joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449789
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.0041c3f0
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x449885
cmp dword [esp + 0x220], 0
je 0x449885
cmp dword [esp + 0x228], 0
je 0x449885
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x449885
mov esi, dword [esp + 0x230]
test esi, esi
je 0x449885
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x449885
cmp dword [esp + 8], 0
je 0x449885
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x44987f
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.0040397c
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.004494ce
jmp 0x449887
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x44991c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x428]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041c3f0
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x449a4d
cmp dword [ebp + 0x10], ebx
je 0x449a4d
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x449a4d
cmp dword [ebp - 4], ebx
je 0x449a4d
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x449a3b
push 0x467ef4
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.004166b3
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.004166b3
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x449a19
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0x460424
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x210], 0x104
call fcn.00402fc9
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x467f0c
call fcn.00411a8e
mov bl, al
jmp 0x449a1b
mov bl, 1
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
je 0x449a3b
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004490ab
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
test bl, bl
setne al
jmp 0x449a4f
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x449aa6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.0041c3f0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x449b23
mov ecx, dword [ebp + 0xc]
call fcn.00411b53
cmp eax, 1
jb 0x449b23
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x449b23
push 0x467ef4
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.004166b3
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.004166b3
sub esp, 0xc
lea eax, [ebp - 0x208]
push eax
call fcn.0044915a
pop ebx
leave
ret 8

Function at 0x449b5c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x449b74
xor eax, eax
jmp 0x449c0b
push SysReAllocString
push esi
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x410]
call fcn.004490ab
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x449baa
cmp word [eax], 0x5c
je 0x449bb6
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x449ba1
jmp 0x449bf1
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x449bf1
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x449bf1
lea eax, [ebp - 0x410]
mov ecx, 0x4b3d2c
push eax
call fcn.00449b5c
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x449c08
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x449c0b
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x44f029
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041c3f0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004045b8
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.004011fb
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x44f0ab
mov eax, str.Install_Fail_Start_Program
jmp 0x44f0da
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x44f0c9
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x44f0d3
push dword [ebp - 0xc]
call esi
mov bl, 1
mov eax, str.Install_Executed
push eax
mov ecx, 0x4ae1c0
call fcn.0043da8e
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x44f0ec
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x69c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 3
jne 0x44f2eb
xor ebp, ebp
cmp dword [edi + 0x7f34], ebp
ja 0x44f11c
cmp dword [edi + 0x7f30], 0x40
jb 0x44f2eb
lea ecx, [esp + 0x80]
call fcn.00403195
lea ecx, [esp + 0x298]
call fcn.004045b8
lea ecx, [esp + 0x10]
call fcn.00448ebd
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x80]
add eax, 0x29c
push eax
call fcn.00402fc9
mov edx, dword [esp + 0x84]
test edx, edx
je 0x44f175
mov eax, dword [esp + 0x88]
inc eax
push eax
push edx
call fcn.0042c82a
mov edx, dword [esp + 0x8c]
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.00448e31
mov eax, dword [esp + 0x88]
add eax, eax
push eax
push edx
call fcn.00448f08
lea ecx, [esp + 0x10]
call fcn.00448fc3
push dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push dword [esp + 0x88]
call fcn.00449033
push dword [esp + 0x29c]
push ebp
push ebp
push 0x1a
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x298]
call fcn.00403c53
mov esi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push ebp
push dword [esp + 0x2a0]
call esi
push 0x46abe0
lea ecx, [esp + 0x29c]
call fcn.004034ba
push ebp
push dword [esp + 0x2a0]
call esi
push str.Terminal_
lea ecx, [esp + 0x29c]
call fcn.004034ba
push ebp
push dword [esp + 0x2a0]
call esi
push dword [esp + 0x84]
lea ecx, [esp + 0x29c]
call fcn.004034ba
push ebp
push dword [esp + 0x2a0]
call esi
push 0x47063c
lea ecx, [esp + 0x29c]
call fcn.004034ba
push ebp
push dword [esp + 0x2a0]
call esi
push str._server.ini
lea ecx, [esp + 0x29c]
call fcn.004034ba
push ecx
push ecx
push dword [esp + 0x2a4]
lea ebx, [edi + 0x7f28]
mov ecx, ebx
call fcn.00403f55
test al, al
je 0x44f2bc
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x29c]
push str._sconfig_servers.dat
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x29c]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ecx
call fcn.0043d3bb
push str.Account_Request_Finish
mov ecx, 0x4ae1c0
call fcn.0043da8e
mov esi, str.Account_Request_Success
jmp 0x44f2c1
mov esi, str.Account_Request_Error
mov edi, 0x4ae1c0
push esi
mov ecx, edi
call fcn.0043da8e
push ebp
push esi
push ebp
push ebp
push edi
call fcn.0043d864
add esp, 0x14
mov ecx, ebx
call fcn.0041753b
lea ecx, [esp + 0x10]
call fcn.00448edc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x69c
ret
Function at 0x44f2f6
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x14]
push edi
call fcn.00403195
mov eax, dword [ebp + 0x58]
xor ebx, ebx
add eax, 0x6ac
mov dword [esp + 0x10], ebx
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, 0x20206
mov ecx, 0x20106
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x58]
push ebx
cmp dword [eax + 4], 2
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44f535
mov esi, dword [ebp + 0x58]
add esi, 0x94
mov ecx, esi
call fcn.00411b53
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [esp + 0x24]
call edi
mov esi, dword [ebp + 0x58]
add esi, 0x29c
mov ecx, esi
call fcn.00411b53
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.InstallLocation
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x1c]
push str._s_terminal.ico
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44f405
mov ecx, dword [ebp + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [esp + 0x20]
push str._s_s
push eax
call fcn.004011fb
add esp, 0x10
mov eax, dword [esp + 0x20]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push ebx
push str.DisplayIcon
push dword [esp + 0x24]
call edi
push 0x20
push 0x467840
push 1
push ebx
push str.Publisher
push dword [esp + 0x24]
call edi
push 0x36
mov esi, 0x4704fc
push esi
push 1
push ebx
push str.HelpLink
push dword [esp + 0x24]
call edi
push 0x36
push esi
push 1
push ebx
push str.UrlInfoAbout
push dword [esp + 0x24]
call edi
mov esi, dword [esp + 0x234]
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
push dword [esi + 4]
push 1
push ebx
push str.UninstallString
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
push 0xa
cmp dword [eax + 8], 9
jae 0x44f4a9
push str.5.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x4705b0
jmp 0x44f4c3
push str.4.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x4705fc
push 1
push ebx
push 0x4705b4
push dword [esp + 0x24]
call edi
push 4
push 0x4705d0
push 1
push ebx
push 0x4705d4
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x7fe0]
call fcn.00401b2b
test al, al
jne 0x44f533
push dword [ebp + 0x7fe4]
lea eax, [esp + 0x1c]
push 0x470600
push eax
call fcn.004011fb
mov eax, dword [ebp + 0x58]
add esp, 0xc
add eax, 0x29c
push 1
push dword [esi + 4]
push ecx
push ecx
push dword [esp + 0x2c]
push dword [esi + 4]
push eax
call fcn.004494ce
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x220
ret 4
Function at 0x44f544
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.00403195
lea ecx, [ebp - 0x430]
call fcn.00403195
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.00403c53
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x44f5cb
lea eax, [ebp - 0x430]
mov ecx, esi
push eax
mov bl, 1
call fcn.0044f2f6
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x44f5d1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x430]
call fcn.00403195
lea ecx, [ebp - 0x648]
call fcn.00403195
lea ecx, [ebp - 0x218]
call fcn.00403195
mov eax, dword [esi + 0x58]
xor bl, bl
cmp dword [eax + 8], 0xb
je 0x44f616
cmp dword [eax + 8], 0xd
je 0x44f616
cmp dword [eax + 8], 3
jne 0x44f657
add eax, 0x29c
push eax
lea eax, [ebp - 0x218]
push str._s_terminal.ico
push eax
call fcn.004011fb
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44f657
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x44f657
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push str._s_s
push eax
call fcn.004011fb
mov ecx, dword [esi + 0x58]
add esp, 0x10
push dword [ebp - 0x214]
lea eax, [ecx + 0x94]
push dword [ebp - 0x424]
push dword [ebp - 0x42c]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.004498b6
test eax, eax
je 0x44f6cc
lea ecx, [ebp - 0x430]
call fcn.00403c53
push dword [ebp - 0x42c]
lea ecx, [esi + 0x88c]
call fcn.00417d05
mov bl, al
mov ecx, dword [esi + 0x58]
cmp dword [ecx + 8], 0xb
je 0x44f6df
cmp dword [ecx + 8], 3
jne 0x44f791
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x44f6f8
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
cmp dword [ecx + 4], 2
mov edx, 0x46293c
mov eax, 0x46fe4c
cmovne eax, edx
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push str._smetaeditor_s.exe
push eax
call fcn.004011fb
add esp, 0x10
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44f791
push dword [ebp - 0x214]
mov ecx, dword [esi + 0x58]
mov edx, str.MetaEditor_5
push dword [ebp - 0x424]
mov eax, str.MetaEditor_4
push dword [ebp - 0x42c]
cmp dword [ecx + 8], 0xb
cmovne eax, edx
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.004498b6
test eax, eax
je 0x44f791
lea ecx, [ebp - 0x430]
call fcn.00403c53
push dword [ebp - 0x42c]
lea ecx, [esi + 0x88c]
call fcn.00417d05
mov bl, al
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x44f8e3
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x109c
call fcn.0041b500
cmp dword [esp + 0x10a8], 0
push ebx
push ebp
push esi
push edi
jne 0x44f902
xor al, al
jmp 0x44faec
push ecx
lea eax, [esp + 0xac]
push eax
call fcn.0043dafd
test al, al
je 0x44f945
mov ecx, dword [esp + 0x10b4]
push 0x470278
call fcn.00403515
test eax, eax
jle 0x44f945
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x10c0]
push eax
push dword [esp + 0x10c0]
call fcn.00458863
mov ebp, dword [esp + 0x10b0]
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x44f9f0
lea ecx, [esp + 0x38]
call fcn.00448ebd
push ebp
lea ecx, [esp + 0x3c]
call fcn.00448c10
lea ecx, [esp + 0x38]
call fcn.00448fc3
lea esi, [esp + 0x90]
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00448e31
push dword [esp + 0x10bc]
push dword [esp + 0x10bc]
call fcn.00448f08
lea ecx, [esp + 0x38]
call fcn.00448fc3
lea esi, [esp + 0x90]
mov ecx, ebx
lea edi, [esp + 0x28]
movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x28]
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x44f9e7
inc ecx
cmp ecx, 4
jne 0x44f9c9
lea ecx, [esp + 0x38]
call fcn.00448edc
mov al, 1
jmp 0x44faec
lea ecx, [esp + 0x38]
call fcn.00448edc
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
or esi, 0xffffffff
cmp dword [ebp + 4], ebx
je 0x44fa1e
push ebx
push 0x80
push 2
push ebx
push 3
push 0x40000000
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44fa63
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44fa3a
push 0x80
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
cmp dword [ebp + 4], ebx
je 0x44fad3
push ebx
push 0x80
push 2
push ebx
push 3
push 0x40000000
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44fad3
mov eax, ebx
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x10bc]
jae 0x44fa9c
push ebx
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10c4]
push dword [esp + 0x10c4]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10bc]
je 0x44fac3
push str.Install_Fail_File_Write
mov ecx, 0x4ae1c0
call fcn.0043da8e
cmp esi, 0xffffffff
je 0x44fab8
push esi
call edi
or esi, 0xffffffff
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x44fae2
cmp esi, 0xffffffff
je 0x44facf
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bl, 1
jmp 0x44faea
push str.Install_Fail_File_Write_Open
mov ecx, 0x4ae1c0
call fcn.0043da8e
cmp esi, 0xffffffff
je 0x44faea
push esi
call edi
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x109c
ret 0x10
Function at 0x44ff1a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa7c
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x86c]
push edi
call fcn.00403195
lea ecx, [esp + 0x658]
call fcn.00403195
lea ecx, [esp + 0x440]
call fcn.00403195
lea ecx, [esp + 0x228]
call fcn.00403195
lea ecx, [esp + 0x10]
call fcn.00403195
push dword [esi + 0x7fec]
mov eax, dword [esi + 0x58]
push dword [esi + 0x7fe4]
add eax, 0x6ac
push eax
call fcn.00449a55
test eax, eax
je 0x450181
lea ecx, [esi + 0x7fe0]
call fcn.00403c53
xor ebx, ebx
mov ebp, str._s_s
push 0x23
lea edi, [ebx + 1]
pop ebx
push edi
lea eax, [esp + 0x22c]
push str.link_name__u
push eax
call fcn.004011fb
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0x1c]
add esp, 0xc
push eax
push dword [esp + 0x230]
call fcn.00456437
test al, al
je 0x45017c
mov ecx, dword [esp + 0x14]
mov edx, str.PROGRAM
call fcn.004174a3
test eax, eax
jne 0x450005
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0x10]
push eax
push str.company_program_brief
call fcn.00456437
test al, al
je 0x45017c
push str..lnk
lea ecx, [esp + 0x14]
call fcn.004034ba
push dword [esp + 0x14]
lea eax, [esp + 0x874]
push dword [esi + 0x7fe4]
push ebp
push eax
call fcn.004011fb
push edi
lea eax, [esp + 0x23c]
push str.file_name__u
push eax
call fcn.004011fb
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0x2c]
add esp, 0x1c
push eax
push dword [esp + 0x230]
call fcn.00456437
test al, al
je 0x45017c
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x450074
lea ecx, [esp + 0x10]
mov edx, eax
push ecx
mov ecx, dword [esi + 0x58]
call fcn.0044eec0
pop ecx
test al, al
je 0x45017c
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x448]
push ebp
push eax
call fcn.004011fb
push edi
lea eax, [esp + 0x23c]
push str.icon_file__u
push eax
call fcn.004011fb
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0x2c]
add esp, 0x1c
push eax
push dword [esp + 0x230]
call fcn.00456437
test al, al
je 0x45017c
mov eax, dword [esp + 0x14]
cmp word [eax], bx
jne 0x4500e3
lea ecx, [esp + 0x10]
mov edx, eax
push ecx
mov ecx, dword [esi + 0x58]
call fcn.0044eec0
pop ecx
test al, al
je 0x45017c
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x660]
push ebp
push eax
call fcn.004011fb
push edi
lea eax, [esp + 0x23c]
push str.icon_index__u
push eax
call fcn.004011fb
mov ecx, dword [esi + 0x5c]
lea eax, [esp + 0x2c]
add esp, 0x1c
push eax
push dword [esp + 0x230]
call fcn.00456437
test al, al
je 0x45017c
push dword [esp + 0x14]
call fcn.00429d81
pop ecx
push dword [esp + 0x444]
mov ebp, eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45016d
mov eax, dword [esi + 0x58]
push ebp
push dword [esp + 0x660]
add eax, 0x29c
push ecx
push ecx
push dword [esp + 0x884]
push dword [esp + 0x458]
push eax
call fcn.004494ce
inc edi
mov ebp, str._s_s
cmp edi, 0x40
jb 0x44ff99
xor ebx, ebx
inc ebx
jmp 0x450192
push str.Install_Fail_Create_Group
mov ecx, 0x4ae1c0
call fcn.0043da8e
xor bl, bl
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xa7c
ret
Function at 0x45069f
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esi + 0x58]
mov edi, 0x29c
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4506da
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.00458e88
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.00449b5c
test eax, eax
je 0x4506f7
mov ecx, dword [esi + 0x58]
add ecx, edi
call fcn.0041001b
test al, al
jne 0x450733
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x450733
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x94]
push eax
lea eax, [esp + 0x14]
push eax
push str._s_s
lea eax, [ecx + 0x29c]
push 0x103
push eax
call fcn.004174cc
add esp, 0x14
mov eax, dword [esi + 0x58]
add eax, edi
push eax
call fcn.00449b5c
test eax, eax
je 0x4507ea
push dword [esi + 0x60]
mov ecx, esi
call fcn.0044fd9e
test al, al
jne 0x450773
push str.Install_Fail_Extract_Core
mov ecx, 0x4ae1c0
call fcn.0043da8e
lea ecx, [esi + 0x4580]
call fcn.004583b2
jmp 0x4507f9
mov ecx, esi
call fcn.0044f797
test al, al
je 0x4507f9
mov ecx, esi
call fcn.0044ff1a
mov byte [esi + 0x81fa], al
test al, al
je 0x4507f9
mov ecx, esi
call fcn.0044fed4
test al, al
je 0x4507f9
mov ecx, esi
call fcn.0044f5d1
mov edi, 0x4ae1c0
test al, al
jne 0x4507b6
push str.Install_Fail_Create_Shortcut
mov ecx, edi
call fcn.0043da8e
mov ecx, esi
call fcn.0044f544
test al, al
jne 0x4507cd
push str.Install_Fail_Create_Uninstall
mov ecx, edi
call fcn.0043da8e
mov ecx, esi
call fcn.0044f0ec
mov ecx, esi
call fcn.0044f029
test al, al
je 0x4507f9
mov ecx, esi
call fcn.004503ef
mov bl, 1
jmp 0x45080a
push str.Install_Fail_Create_Folder
mov ecx, 0x4ae1c0
call fcn.0043da8e
push ebx
push 7
push 0x464
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45084c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 0x4580]
call fcn.00458189
mov ecx, esi
call fcn.004508d7
cmp byte [ebp + 8], 0
je 0x4508a8
mov byte [esi + 0x81f8], 1
mov dword [esi + 0x7ef8], 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
lea ecx, [esi + 4]
call fcn.0041751e
jmp 0x4508cf
xor ebx, ebx
push ebx
push dword [esi + 0x827c]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
mov ecx, esi
call fcn.004513fb
mov word [esi + 0x81f8], 0x100
mov dword [esi + 0x7ef8], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4