax, eax
je 0x44d40c
mov ebp, dword [ebx + 0x2b0]
cmp esi, 0xffffffff
je 0x44d3fd
test ebp, ebp
je 0x44d3fd
xor edi, edi
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, 0x400000
sub eax, edi
push eax
lea eax, [edi + ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44d3e5
cmp dword [esp + 0x10], 0
je 0x44d3e5
add edi, dword [esp + 0x10]
cmp edi, 0x400000
jb 0x44d3af
test edi, edi
je 0x44d3fd
push edi
push dword [ebx + 0x2b0]
mov ecx, ebx
call fcn.0044ca45
test al, al
jne 0x44d39e
jmp 0x44d40c
mov ecx, ebx
call fcn.0044c6dc
mov bl, al
jmp 0x44d40e
mov esi, dword [esp + 0x14]
xor bl, bl
and dword [esp + 0x4c], 0
and dword [esp + 0x50], 0
mov dword [esp + 0x48], 0x5098cc
cmp esi, 0xffffffff
je 0x44d42c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x894
ret 8
Function at 0x44deb8
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
lea eax, [ebp - 0x244]
push ebx
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0041d6f0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x244]
call fcn.0040e9a9
test al, al
jne 0x44df6f
call fcn.00409121
test al, al
je 0x44df6f
call fcn.004090c4
test al, al
jne 0x44df6f
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0041d6f0
push ebx
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0041d6f0
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4f8934
push 0x103
push eax
push edi
mov dword [ebp - 0x30], 0x50d67c
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb al, al
inc al
jmp 0x44df71
mov al, 1
pop edi
pop ebx
leave
ret
Function at 0x44f95c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.0044f922
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jae 0x44f98a
and dword [esi + 0x118], 0
xor al, al
jmp 0x44f9ca
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x44f97f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x44f9c8
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [esi + 0x110], 0
jmp 0x44f97f
mov al, 1
pop esi
ret 8

Function at 0x451570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x4515c1
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x4515c1
ja 0x451593
cmp dword [ebp + 8], 0
jbe 0x4515c1
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x4fa800]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x45159b
ja 0x4515c1
cmp ecx, dword [ebp + 8]
jb 0x45159b
pop esi
pop ebx
leave
ret

Function at 0x451615
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x45164b
test esi, esi
je 0x451656
xor edx, edx
test edi, edi
je 0x451656
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x451630
jmp 0x451656
push 0x4fa800
call fcn.0045174f
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x45165a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x45169b
cmp dword [ebp + 0xc], 0
je 0x45169b
test esi, esi
je 0x4516a6
xor ecx, ecx
test edi, edi
je 0x4516a6
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x45167e
jmp 0x4516a6
push 0x4fa800
call fcn.00451721
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4516fa
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x451721
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x45174d
xor ecx, ecx
test edx, edx
je 0x45174d
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x451736
pop edi
pop ebx
pop esi
ret
Function at 0x45174f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x451783
xor edx, edx
test edi, edi
je 0x451783
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x451767
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x457e95
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041d6f0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004047b4
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.0040371e
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x457f17
mov eax, str.Install_Fail_Start_Program
jmp 0x457f46
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x457f35
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x457f3f
push dword [ebp - 0xc]
call esi
mov bl, 1
mov eax, str.Install_Executed
push eax
mov ecx, 0x555890
call fcn.004444e4
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x457f58
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x69c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 3
jne 0x458157
xor ebp, ebp
cmp dword [edi + 0xa3fc], ebp
ja 0x457f88
cmp dword [edi + 0xa3f8], 0x40
jb 0x458157
lea ecx, [esp + 0x80]
call fcn.0040337a
lea ecx, [esp + 0x298]
call fcn.004047b4
lea ecx, [esp + 0x10]
call fcn.00451786
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x80]
add eax, 0x29c
push eax
call fcn.004031de
mov edx, dword [esp + 0x84]
test edx, edx
je 0x457fe1
mov eax, dword [esp + 0x88]
inc eax
push eax
push edx
call fcn.0042e8fa
mov edx, dword [esp + 0x8c]
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.004516fa
mov eax, dword [esp + 0x88]
add eax, eax
push eax
push edx
call fcn.004517d1
lea ecx, [esp + 0x10]
call fcn.00451889
push dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push dword [esp + 0x88]
call fcn.004518f9
push dword [esp + 0x29c]
push ebp
push ebp
push 0x1a
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x298]
call fcn.00403e73
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
push dword [esp + 0x2a0]
call esi
push 0x50c510
lea ecx, [esp + 0x29c]
call fcn.004035d5
push ebp
push dword [esp + 0x2a0]
call esi
push str.Terminal_
lea ecx, [esp + 0x29c]
call fcn.004035d5
push ebp
push dword [esp + 0x2a0]
call esi
push dword [esp + 0x84]
lea ecx, [esp + 0x29c]
call fcn.004035d5
push ebp
push dword [esp + 0x2a0]
call esi
push 0x51249c
lea ecx, [esp + 0x29c]
call fcn.004035d5
push ebp
push dword [esp + 0x2a0]
call esi
push str._server.ini
lea ecx, [esp + 0x29c]
call fcn.004035d5
push ecx
push ecx
push dword [esp + 0x2a4]
lea ebx, [edi + 0xa3f0]
mov ecx, ebx
call fcn.00404177
test al, al
je 0x458128
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x29c]
push str._sconfig_servers.dat
push eax
call fcn.0040371e
add esp, 0xc
push dword [esp + 0x29c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call fcn.00443e97
push str.Account_Request_Finish
mov ecx, 0x555890
call fcn.004444e4
mov esi, str.Account_Request_Success
jmp 0x45812d
mov esi, str.Account_Request_Error
mov edi, 0x555890
push esi
mov ecx, edi
call fcn.004444e4
push ebp
push esi
push ebp
push ebp
push edi
call fcn.004442ba
add esp, 0x14
mov ecx, ebx
call fcn.00404741
lea ecx, [esp + 0x10]
call fcn.004517a5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x69c
ret
Function at 0x458162
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x14]
push edi
call fcn.0040337a
mov eax, dword [ebp + 0x58]
xor ebx, ebx
add eax, 0x6ac
mov dword [esp + 0x10], ebx
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040371e
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, 0x20206
mov ecx, 0x20106
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x58]
push ebx
cmp dword [eax + 4], 2
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4583a1
mov esi, dword [ebp + 0x58]
add esi, 0x94
mov ecx, esi
call fcn.00408f92
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [esp + 0x24]
call edi
mov esi, dword [ebp + 0x58]
add esi, 0x29c
mov ecx, esi
call fcn.00408f92
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.InstallLocation
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x1c]
push str._s_terminal.ico
push eax
call fcn.0040371e
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x458271
mov ecx, dword [ebp + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [esp + 0x20]
push 0x50d448
push eax
call fcn.0040371e
add esp, 0x10
mov eax, dword [esp + 0x20]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push ebx
push str.DisplayIcon
push dword [esp + 0x24]
call edi
push 0x20
push 0x5091b0
push 1
push ebx
push str.Publisher
push dword [esp + 0x24]
call edi
push 0x36
mov esi, 0x51235c
push esi
push 1
push ebx
push str.HelpLink
push dword [esp + 0x24]
call edi
push 0x36
push esi
push 1
push ebx
push str.UrlInfoAbout
push dword [esp + 0x24]
call edi
mov esi, dword [esp + 0x234]
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
push dword [esi + 4]
push 1
push ebx
push str.UninstallString
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
push 0xa
cmp dword [eax + 8], 9
jae 0x458315
push str.5.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x512410
jmp 0x45832f
push str.4.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x51245c
push 1
push ebx
push 0x512414
push dword [esp + 0x24]
call edi
push 4
push 0x512430
push 1
push ebx
push 0x512434
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xa4a8]
call fcn.00401887
test al, al
jne 0x45839f
push dword [ebp + 0xa4ac]
lea eax, [esp + 0x1c]
push 0x512460
push eax
call fcn.0040371e
mov eax, dword [ebp + 0x58]
add esp, 0xc
add eax, 0x29c
push 1
push dword [esi + 4]
push ecx
push ecx
push dword [esp + 0x2c]
push dword [esi + 4]
push eax
call fcn.0046243e
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x220
ret 4
Function at 0x4583b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.0040337a
lea ecx, [ebp - 0x430]
call fcn.0040337a
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.00403e73
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.0040371e
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x458437
lea eax, [ebp - 0x430]
mov ecx, esi
push eax
mov bl, 1
call fcn.00458162
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x45843d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.0040337a
lea ecx, [ebp - 0x648]
call fcn.0040337a
lea ecx, [ebp - 0x430]
call fcn.0040337a
mov eax, dword [esi + 0x58]
xor bl, bl
cmp dword [eax + 8], 0xb
je 0x458482
cmp dword [eax + 8], 0xd
je 0x458482
cmp dword [eax + 8], 3
jne 0x4584c3
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._s_terminal.ico
push eax
call fcn.0040371e
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4584c3
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x4584c3
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push 0x50d448
push eax
call fcn.0040371e
mov ecx, dword [esi + 0x58]
add esp, 0x10
push dword [ebp - 0x42c]
lea eax, [ecx + 0x94]
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.00462580
test eax, eax
je 0x458555
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x458540
push dword [ebp - 0x20c]
push eax
call fcn.0042a711
pop ecx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
pop ecx
jmp 0x458547
and dword [ebp - 0x210], 0
push eax
lea ecx, [esi + 0x88c]
call fcn.00416e64
mov bl, al
mov ecx, dword [esi + 0x58]
cmp dword [ecx + 8], 0xb
je 0x458568
cmp dword [ecx + 8], 3
jne 0x458637
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x45857e
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
mov edx, 0x4f8934
mov eax, 0x511cbc
cmp dword [ecx + 4], 2
cmovne eax, edx
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push str._smetaeditor_s.exe
push eax
call fcn.0040371e
add esp, 0x10
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x458637
push dword [ebp - 0x42c]
mov ecx, dword [esi + 0x58]
mov edx, str.MetaEditor_5
push dword [ebp - 0x20c]
mov eax, str.MetaEditor_4
push dword [ebp - 0x214]
cmp dword [ecx + 8], 0xb
cmovne eax, edx
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.00462580
test eax, eax
je 0x458637
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x458622
push dword [ebp - 0x20c]
push eax
call fcn.0042a711
pop ecx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
pop ecx
jmp 0x458629
and dword [ebp - 0x210], 0
push eax
lea ecx, [esi + 0x88c]
call fcn.00416e64
mov bl, al
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x458767
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x10a4
call fcn.0041c820
cmp dword [esp + 0x10b0], 0
push ebx
push ebp
push esi
push edi
jne 0x458786
xor al, al
jmp 0x458971
push ecx
lea eax, [esp + 0xb4]
push eax
call fcn.00444553
test al, al
je 0x4587c9
mov ecx, dword [esp + 0x10bc]
push str..exe
call fcn.00403630
test eax, eax
jle 0x4587c9
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x10c8]
push eax
push dword [esp + 0x10c8]
call fcn.00461228
mov ebx, dword [esp + 0x10b8]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
cmp eax, 0xffffffff
je 0x458874
lea ecx, [esp + 0x40]
call fcn.00451786
push ebx
lea ecx, [esp + 0x44]
call fcn.004514dc
lea ecx, [esp + 0x40]
call fcn.00451889
lea esi, [esp + 0x98]
lea edi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004516fa
push dword [esp + 0x10c4]
push dword [esp + 0x10c4]
call fcn.004517d1
lea ecx, [esp + 0x40]
call fcn.00451889
lea esi, [esp + 0x98]
mov ecx, ebp
lea edi, [esp + 0x30]
movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x30]
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x45886b
inc ecx
cmp ecx, 4
jne 0x45884d
lea ecx, [esp + 0x40]
call fcn.004517a5
mov al, 1
jmp 0x458971
lea ecx, [esp + 0x40]
call fcn.004517a5
or dword [esp + 0x1c], 0xffffffff
mov esi, 0x40000000
push ecx
push 2
push 3
push esi
push dword [ebx + 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x4f88f0
call fcn.00401140
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
jne 0x4588e9
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4588be
push 0x80
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ecx
push 2
push 3
push esi
push dword [ebx + 4]
lea ecx, [esp + 0x2c]
call fcn.00401140
test al, al
jne 0x4588e9
push str.Install_Fail_File_Write_Open
mov ecx, 0x555890
call fcn.004444e4
mov esi, dword [esp + 0x1c]
jmp 0x458950
mov esi, dword [esp + 0x1c]
mov eax, ebp
mov dword [esp + 0x14], eax
cmp esi, 0xffffffff
je 0x458924
cmp eax, dword [esp + 0x10c4]
jae 0x45892b
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10cc]
push dword [esp + 0x10cc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10c4]
je 0x458954
push str.Install_Fail_File_Write
mov ecx, 0x555890
call fcn.004444e4
cmp esi, 0xffffffff
je 0x458947
push esi
call edi
or esi, 0xffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
jmp 0x458967
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x458965
push esi
call edi
or esi, 0xffffffff
mov bl, 1
cmp esi, 0xffffffff
je 0x45896f
push esi
call edi
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10a4
ret 0x10
Function at 0x4595ae
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
mov edi, 0x29c
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4595e0
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.004618f6
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.00462339
xor ebx, ebx
test eax, eax
je 0x4595ff
mov ecx, dword [esi + 0x58]
add ecx, edi
call fcn.0040e9a9
test al, al
jne 0x45963b
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x45963b
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x94]
push eax
lea eax, [esp + 0x14]
push eax
push 0x50d448
lea eax, [ecx + 0x29c]
push 0x103
push eax
call fcn.004165f2
add esp, 0x14
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.00462339
test eax, eax
je 0x4596f2
push dword [esi + 0x60]
mov ecx, esi
call fcn.00458c23
test al, al
jne 0x45967b
push str.Install_Fail_Extract_Core
mov ecx, 0x555890
call fcn.004444e4
lea ecx, [esi + 0x49d0]
call fcn.00460d81
jmp 0x459701
mov ecx, esi
call fcn.0045863d
test al, al
je 0x459701
mov ecx, esi
call fcn.00458d6c
mov byte [esi + 0xa6c2], al
test al, al
je 0x459701
mov ecx, esi
call fcn.00458d26
test al, al
je 0x459701
mov ecx, esi
call fcn.0045843d
mov edi, 0x555890
test al, al
jne 0x4596be
push str.Install_Fail_Create_Shortcut
mov ecx, edi
call fcn.004444e4
mov ecx, esi
call fcn.004583b0
test al, al
jne 0x4596d5
push str.Install_Fail_Create_Uninstall
mov ecx, edi
call fcn.004444e4
mov ecx, esi
call fcn.00457f58
mov ecx, esi
call fcn.00457e95
test al, al
je 0x459701
mov ecx, esi
call fcn.0045926d
mov al, 1
jmp 0x459714
push str.Install_Fail_Create_Folder
mov ecx, 0x555890
call fcn.004444e4
push ebx
push 7
push 0x464
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x459768
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x49d0]
call fcn.00460a98
mov ecx, esi
call fcn.004597f1
cmp byte [ebp + 8], 0
je 0x4597c2
mov byte [esi + 0xa6c0], 1
mov dword [esi + 0xa3bc], 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
lea ecx, [esi + 4]
call fcn.00416644
jmp 0x4597e9
xor ebx, ebx
push ebx
push dword [esi + 0xa744]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
mov ecx, esi
call fcn.0045a2f5
mov word [esi + 0xa6c0], 0x100
mov dword [esi + 0xa3bc], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4