joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cdd4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x45c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov ebx, esi
call fcn.0041cce0
mov edi, dword [esp + 0x47c]
add esp, 0xc
test edi, edi
je 0x44cfb0
push 0x470f98
push edi
push 0x470fa8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c67
add esp, 0x14
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44cf5f
test byte [esp + 0x218], 0x10
lea eax, [esp + 0x244]
je 0x44cebd
push 0x46fdec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44cf41
push 0x470fa0
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44cf41
lea eax, [esp + 0x244]
push eax
push edi
push 0x470fa8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c67
add esp, 0x14
lea eax, [esp + 0x10]
mov ecx, 0x4c7270
push 1
push 1
push 0x470f98
push eax
call fcn.0044cdd4
add ebx, eax
jmp 0x44cf41
push eax
push edi
push 0x470fa8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c67
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44cf40
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44ceec
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x491ec0]
jae 0x44cf40
mov esi, dword [0x491ebc]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00438dcc
add esp, 0xc
xor esi, esi
test eax, eax
je 0x44cf40
push 4
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4c7270], 1
inc ebx
lea eax, [esp + 0x218]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44ce3e
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x44cf6d
inc ebx
jmp 0x44cfac
mov ecx, edi
call fcn.004095cd
cmp eax, dword [0x491ec0]
jae 0x44cfac
mov esi, dword [0x491ebc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call fcn.00438dcc
add esp, 0xc
test eax, eax
je 0x44cfac
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4c7270], 1
mov eax, ebx
jmp 0x44cfb2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c
ret 0x10
Function at 0x44cfbf
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebp
push esi
mov ebp, 0x2b4
push ebp
push 0
push eax
call fcn.0041cce0
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x44d131
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x44d130
push ebx
mov ebx, dword [esp + 0x6d8]
test ebx, ebx
je 0x44d12f
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebx], 0xffffffff
push ebp
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebp
test eax, eax
jle 0x44d06c
push edi
call ebp
dec eax
shr eax, 1
je 0x44d060
push SysReAllocString
lea ecx, [esp + 0x228]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044cd25
mov eax, dword [esp + 0x21c]
jmp 0x44d12d
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push closesocket
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.00415d5c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push closesocket
call esi
lea eax, [esp + 0x18]
push 0x46f890
push eax
call fcn.0041bfde
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x44d12f
push eax
call ebp
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebp
push edi
add esi, eax
call ebp
shr eax, 1
je 0x44d11f
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x44d10f
xor eax, eax
mov word [edi], ax
jmp 0x44d11f
push esi
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044cd25
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.0042a755
pop ecx
mov dword [ebx], eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x6bc
ret 0xc
Function at 0x44d13c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x44d276
cmp dword [ebp + 0x10], 0
je 0x44d276
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0041cce0
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push 0x45f760
push 1
push edi
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44d276
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x44d276
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x44d1be
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0044cfbf
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0xc]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
mov esi, 0x4679ec
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
push 0x45f7a0
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x44d264
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44d264
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x44d278
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x44d27e
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x44d3ef
cmp dword [ebp + 0x10], ebx
je 0x44d3ef
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d3ef
cmp dword [ebp - 4], ebx
je 0x44d3ef
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44d3e1
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov edi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00403c67
add esp, 0x14
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
push eax
push 0x45f760
push 1
push ebx
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44d3e0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44d3e0
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
mov eax, dword [ecx]
push edx
push 0x45f7a0
push ecx
call dword [eax]
test eax, eax
js 0x44d3c0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44d3c0
mov eax, dword [ecx]
lea edx, [ebp - 0x414]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x44d3b7
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x61c]
push edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
js 0x44d3b7
lea eax, [ebp - 0x61c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44d3ad
test cx, cx
je 0x44d3b2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44d3ad
add esi, 4
add eax, 4
test cx, cx
jne 0x44d389
jmp 0x44d3b2
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x44d3e0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop edi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x44d3f1
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x44d3f7
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.0041cce0
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x44d4f3
cmp dword [esp + 0x220], 0
je 0x44d4f3
cmp dword [esp + 0x228], 0
je 0x44d4f3
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x44d4f3
mov esi, dword [esp + 0x230]
test esi, esi
je 0x44d4f3
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d4f3
cmp dword [esp + 8], 0
je 0x44d4f3
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x44d4ed
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.00403c67
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.0044d13c
jmp 0x44d4f5
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x44d58a
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x428]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041cce0
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44d6bb
cmp dword [ebp + 0x10], ebx
je 0x44d6bb
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d6bb
cmp dword [ebp - 4], ebx
je 0x44d6bb
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44d6a9
push 0x46cfbc
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415d5c
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415d5c
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d687
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0x4654d8
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x210], 0x104
call fcn.0040349c
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x46cfd4
call fcn.00410f6c
mov bl, al
jmp 0x44d689
mov bl, 1
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
je 0x44d6a9
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0044cd25
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
test bl, bl
setne al
jmp 0x44d6bd
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x44d714
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.0041cce0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x44d791
mov ecx, dword [ebp + 0xc]
call fcn.004095cd
cmp eax, 1
jb 0x44d791
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44d791
push 0x46cfbc
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415d5c
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415d5c
sub esp, 0xc
lea eax, [ebp - 0x208]
push eax
call fcn.0044cdd4
pop ebx
leave
ret 8

Function at 0x44d7ca
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x44d7e2
xor eax, eax
jmp 0x44d879
push SysReAllocString
push esi
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x410]
call fcn.0044cd25
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x44d818
cmp word [eax], 0x5c
je 0x44d824
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x44d80f
jmp 0x44d85f
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d85f
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44d85f
lea eax, [ebp - 0x410]
mov ecx, 0x4c7270
push eax
call fcn.0044d7ca
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d876
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44d879
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x453dc5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0041cce0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004049dc
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.004011fb
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x453e47
mov eax, str.Install_Fail_Start_Program
jmp 0x453e76
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x453e65
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x453e6f
push dword [ebp - 0xc]
call esi
mov bl, 1
mov eax, str.Install_Executed
push eax
mov ecx, 0x4b40d0
call fcn.0043f31d
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x453e88
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x69c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
cmp dword [eax + 8], 3
jne 0x454087
xor ebp, ebp
cmp dword [edi + 0x879c], ebp
ja 0x453eb8
cmp dword [edi + 0x8798], 0x40
jb 0x454087
lea ecx, [esp + 0x80]
call fcn.00403638
lea ecx, [esp + 0x298]
call fcn.004049dc
lea ecx, [esp + 0x10]
call fcn.0044cb3a
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x80]
add eax, 0x29c
push eax
call fcn.0040349c
mov edx, dword [esp + 0x84]
test edx, edx
je 0x453f11
mov eax, dword [esp + 0x88]
inc eax
push eax
push edx
call fcn.0042d28a
mov edx, dword [esp + 0x8c]
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.0044caae
mov eax, dword [esp + 0x88]
add eax, eax
push eax
push edx
call fcn.0044cb85
lea ecx, [esp + 0x10]
call fcn.0044cc3d
push dword [esp + 0x8c]
lea ecx, [esp + 0x14]
push dword [esp + 0x88]
call fcn.0044ccad
push dword [esp + 0x29c]
push ebp
push ebp
push 0x1a
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x298]
call fcn.00403f78
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
push dword [esp + 0x2a0]
call esi
push 0x470070
lea ecx, [esp + 0x29c]
call fcn.00403846
push ebp
push dword [esp + 0x2a0]
call esi
push str.Terminal_
lea ecx, [esp + 0x29c]
call fcn.00403846
push ebp
push dword [esp + 0x2a0]
call esi
push dword [esp + 0x84]
lea ecx, [esp + 0x29c]
call fcn.00403846
push ebp
push dword [esp + 0x2a0]
call esi
push 0x475fbc
lea ecx, [esp + 0x29c]
call fcn.00403846
push ebp
push dword [esp + 0x2a0]
call esi
push str._server.ini
lea ecx, [esp + 0x29c]
call fcn.00403846
push ecx
push ecx
push dword [esp + 0x2a4]
lea ebx, [edi + 0x8790]
mov ecx, ebx
call fcn.0040427c
test al, al
je 0x454058
mov eax, dword [edi + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x29c]
push str._sconfig_servers.dat
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x29c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call fcn.0043ec4a
push str.Account_Request_Finish
mov ecx, 0x4b40d0
call fcn.0043f31d
mov esi, str.Account_Request_Success
jmp 0x45405d
mov esi, str.Account_Request_Error
mov edi, 0x4b40d0
push esi
mov ecx, edi
call fcn.0043f31d
push ebp
push esi
push ebp
push ebp
push edi
call fcn.0043f0f3
add esp, 0x14
mov ecx, ebx
call fcn.00404918
lea ecx, [esp + 0x10]
call fcn.0044cb59
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x69c
ret
Function at 0x454092
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x14]
push edi
call fcn.00403638
mov eax, dword [ebp + 0x58]
xor ebx, ebx
add eax, 0x6ac
mov dword [esp + 0x10], ebx
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 0x14]
mov edx, 0x20206
mov ecx, 0x20106
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x58]
push ebx
cmp dword [eax + 4], 2
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [esp + 0x38]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4542d1
mov esi, dword [ebp + 0x58]
add esi, 0x94
mov ecx, esi
call fcn.004095cd
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [esp + 0x24]
call edi
mov esi, dword [ebp + 0x58]
add esi, 0x29c
mov ecx, esi
call fcn.004095cd
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.InstallLocation
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
add eax, 0x29c
push eax
lea eax, [esp + 0x1c]
push str._s_terminal.ico
push eax
call fcn.004011fb
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4541a1
mov ecx, dword [ebp + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [esp + 0x20]
push 0x470fa8
push eax
call fcn.004011fb
add esp, 0x10
mov eax, dword [esp + 0x20]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push ebx
push str.DisplayIcon
push dword [esp + 0x24]
call edi
push 0x20
push 0x46c8e0
push 1
push ebx
push str.Publisher
push dword [esp + 0x24]
call edi
push 0x36
mov esi, 0x475e7c
push esi
push 1
push ebx
push str.HelpLink
push dword [esp + 0x24]
call edi
push 0x36
push esi
push 1
push ebx
push str.UrlInfoAbout
push dword [esp + 0x24]
call edi
mov esi, dword [esp + 0x234]
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
push dword [esi + 4]
push 1
push ebx
push str.UninstallString
push dword [esp + 0x24]
call edi
mov eax, dword [ebp + 0x58]
push 0xa
cmp dword [eax + 8], 9
jae 0x454245
push str.5.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x475f30
jmp 0x45425f
push str.4.00
push 1
push ebx
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push 4
push 0x475f7c
push 1
push ebx
push 0x475f34
push dword [esp + 0x24]
call edi
push 4
push 0x475f50
push 1
push ebx
push 0x475f54
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8848]
call fcn.00401b89
test al, al
jne 0x4542cf
push dword [ebp + 0x884c]
lea eax, [esp + 0x1c]
push 0x475f80
push eax
call fcn.004011fb
mov eax, dword [ebp + 0x58]
add esp, 0xc
add eax, 0x29c
push 1
push dword [esi + 4]
push ecx
push ecx
push dword [esp + 0x2c]
push dword [esi + 4]
push eax
call fcn.0044d13c
mov bl, 1
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x220
ret 4
Function at 0x4542e0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.00403638
lea ecx, [ebp - 0x430]
call fcn.00403638
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.00403f78
mov eax, dword [esi + 0x58]
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.004011fb
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x454367
lea eax, [ebp - 0x430]
mov ecx, esi
push eax
mov bl, 1
call fcn.00454092
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x45436d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.00403638
lea ecx, [ebp - 0x648]
call fcn.00403638
lea ecx, [ebp - 0x430]
call fcn.00403638
mov eax, dword [esi + 0x58]
xor bl, bl
cmp dword [eax + 8], 0xb
je 0x4543b2
cmp dword [eax + 8], 0xd
je 0x4543b2
cmp dword [eax + 8], 3
jne 0x4543f3
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._s_terminal.ico
push eax
call fcn.004011fb
add esp, 0xc
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4543f3
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x4543f3
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push 0x470fa8
push eax
call fcn.004011fb
mov ecx, dword [esi + 0x58]
add esp, 0x10
push dword [ebp - 0x42c]
lea eax, [ecx + 0x94]
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.0044d524
test eax, eax
je 0x454485
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x454470
push dword [ebp - 0x20c]
push eax
call fcn.0041eaec
pop ecx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
pop ecx
jmp 0x454477
and dword [ebp - 0x210], 0
push eax
lea ecx, [esi + 0x88c]
call fcn.004173ff
mov bl, al
mov ecx, dword [esi + 0x58]
cmp dword [ecx + 8], 0xb
je 0x454498
cmp dword [ecx + 8], 3
jne 0x454567
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x4544ae
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x58]
mov edx, 0x4679ec
mov eax, 0x4757dc
cmp dword [ecx + 4], 2
cmovne eax, edx
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push str._smetaeditor_s.exe
push eax
call fcn.004011fb
add esp, 0x10
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x454567
push dword [ebp - 0x42c]
mov ecx, dword [esi + 0x58]
mov edx, str.MetaEditor_5
push dword [ebp - 0x20c]
mov eax, str.MetaEditor_4
push dword [ebp - 0x214]
cmp dword [ecx + 8], 0xb
cmovne eax, edx
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.0044d524
test eax, eax
je 0x454567
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x454552
push dword [ebp - 0x20c]
push eax
call fcn.0041eaec
pop ecx
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x214]
pop ecx
jmp 0x454559
and dword [ebp - 0x210], 0
push eax
lea ecx, [esi + 0x88c]
call fcn.004173ff
mov bl, al
pop esi
mov al, bl
pop ebx
leave
ret