joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de6f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push esi
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
call fcn.004243a0
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x40e056
cmp dword [ebp + 0xc], esi
je 0x40e056
push dword [ebp + 0xc]
mov ebx, str._s_s
push dword [ebp + 8]
mov ecx, 0x104
push ebx
lea edi, [esp + 0x24]
call fcn.0040ccfb
add esp, 0xc
lea eax, [esp + 0x220]
push eax
mov eax, edi
push eax
call dword [sym.imp.l_mt5clwtst__FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40dffa
test byte [esp + 0x220], 0x10
je 0x40df6b
cmp byte [ebp + 0x10], 0
je 0x40df6b
mov esi, dword [sym.imp.l_mt5clwtst__lstrcmpW]
push 0x435df0
lea eax, [esp + 0x250]
push eax
call esi
test eax, eax
je 0x40dfd6
push 0x435df4
lea eax, [esp + 0x250]
push eax
call esi
test eax, eax
je 0x40dfd6
lea eax, [esp + 0x24c]
push eax
push dword [ebp + 8]
mov ecx, 0x104
push ebx
lea edi, [esp + 0x24]
call fcn.0040ccfb
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push dword [ebp + 0x10]
mov eax, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0040de6f
add dword [esp + 0xc], eax
jmp 0x40dfd6
lea eax, [esp + 0x24c]
push eax
push dword [ebp + 8]
mov ecx, 0x104
push ebx
lea edi, [esp + 0x24]
call fcn.0040ccfb
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.l_mt5clwtst__DeleteFileW]
test eax, eax
jne 0x40dfd2
mov eax, edi
call fcn.0040831a
cmp eax, dword [0x441340]
jae 0x40dfd2
mov esi, dword [0x44133c]
mov eax, edi
push eax
call dword [sym.imp.l_mt5clwtst__lstrlenW]
mov ecx, eax
add ecx, ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40dfd2
push 4
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.l_mt5clwtst__MoveFileExW]
mov eax, dword [esp + 0x10]
mov byte [eax], 1
inc dword [esp + 0xc]
lea eax, [esp + 0x220]
push eax
push dword [esp + 0x18]
call dword [sym.imp.l_mt5clwtst__FindNextFileW]
test eax, eax
jne 0x40deef
push dword [esp + 0x14]
call dword [sym.imp.l_mt5clwtst__FindClose]
cmp byte [ebp + 0x14], 0
je 0x40e050
push dword [ebp + 8]
call dword [sym.imp.l_mt5clwtst__RemoveDirectoryW]
test eax, eax
je 0x40e013
inc dword [esp + 0xc]
jmp 0x40e050
mov eax, dword [ebp + 8]
call fcn.0040831a
cmp eax, dword [0x441340]
jae 0x40e050
mov edi, dword [ebp + 8]
mov esi, dword [0x44133c]
push edi
call dword [sym.imp.l_mt5clwtst__lstrlenW]
mov ecx, eax
add ecx, ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40e050
push 4
push eax
push dword [ebp + 8]
call dword [sym.imp.l_mt5clwtst__MoveFileExW]
mov eax, dword [esp + 0x10]
mov byte [eax], 1
mov eax, dword [esp + 0xc]
jmp 0x40e058
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e061
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [ebp + 8], 0
jne 0x40e074
xor al, al
leave
ret
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.l_mt5clwtst__GetFileAttributesW]
call edi
cmp eax, 0xffffffff
je 0x40e08f
shr al, 4
and al, 1
jmp 0x40e119
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push 0x104
push eax
call fcn.0040ab8d
mov ebx, dword [sym.imp.l_mt5clwtst__CreateDirectoryW]
add esp, 0xc
cmp word [ebp - 0x208], 0
lea esi, [ebp - 0x208]
je 0x40e0f4
cmp word [esi], 0x5c
jne 0x40e0ec
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x208]
push eax
call edi
cmp eax, 0xffffffff
jne 0x40e0e6
push 0
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
je 0x40e111
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
cmp word [esi], 0
jne 0x40e0be
lea eax, [ebp - 0x208]
push eax
call edi
cmp eax, 0xffffffff
jne 0x40e115
push 0
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
jne 0x40e115
xor al, al
jmp 0x40e117
mov al, 1
pop esi
pop ebx
pop edi
leave
ret

Function at 0x40f128
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
xor eax, eax
push edi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x40f15b
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.l_mt5clwtst__GetFileSizeEx]
test eax, eax
je 0x40f15b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
jmp 0x40f15f
xor eax, eax
xor edx, edx
pop edi
leave
ret 4
Function at 0x413f89
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
cmp byte [edi + 0x182d], bl
jne 0x413fc9
cmp byte [edi + 0x182c], bl
je 0x413fc9
mov eax, dword [edi + 0x54]
test byte [eax], 2
je 0x414008
push 1
mov edi, eax
lea eax, [edi + 0x216]
push eax
push ebx
add edi, 0x41e
push edi
push 0x43594c
push ebx
call dword [0x430374]
jmp 0x414008
cmp byte [edi + 0x182e], bl
je 0x413fdf
mov esi, dword [edi + 0x54]
add esi, 0x626
call fcn.0040d870
xor esi, esi
cmp dword [edi + 0x13f0], ebx
jbe 0x414008
mov eax, dword [edi + 0x13f8]
imul eax, esi
add eax, dword [edi + 0x13ec]
push eax
call dword [sym.imp.l_mt5clwtst__DeleteFileW]
inc esi
cmp esi, dword [edi + 0x13f0]
jb 0x413fe9
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x41400e
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, eax
push 5
push dword [esi + 4]
call dword [0x430420]
cmp dword [esp + 0xc], 0
jne 0x414037
push 7
mov eax, 0xc8
xor edi, edi
call fcn.00409b2d
call fcn.00409b51
cmp dword [esp + 0xc], 1
jne 0x41404e
call fcn.00409bcb
push 8
pop edi
push edi
xor eax, eax
call fcn.00409b2d
cmp dword [esp + 0xc], 2
jne 0x414065
call fcn.00409bcb
push 9
pop edi
push edi
xor eax, eax
call fcn.00409b2d
pop edi
pop esi
ret 4

Function at 0x4142ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push edi
lea edi, [esi + 0x1a20]
push 0
mov eax, edi
call fcn.0041400e
mov eax, dword [esi + 0x54]
mov ebp, 0x216
add eax, ebp
push eax
mov bl, 1
call dword [sym.imp.l_mt5clwtst__GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x414303
mov eax, dword [esi + 0x54]
add eax, ebp
push eax
mov ecx, 0x441598
call fcn.0040d7c2
test eax, eax
jne 0x414303
push str.createfolder
lea ecx, [esi + 0x182f]
mov eax, 0x80
xor bl, bl
call fcn.0041631a
xor eax, eax
test bl, bl
sete al
inc eax
push eax
mov eax, edi
call fcn.0041400e
xor eax, eax
test bl, bl
sete al
push 0
dec eax
and eax, 0xfffffffb
add eax, 0xb
push eax
push 0x464
push dword [esi + 4]
call dword [0x4303f0]
pop edi
pop ebp
mov al, bl
pop ebx
ret
Function at 0x414d0f
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x44c], ax
xor ebx, ebx
lea eax, [ebp - 0x44a]
push ebx
push eax
call fcn.004243a0
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
push 0x104
call dword [sym.imp.l_mt5clwtst__GetTempPathW]
test eax, eax
jne 0x414d6d
push str.temppathnotfound
lea ecx, [edi + 0x182f]
mov eax, 0x80
call fcn.0041631a
xor al, al
jmp 0x414f0d
lea eax, [ebp - 0x3c]
call fcn.0040bb6b
or dword [ebp - 0x14], 0xffffffff
xor eax, eax
push esi
mov word [ebp - 0x244], ax
lea eax, [ebp - 0x242]
push ebx
push eax
mov dword [ebp - 0x18], 0x435590
call fcn.004243a0
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 5], 1
call fcn.0041619e
test al, al
je 0x414efb
mov esi, dword [sym.imp.l_mt5clwtst__CloseHandle]
cmp byte [ebp - 5], bl
je 0x414ef0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0xc], 5
je 0x414e03
mov eax, dword [edi + 0x54]
mov eax, dword [eax + 4]
cmp eax, 1
jne 0x414df4
cmp dword [ebp - 0xc], 8
jne 0x414eb0
cmp eax, 2
jne 0x414e03
cmp dword [ebp - 0xc], 9
jne 0x414eb0
lea eax, [ebp - 0x244]
push eax
push ebx
push 0x437220
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.l_mt5clwtst__GetTempFileNameW]
test eax, eax
je 0x414ed1
push 2
push 3
push 0x40000000
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x18]
call fcn.004018e1
test al, al
je 0x414ed8
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.0040ab04
cmp eax, dword [ebp - 0x10]
sete byte [ebp - 5]
cmp dword [ebp - 0x14], 0xffffffff
je 0x414e69
push dword [ebp - 0x14]
call esi
or dword [ebp - 0x14], 0xffffffff
cmp byte [ebp - 5], bl
je 0x414ea3
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [edi + 0x54]
add eax, 0x216
push eax
lea eax, [ebp - 0x244]
push eax
mov ebx, edi
call fcn.00414f13
mov byte [ebp - 5], al
test al, al
je 0x414ea1
lea eax, [edi + 0x13e8]
lea ecx, [ebp - 0x3c]
call fcn.00415ea7
mov byte [ebp - 5], al
xor ebx, ebx
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.l_mt5clwtst__DeleteFileW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
call fcn.0041619e
test al, al
jne 0x414dcd
jmp 0x414ef0
push str.tempfilenotfound
jmp 0x414edd
push str.tempwritefailed
mov eax, 0x80
lea ecx, [edi + 0x182f]
call fcn.0041631a
mov byte [ebp - 5], bl
cmp dword [ebp - 0x14], 0xffffffff
je 0x414efb
push dword [ebp - 0x14]
call esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x435b6c
call fcn.0040b047
mov al, byte [ebp - 5]
pop esi
pop ebx
leave
ret 4
Function at 0x415384
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 0x430]
call fcn.0040648e
lea eax, [ebp - 0x648]
call fcn.0040648e
lea eax, [ebp - 0x218]
call fcn.0040648e
mov eax, dword [edi + 0x54]
mov ecx, dword [eax + 8]
xor ebx, ebx
cmp ecx, 6
je 0x4153ca
cmp ecx, 7
je 0x4153ca
cmp ecx, 3
jne 0x415408
add eax, 0x216
push eax
push str._s_terminal.ico
lea eax, [ebp - 0x218]
call fcn.004017f8
pop ecx
pop ecx
push dword [ebp - 0x214]
call dword [sym.imp.l_mt5clwtst__GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x415408
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], ebx
cmp eax, ebx
je 0x415408
xor ecx, ecx
mov word [eax], cx
mov eax, dword [edi + 0x54]
lea ecx, [eax + 0x41e]
push ecx
add eax, 0x216
push eax
push str._s_s
lea eax, [ebp - 0x648]
call fcn.004017f8
mov eax, dword [edi + 0x54]
add esp, 0xc
push dword [ebp - 0x214]
lea ecx, [eax + 0xe]
push dword [ebp - 0x424]
add eax, 0x216
push dword [ebp - 0x42c]
push ecx
push dword [ebp - 0x644]
push eax
call fcn.0040dab1
test eax, eax
je 0x415478
lea esi, [ebp - 0x430]
call fcn.00406474
push dword [ebp - 0x42c]
add edi, 0x13e8
push edi
call fcn.0040baf6
mov bl, al
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x415a45
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
mov esi, eax
lea eax, [ebp - 0x54]
push ebx
push eax
mov dword [ebp - 0x58], ebx
call fcn.004243a0
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x270]
call fcn.0040648e
mov eax, dword [esi + 0x54]
lea ecx, [eax + 0x41e]
push ecx
add eax, 0x216
push eax
push str.__s_s___install
lea eax, [ebp - 0x270]
call fcn.004017f8
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x26c]
push ebx
call dword [sym.imp.l_mt5clwtst__CreateProcessW]
test eax, eax
jne 0x415ae8
call dword [sym.imp.l_mt5clwtst__GetLastError]
push eax
push str.startprograminstall__d_
lea edi, [esi + 0x182f]
mov ecx, 0x80
call fcn.00416120
pop ecx
pop ecx
xor al, al
jmp 0x415bc8
mov edi, dword [sym.imp.l_mt5clwtst__CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x415b06
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.l_mt5clwtst__WaitForSingleObject]
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0xc], ebx
je 0x415b10
push dword [ebp - 0xc]
call edi
mov eax, dword [esi + 0x54]
cmp dword [eax + 8], 3
jne 0x415bc6
push dword [ebp - 0x264]
push dword [ebp - 0x26c]
push ebx
call dword [sym.imp.l_mt5clwtst__GetModuleFileNameW]
lea esi, [ebp - 0x270]
call fcn.00406474
push 0x2e
call fcn.0040644a
cmp eax, ebx
jle 0x415b64
mov ecx, dword [ebp - 0x26c]
cmp ecx, ebx
je 0x415b64
cmp eax, dword [ebp - 0x268]
jae 0x415b64
xor edx, edx
mov dword [ebp - 0x268], eax
mov word [ecx + eax*2], dx
push 0x5c
lea esi, [ebp - 0x270]
call fcn.0040644a
cmp eax, ebx
jle 0x415b7f
lea edx, [eax + 1]
mov eax, esi
call fcn.00415ed3
lea eax, [ebp - 0x270]
call fcn.0040afbe
test al, al
jne 0x415bc6
cmp dword [ebp - 0x26c], ebx
je 0x415ba9
push dword [ebp - 0x264]
push dword [ebp - 0x26c]
call fcn.0042388d
pop ecx
pop ecx
push dword [ebp - 0x26c]
push 0x43769c
push str.SoftwareMetaQuotes_SoftwareMetaTrader_5Settings
push 0x80000001
call fcn.0040cdcc
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416a92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
push 0x4378a0
push eax
push dword [0x440608]
call dword [sym.imp.l_mt5clwtst__FindResourceW]
mov esi, eax
test esi, esi
je 0x416b5d
push esi
push dword [0x440604]
call dword [sym.imp.l_mt5clwtst__SizeofResource]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0x32
jbe 0x416b5d
push esi
push dword [0x440604]
call dword [sym.imp.l_mt5clwtst__LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x416b5d
push eax
call dword [sym.imp.l_mt5clwtst__LockResource]
mov ebx, eax
test ebx, ebx
je 0x416b5d
push 0x4406a8
shr edi, 1
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00422c07
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x416b2a
xor bl, bl
push dword [ebp + 0xc]
call dword [sym.imp.l_mt5clwtst__FreeResource]
mov al, bl
jmp 0x416b5f
mov eax, dword [ebp - 4]
add eax, 0xfffffffe
push eax
add ebx, 2
push ebx
push esi
call fcn.004261c0
xor eax, eax
add esp, 0xc
mov word [esi + edi*2 - 4], ax
mov eax, dword [ebp + 8]
push esi
push dword [eax + 0x60]
call dword [0x430424]
push esi
call fcn.00422772
pop ecx
mov bl, 1
jmp 0x416b1d
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x416e9b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 0x218]
call fcn.0040648e
lea eax, [ebp - 0x430]
call fcn.0040648e
call fcn.00416cdc
push 7
push dword [edi + 4]
call fcn.0040b516
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push dword [edi + 0x538]
call dword [0x4303ec]
lea esi, [ebp - 0x218]
call fcn.00406474
mov eax, dword [edi + 0x54]
add eax, 0xe
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
call fcn.004017f8
mov esi, dword [0x430424]
pop ecx
pop ecx
push dword [ebp - 0x42c]
push dword [edi + 0x538]
call esi
mov eax, dword [edi + 0x54]
add eax, 0x216
push eax
push dword [edi + 0x60]
call esi
mov eax, dword [edi + 0x54]
add eax, 0x626
push eax
push dword [edi + 0x2a8]
call esi
mov eax, dword [edi + 0x54]
mov eax, dword [eax]
mov esi, dword [0x430444]
push 0
and eax, 1
push eax
mov ebx, 0xf1
push ebx
push dword [edi + 0x514]
call esi
mov eax, dword [edi + 0x54]
mov eax, dword [eax]
push 0
shr eax, 1
and eax, 1
push eax
push ebx
push dword [edi + 0x4f0]
call esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x41720c
Capabilities:
Get common file path
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x230], ax
xor ebx, ebx
lea eax, [ebp - 0x22e]
push ebx
push eax
call fcn.004243a0
xor eax, eax
push edi
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x436]
push ebx
push eax
call fcn.004243a0
add esp, 0x18
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call dword [0x430388]
test eax, eax
jge 0x417266
xor eax, eax
pop edi
pop ebx
leave
ret
lea eax, [ebp - 8]
push eax
push 0x11
push dword [esi + 4]
call dword [0x430390]
test eax, eax
jge 0x417286
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x417262
push 0x103
push 0x39
lea eax, [ebp - 0x438]
call fcn.0040b568
push 0x104
lea eax, [ebp - 0x230]
push eax
push dword [esi + 0x60]
call dword [0x4303ec]
xor eax, eax
push 8
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x14], 0x417807
mov dword [ebp - 0x18], 0x8047
call dword [0x43037c]
mov edi, eax
cmp edi, ebx
je 0x41731b
lea eax, [ebp - 0x230]
push eax
push edi
call dword [0x43038c]
lea eax, [ebp - 0x230]
push eax
push dword [esi + 0x60]
call dword [0x430424]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
xor ebx, ebx
inc ebx
jmp 0x417279
Function at 0x41744e
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov esi, 0x206
lea edi, [ebp - 4]
push esi
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
call fcn.004243a0
xor eax, eax
push esi
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push ebx
push eax
call fcn.004243a0
xor eax, eax
push 0x81e
mov word [ebp - 0xc48], ax
lea eax, [ebp - 0xc46]
push ebx
push eax
call fcn.004243a0
push dword [ebp + 0xc]
lea eax, [ebp - 0x220]
push 0x103
push eax
call fcn.0040ab8d
lea eax, [ebp - 0x220]
push eax
mov eax, 0x4378b8
call fcn.00401515
add esp, 0x34
cmp eax, 1
jne 0x4175a8
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.l_mt5clwtst__GetDiskFreeSpaceExW]
test eax, eax
jne 0x41755d
push 0x104
push 0x23
lea eax, [ebp - 0x428]
call fcn.0040b568
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x40f
lea esi, [ebp - 0xc48]
call fcn.0041641f
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x54]
add ecx, 0xe
push 0x30
push ecx
lea ecx, [ebp - 0xc48]
jmp 0x4175cc
cmp dword [ebp - 4], ebx
ja 0x4175a4
jb 0x41756d
cmp dword [ebp - 8], 0x3200000
jae 0x4175a4
push 0x104
push 0xe
lea eax, [ebp - 0x428]
call fcn.0040b568
push 0x32
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
push 0x40f
lea esi, [ebp - 0xc48]
call fcn.0041641f
add esp, 0x10
jmp 0x417549
mov al, 1
jmp 0x4175d8
push 0x104
push 0x1e
lea eax, [ebp - 0x428]
call fcn.0040b568
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x54]
add ecx, 0xe
push 0x30
push ecx
lea ecx, [ebp - 0x428]
push ecx
push dword [eax + 4]
call dword [0x4304c4]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4175df
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x908
push ebx
push esi
lea eax, [esp + 0x10]
call fcn.0040bb6b
lea eax, [esp + 0x2c]
call fcn.0040bb6b
lea eax, [esp + 0x48]
call fcn.0040648e
lea eax, [esp + 0x260]
call fcn.0040648e
push str.metatester.exe
push edi
mov esi, str._s_s
push esi
lea eax, [esp + 0x54]
mov byte [esp + 0x17], 1
call fcn.004017f8
add esp, 0xc
push dword [esp + 0x4c]
lea eax, [esp + 0x30]
push eax
call fcn.0040baf6
push str.metatester64.exe
push edi
push esi
lea eax, [esp + 0x54]
call fcn.004017f8
add esp, 0xc
push dword [esp + 0x4c]
lea eax, [esp + 0x30]
push eax
call fcn.0040baf6
push edi
push str._s.exe
lea eax, [esp + 0x268]
call fcn.004017f8
pop ecx
pop ecx
lea eax, [esp + 0x478]
push eax
push dword [esp + 0x268]
call dword [sym.imp.l_mt5clwtst__FindFirstFileW]
xor ebx, ebx
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x41771a
mov ecx, 0x435df0
lea eax, [esp + 0x4a4]
call fcn.00401541
test eax, eax
je 0x4176f4
mov ecx, 0x435df4
lea eax, [esp + 0x4a4]
call fcn.00401541
test eax, eax
je 0x4176f4
test byte [esp + 0x478], 0x10
jne 0x4176f4
lea eax, [esp + 0x4a4]
push eax
push edi
push esi
lea eax, [esp + 0x54]
call fcn.004017f8
add esp, 0xc
push dword [esp + 0x4c]
lea eax, [esp + 0x14]
push eax
call fcn.0040baf6
test al, al
je 0x41770c
lea eax, [esp + 0x478]
push eax
push dword [esp + 0x10]
call dword [sym.imp.l_mt5clwtst__FindNextFileW]
test eax, eax
jne 0x417698
jmp 0x417710
mov byte [esp + 0xb], bl
push dword [esp + 0xc]
call dword [sym.imp.l_mt5clwtst__FindClose]
cmp dword [esp + 0x18], ebx
je 0x4177b6
lea eax, [esp + 0x10]
push eax
push ebx
lea edx, [esp + 0x34]
lea eax, [esp + 0x6d0]
call fcn.0041e0a9
call dword [0x4303e0]
push eax
lea ecx, [esp + 0x6cc]
call fcn.0041e174
cmp eax, 1
je 0x4177aa
push dword [esp + 0x26c]
mov eax, dword [esp + 0x268]
push 0x4b
call fcn.0040b568
lea esi, [esp + 0x260]
call fcn.00406474
lea eax, [esp + 0x6fc]
push eax
push dword [esp + 0x268]
lea eax, [esp + 0x50]
call fcn.004017f8
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [eax + 0x54]
push 0x40
add ecx, 0xe
push ecx
push dword [esp + 0x54]
push dword [eax + 4]
call dword [0x4304c4]
mov byte [esp + 0xb], bl
lea eax, [esp + 0x6c8]
call fcn.0041e109
mov eax, 0x438858
mov esi, 0x435b6c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], ebx
mov dword [esp + 0x268], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x2c], esi
call fcn.0040b047
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
call fcn.0040b047
mov al, byte [esp + 0xb]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4178ab
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push 3
add eax, 4
call fcn.004163eb
xor eax, eax
ret
push 4
pop eax
ret
push esi
mov esi, eax
mov eax, dword [edi + 4]
cmp dword [esi], eax
je 0x4178c8
push eax
call dword [0x430478]
cmp dword [esi], eax
je 0x4178c8
and dword [ebx], 0
xor eax, eax
inc eax
pop esi
ret
mov esi, dword [esi + 8]
lea ecx, [esi + 0xd5]
xor eax, eax
cmp ecx, 0xd
ja case.0x4178d8.211
jmp dword [ecx*4 + 0x417903]
mov eax, edi
pop esi
jmp 0x416f7b
push edi
call fcn.004171a4
pop esi
ret
mov eax, edi
pop esi
jmp fcn.00416f88
pop esi
jmp 0x4171a0
mov dword [ebx], eax
pop esi
ret

Function at 0x417cbd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.004243a0
add esp, 0xc
call fcn.00417a8f
push 6
push dword [esi + 4]
call fcn.0040b516
push 0x102
push dword [esi + 4]
call dword [0x430440]
push 1
push dword [esi + 0x58]
push 0x30
push eax
call dword [0x430444]
lea edi, [esi + 0x5c]
call fcn.00416408
mov ebx, dword [0x430420]
push 0
push dword [esi + 0x60]
call ebx
push 0x104
push 0x10
lea eax, [ebp - 0x208]
call fcn.0040b568
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0xbc]
call dword [0x430424]
lea edi, [esi + 0xdc]
call fcn.00416408
push 0
push dword [esi + 0xe0]
call ebx
push 0x104
push 0x12
lea eax, [ebp - 0x208]
call fcn.0040b568
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x13c]
call dword [0x430424]
lea edi, [esi + 0x15c]
call fcn.00416408
push 0
push dword [esi + 0x160]
call ebx
push 0x104
push 0x11
lea eax, [ebp - 0x208]
call fcn.0040b568
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x1bc]
call dword [0x430424]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x417f0c
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, eax
push 5
push dword [esi + 4]
call dword [0x430420]
cmp dword [esp + 0xc], 0
jne 0x417f35
push 7
mov eax, 0xc8
xor edi, edi
call fcn.00409b2d
call fcn.00409b51
cmp dword [esp + 0xc], 1
jne 0x417f4c
call fcn.00409bcb
push 8
pop edi
push edi
xor eax, eax
call fcn.00409b2d
pop edi
pop esi
ret 4