joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c1e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0xffffffffffffffff
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
je 0x14000c274
test rdx, rdx
je 0x14000c274
cmp r8d, 1
jb 0x14000c274
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov ebx, r14d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp + 8]
lea r9, [rsp + 0x50]
mov r8d, edi
mov edx, ebx
sub r8d, ebx
mov dword [rsp + 0x50], r14d
add rdx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c256
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14000c256
add ebx, eax
cmp ebx, edi
jb 0x14000c220
mov eax, ebx
lock add qword [0x1401f4d70], rax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000c280
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp rcx, 0xffffffffffffffff
je 0x14000c2be
test rdx, rdx
je 0x14000c2be
test r8d, r8d
je 0x14000c2be
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000c2ba
mov dword [rsp + 0x40], ebx
jmp 0x14000c2be
mov ebx, dword [rsp + 0x40]
mov eax, ebx
lock add qword [0x1401f4d68], rax
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x14000c2e0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x14000c314
cmp word [rcx], 0
je 0x14000c314
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000c324
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000c345
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test bl, 0x10
jne 0x14000c355
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000c314
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000c314
mov eax, reloc.WS2_32.dll_recv
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test bl, 1
je 0x14000c368
xor ebx, 1
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c410
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov rbx, rcx
test rcx, rcx
je 0x14000c4bf
cmp word [rcx], 0
je 0x14000c4bf
call fcn.14000cff0
test al, al
je 0x14000c4bf
lea rax, [0x1401c1110]
mov edx, 0x103
mov qword [rsp + 0x28], rax
lea r9, str._scheckwritepermissions._s
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x40]
call fcn.140003dd0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x40]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000c4bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
add rsp, 0x250
pop rbx
ret
xor al, al
add rsp, 0x250
pop rbx
ret

Function at 0x14000c6b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rsi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov rax, rdx
mov qword [rcx + 8], r15
mov r14, rcx
test rdx, rdx
je 0x14000c805
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 3]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c805
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdi
mov rcx, rax
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, r15d
mov rcx, r14
test eax, eax
cmovne rdi, qword [rsp + 0x70]
lea rdx, [rdi + 2]
call fcn.140003ae0
test al, al
je 0x14000c7eb
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x48], rbp
mov rbp, qword [r14]
test rbp, rbp
je 0x14000c7b6
cmp rdi, 1
jb 0x14000c7b6
mov ebx, r15d
nop dword [rax]
mov r8d, 0xfffffff
mov dword [rsp + 0x80], r15d
mov rax, rdi
mov qword [rsp + 0x20], r15
sub rax, rbx
lea rdx, [rbx + rbp]
cmp rax, r8
lea r9, [rsp + 0x80]
mov rcx, rsi
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c7ac
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14000c7ac
add rbx, rax
cmp rbx, rdi
jb 0x14000c760
lock add qword [0x1401f4d70], rbx
jmp 0x14000c7b9
mov rbx, r15
mov rbp, qword [rsp + 0x48]
cmp rbx, rdi
mov rbx, qword [rsp + 0x78]
jne 0x14000c7eb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
mov qword [r14 + 8], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rsi
jmp fcn.140003a90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x40]
xor al, al
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
xor al, al
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
Function at 0x14000e4e0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4c0
xor ebp, ebp
mov eax, dword [0x1401f2c90]
cmp eax, 0xffffffff
jne 0x14000e53e
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 0x20
mov word [rsp + 0x38], bp
lea rax, [0x1401ba9d0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.14000b150
movzx eax, al
mov dword [0x1401f2c90], eax
test eax, eax
jne 0x14000e5f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000e5f0
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x84]
call fcn.14014e180
mov dword [rsp + 0x80], 0x438
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000e5e7
lea rsi, str.frida_agent_64.dll
nop dword [rax]
nop word [rax + rax]
mov rbx, rbp
mov rdx, qword [rbx + rsi]
lea rcx, [rsp + 0xb0]
call fcn.14003e940
test eax, eax
je 0x14000e60b
add rbx, 8
cmp rbx, 0x18
jb 0x14000e5b3
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14000e5b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000e5f2
Function at 0x140011720
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x420
mov rbx, rcx
test rcx, rcx
je 0x140011874
call fcn.14000c2e0
cmp eax, 0xffffffff
jne 0x140011853
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x200
call fcn.14003c5c8
movzx ecx, word [rsp + 0x20]
lea rdi, [rsp + 0x20]
test cx, cx
je 0x140011874
movzx eax, cx
xor esi, esi
cmp ax, 0x5c
jne 0x140011806
mov word [rdi], si
cmp word [rsp + 0x20], si
je 0x140011874
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400117b9
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x1400117fa
test bl, 0x10
jne 0x1400117e2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140011874
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x1400117fa
test bl, 1
je 0x1400117fc
xor ebx, 1
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp ebx, 0xffffffff
je 0x140011874
mov word [rdi], 0x5c
movzx ecx, word [rsp + 0x20]
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140011782
test cx, cx
je 0x140011874
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140011842
test bl, 0x10
jne 0x140011857
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140011874
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140011874
mov al, 1
jmp 0x140011876
test bl, 1
je 0x14001186c
xor ebx, 1
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp ebx, 0xffffffff
setne al
jmp 0x140011876
xor al, al
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140014990
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x50], r15
mov edi, dword [rcx + 8]
or edi, 0x2001f
mov qword [rbp + 0x1a0], r15
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x140014a1f
mov ebx, r15d
test rcx, rcx
je 0x140014a09
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rbp + 0x1a0]
mov qword [rsp + 0x40], rcx
and edi, 0x300
mov dword [rsp + 0x48], edi
test ebx, ebx
jne 0x140014af3
mov dword [rbp + 0x190], 0x100
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x190]
lea r8, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140014ac7
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140014990
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x140014af3
mov dword [rbp + 0x190], 0x100
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x190]
lea r8, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140014a70
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140014adc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov rdx, r14
mov rcx, rsi
call fcn.140014bc0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140014afe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400160d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov rsi, r9
mov r15, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x50], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x140016150
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x140016150
call fcn.140013cd0
mov ebx, eax
jmp 0x14001627e
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140016171
call fcn.140013cd0
jmp 0x14001626d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140016194
call fcn.140013cd0
jmp 0x14001626d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x480], eax
inc eax
cmp eax, ebx
jae 0x1400161b9
mov ebx, 0x8007000e
jmp 0x14001626f
mov ecx, eax
test eax, eax
je 0x1400161ee
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400162b0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1400161ee
lea rcx, [rsp + 0x50]
call fcn.140013ca0
jmp 0x1400161f8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x140016211
cmp qword [rsp + 0x50], 0
jne 0x140016220
mov ebx, 0x8007000e
jmp 0x14001626f
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14001624a
call fcn.140013cd0
jmp 0x14001626d
mov ecx, eax
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.140015c20
mov ebx, eax
test rdi, rdi
je 0x14001627e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x140016295
lea rcx, [rsp + 0x50]
call fcn.140013c80
nop
mov eax, ebx
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80070216
call fcn.1400148b0
int3
Function at 0x1400175c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ecx, dword [rcx + 0x90]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x140017635
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
mov dword [rsp + 0x40], 0xfffffffe
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, qword [rdi + 8]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movsxd r8, eax
lea r9, [rsp + 0x30]
mov edx, 0x4e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
shr ecx, 2
test cl, 1
je 0x140017679
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rdi, qword [rdi + 8]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx r8d, ax
mov r9, rdi
mov edx, VarUI4FromDisp
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rdi + 0x50]
lea rdx, str.open
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta bl
jbe 0x1400176c0
or byte [rdi + 0x94], 2
xor edx, edx
mov rcx, qword [rdi + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14001c7e0
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
test rdx, rdx
je 0x14001ca42
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
je 0x14001ca26
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
xor r15d, r15d
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x74], 0x104
mov word [rsp + 0x78], r15w
lea rbx, [0x1401b7690]
mov qword [rsp + 0x60], rbx
mov r9, r8
mov r8, rcx
lea rdx, str._sFonts_s
lea rcx, [rsp + 0x60]
call fcn.1400038c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001ca26
movzx eax, byte [rsi + 0x3df0]
test al, al
jne 0x14001ca26
lea rax, [rbp + 0x198]
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x190], r15d
mov dword [rbp + 0x194], 0x104
mov word [rbp + 0x198], r15w
mov qword [rbp + 0x180], rbx
mov r8, rdi
lea rdx, str.https:__download.mql5.com_cdn_web_components__s
lea rcx, [rbp + 0x180]
call fcn.1400038c0
mov rax, qword [rsi + 0x218]
lea rcx, [rsi + 0x218]
call qword [rax + 0x68]
mov rax, qword [rsi + 0x218]
mov rdx, qword [rbp + 0x188]
lea rcx, [rsi + 0x218]
call qword [rax + 0x78]
cmp eax, 0xc8
jne 0x14001ca26
mov ebx, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0x20000
mov qword [rsp + 0x50], r15
lea rdx, [rsi + 0x3dc0]
lea rax, [rsp + 0x30]
cmp rdx, rax
je 0x14001ca18
mov rbx, qword [rdx]
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], r15
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
cmp rcx, 0x4e20
jbe 0x14001ca18
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140004520
test al, al
je 0x14001ca18
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], 0
jne 0x14001c980
lea esi, [rax*2 + 2]
test esi, esi
je 0x14001c9f7
mov qword [rbp + 0x3c8], r15
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c9f7
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 1]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x20], rdi
lea r9, str.value_sunitfile
lea r8, str.Install_Component
xor edx, edx
lea rcx, [0x140215a10]
call fcn.140059ad0
test rbx, rbx
je 0x14001ca26
mov rcx, rbx
call fcn.14002ec58
nop
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001ca50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test r8, r8
je 0x14001cc1d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov r14, rdx
mov rsi, rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
xor edi, edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], 0x104
mov word [rsp + 0x78], di
lea rbx, [0x1401b7690]
mov qword [rsp + 0x60], rbx
mov r9, r8
mov r8, rcx
lea rdx, [0x1401c0df0]
lea rcx, [rsp + 0x60]
call fcn.1400038c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001cc01
movzx eax, byte [rsi + 0x3df0]
test al, al
jne 0x14001cc01
lea rax, [rbp + 0x198]
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x190], edi
mov dword [rbp + 0x194], 0x104
mov word [rbp + 0x198], di
mov qword [rbp + 0x180], rbx
mov r8, r14
lea rdx, str.https:__download.mql5.com_cdn_web_components__s
lea rcx, [rbp + 0x180]
call fcn.1400038c0
mov rax, qword [rsi + 0x218]
lea rcx, [rsi + 0x218]
call qword [rax + 0x68]
mov rax, qword [rsi + 0x218]
mov rdx, qword [rbp + 0x188]
lea rcx, [rsi + 0x218]
call qword [rax + 0x78]
cmp eax, 0xc8
jne 0x14001cc01
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0x20000
mov qword [rsp + 0x50], rdi
lea rcx, [rsi + 0x3dc0]
mov edx, edi
mov ebx, edi
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x14001cbb6
mov rbx, qword [rcx]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov rdi, rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
cmp rdx, 0x186a0
jbe 0x14001cbf3
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140004520
test al, al
je 0x14001cbf3
mov qword [rsp + 0x20], r14
lea r9, str.value_sunitfile
lea r8, str.Install_Component
xor edx, edx
lea rcx, [0x140215a10]
call fcn.140059ad0
test rbx, rbx
je 0x14001cc01
mov rcx, rdi
call fcn.14002ec58
nop
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001e990
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov r15d, r9d
mov rdi, r8
mov r13, rdx
mov rsi, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], 0x200
mov word [rsp + 0x38], r12w
lea rax, [0x1401b8178]
mov qword [rsp + 0x20], rax
mov bl, 1
cmp r9d, 0x80
ja 0x14001ebb8
mov eax, dword [rcx + 0x10]
cmp eax, 1
jb 0x14001ebb8
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14001ebb8
cmp word [rcx], r12w
je 0x14001ebb8
cmp eax, 3
jbe 0x14001ebb8
mov r9, qword [rdx + 8]
mov r8, rcx
lea rdx, [0x1401c0df0]
lea rcx, [rsp + 0x20]
call fcn.1400038c0
lea rdx, [rbp + 0x340]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14001ebb3
test byte [rbp + 0x340], 0x10
je 0x14001eb2c
movzx edx, word [rbp + 0x36c]
movzx ecx, word [rbp + 0x36e]
cmp dx, 0x2e
jne 0x14001eaa3
test cx, cx
je 0x14001eb91
cmp dx, dx
jne 0x14001eaa3
cmp cx, dx
jne 0x14001eaa3
cmp word [rbp + 0x370], 0
je 0x14001eb91
lea r9, [rbp + 0x36c]
mov r8, qword [rsi + 8]
lea rdx, [0x1401c0df0]
lea rcx, [rsp + 0x20]
call fcn.1400038c0
mov dword [rbp + 0x5d8], r12d
lea r9d, [r15 + 1]
lea r8, [rbp + 0x5d8]
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.14001e990
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14001eaf4
inc dword [rdi]
jmp 0x14001eb91
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14001eb8f
lea edx, [rax + 0x7b]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, r12d
test eax, eax
movzx ecx, bl
cmovne edx, ecx
movzx ebx, dl
jmp 0x14001eb91
lea r9, [rbp + 0x36c]
mov r8, qword [rsi + 8]
lea rdx, [0x1401c0df0]
lea rcx, [rsp + 0x20]
call fcn.1400038c0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001eb5b
inc dword [rdi]
jmp 0x14001eb91
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14001eb8f
lea edx, [rax + 0x7b]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, r12d
test eax, eax
movzx ecx, bl
cmovne edx, ecx
movzx ebx, dl
jmp 0x14001eb91
xor bl, bl
lea rdx, [rbp + 0x340]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001ea61
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
movzx eax, bl
jmp 0x14001ebba
xor al, al
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001f910
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
xor eax, eax
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x14001f935
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rax, qword [rsp + 0x30]
shr rax, 0x14
add rsp, 0x28
ret
Function at 0x140024ed0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov dil, 1
cmp rax, 0xffffffffffffffff
je 0x140024f56
mov rcx, qword [rcx + 0x30]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140024f28
mov rcx, rbx
xor dil, dil
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 0x30]
cmp rax, 0xffffffffffffffff
je 0x140024f1f
mov rcx, qword [rbx + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x140024f4d
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
movzx eax, dil
add rsp, 0x20
pop rdi
ret