joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4422d8
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push dword [edi + 0x8c]
mov esi, eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [edi + 0x8c]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 0x3023
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call edi
pop edi
xor eax, eax
pop esi
ret

Function at 0x44231b
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0x3023
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [ebx + 0x8c]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [ebx + 0x8c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 2
push 0
push 0x470
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop ebx
ret
Function at 0x44270c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x220]
mov edi, 0x208
mov dword [ebp - 0x18], ebx
push edi
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.004183a0
push edi
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.004183a0
push 0x820
lea eax, [ebp - 0xc48]
push ebx
push eax
call fcn.004183a0
add esp, 0x24
cmp dword [ebp + 8], ebx
je 0x442782
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x220]
push 0x103
push eax
call fcn.00423035
add esp, 0x10
lea eax, [ebp - 0x220]
push 0x4621bc
push eax
call fcn.0041779d
pop ecx
pop ecx
test eax, eax
je 0x4427a5
lea ecx, [ebp - 0x220]
sub eax, ecx
sar eax, 1
jmp 0x4427a8
or eax, 0xffffffff
cmp eax, 1
jne 0x44286e
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
jne 0x442820
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0x23
pop ecx
call fcn.00439684
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xc48]
push 0x40f
push eax
call fcn.00412d1f
add esp, 0x10
mov eax, dword [esi + 0x54]
add eax, 0x94
push 0x30
push eax
lea eax, [ebp - 0xc48]
jmp 0x442893
cmp dword [ebp - 4], ebx
ja 0x44286a
jb 0x442830
cmp dword [ebp - 8], 0x3200000
jae 0x44286a
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0xe
pop ecx
call fcn.00439684
push 0x32
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xc48]
push 0x40f
push eax
call fcn.00412d1f
add esp, 0x14
jmp 0x44280d
mov al, 1
jmp 0x44289f
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0x1e
pop ecx
call fcn.00439684
mov eax, dword [esi + 0x54]
add eax, 0x94
push 0x30
push eax
lea eax, [ebp - 0x428]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4429b7
Capabilities:
Get common file path
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
push 8
mov ebx, ecx
lea edi, [ebp - 0x24]
pop ecx
xor eax, eax
mov esi, 0x208
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [ebp - 0x230]
push esi
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004183a0
push esi
lea eax, [ebp - 0x438]
push edi
push eax
call fcn.004183a0
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x11
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x442aae
cmp dword [ebp - 4], edi
je 0x442aae
push 0x103
lea eax, [ebp - 0x438]
push eax
push 0x39
pop ecx
call fcn.00439684
push 0x104
lea eax, [ebp - 0x230]
push eax
push dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x438]
mov dword [ebp - 0x10], 0x44269f
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0x8047
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, eax
test esi, esi
je 0x442aa4
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x230]
push eax
push dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call edi
push dword [ebp - 4]
call edi
xor eax, eax
inc eax
jmp 0x442ab0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x442ab9
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xe38
lea eax, [esp]
push ebp
push esi
push edi
mov edi, 0x208
xor ebp, ebp
push edi
push ebp
push eax
mov esi, ecx
call fcn.004183a0
push edi
lea eax, [esp + 0x224]
push ebp
push eax
call fcn.004183a0
push 0x820
lea eax, [esp + 0x640]
push ebp
push eax
call fcn.004183a0
add esp, 0x24
lea eax, [esp + 0x624]
push 0x410
push eax
push dword [esi + 0x2a8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
lea eax, [esp + 0x420]
push ebp
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [esp + 0x41c]
mov ecx, esi
push eax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x62c]
push eax
call fcn.004428a8
mov ecx, dword [esi + 0x2a8]
test al, al
jne 0x442b5d
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
xor al, al
jmp 0x442c4a
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x214]
push eax
push ecx
call edi
mov eax, dword [esi + 0x54]
add eax, 0x6ac
je 0x442b90
push 0xffffffffffffffff
lea ecx, [esp + 0x218]
push ecx
push 0x104
push eax
call fcn.00423035
add esp, 0x10
push 0x410
lea eax, [esp + 0x628]
push eax
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x208
lea eax, [esp + 0x420]
push ebp
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [esp + 0x41c]
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x62c]
push eax
call fcn.004428a8
mov ecx, dword [esi + 0x60]
test al, al
je 0x442b4f
lea eax, [esp + 0xc]
push eax
push ecx
call edi
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044270c
test al, al
jne 0x442c03
push dword [esi + 0x60]
jmp 0x442b50
mov eax, dword [esi + 0x54]
add eax, 0x29c
je 0x442c22
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
push ecx
push 0x104
push eax
call fcn.00423035
add esp, 0x10
push ebp
push ebp
push 0xf0
push dword [esi + 0x4f0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esi + 0x54]
mov ecx, dword [edx]
test eax, eax
je 0x442c43
or ecx, 4
jmp 0x442c46
and ecx, 0xfffffffb
mov dword [edx], ecx
mov al, 1
pop edi
pop esi
pop ebp
add esp, 0xe38
ret

Function at 0x442cd6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, ecx
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push 0x3023
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 3
push 0
push 0x470
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebp
ret
Function at 0x442d2a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x218]
call fcn.0040b6e3
lea ecx, [ebp - 0x430]
call fcn.0040b6e3
push ecx
push ecx
mov ecx, edi
call fcn.00412b65
push 7
push dword [edi + 4]
call fcn.0043917d
push dword [ebp - 0x20c]
push dword [ebp - 0x214]
push dword [edi + 0x514]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x218]
call fcn.00401be0
mov eax, dword [edi + 0x54]
add eax, 0x94
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x430]
push eax
call fcn.0040c813
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
add esp, 0xc
push dword [ebp - 0x42c]
push dword [edi + 0x514]
call esi
mov eax, dword [edi + 0x54]
add eax, 0x29c
push eax
push dword [edi + 0x60]
call esi
mov eax, dword [edi + 0x54]
add eax, 0x6ac
push eax
push dword [edi + 0x2a8]
call esi
mov eax, dword [edi + 0x54]
push 0
mov ecx, dword [eax]
shr ecx, 2
and ecx, 1
push ecx
push 0xf1
push dword [edi + 0x4f0]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x443070
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
sub esp, 0x624
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x414]
push edi
call fcn.0040b6e3
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
mov eax, dword [esp + 0x638]
mov edi, ebp
or eax, 0x20019
mov dword [esp + 0x18], ebp
push eax
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44319d
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push ebp
jmp 0x44315c
cmp dword [esp + 0x10], ebp
jbe 0x443193
push 0x200
lea eax, [esp + 0x21c]
push ebp
push eax
call fcn.004183a0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x428]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040c813
push dword [esp + 0x64c]
mov edx, dword [esp + 0x438]
lea eax, [esp + 0x234]
push 0x1fe
push eax
push str.InstallLocation
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408e7e
add esp, 0x28
test al, al
je 0x44314c
push dword [0x47cbac]
lea eax, [esp + 0x21c]
push eax
call fcn.00425930
pop ecx
pop ecx
test eax, eax
je 0x443178
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push dword [esp + 0x30]
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4430ce
jmp 0x443193
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x414
push 0x104
push eax
call fcn.0041caeb
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x54]
pop edi
pop esi
cmp word [eax + 0x414], bp
pop ebp
setne al
add esp, 0x624
ret 4
Function at 0x443077
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
sub esp, 0x624
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x414]
push edi
call fcn.0040b6e3
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
mov eax, dword [esp + 0x638]
mov edi, ebp
or eax, 0x20019
mov dword [esp + 0x18], ebp
push eax
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44319d
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push ebp
jmp 0x44315c
cmp dword [esp + 0x10], ebp
jbe 0x443193
push 0x200
lea eax, [esp + 0x21c]
push ebp
push eax
call fcn.004183a0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x428]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040c813
push dword [esp + 0x64c]
mov edx, dword [esp + 0x438]
lea eax, [esp + 0x234]
push 0x1fe
push eax
push str.InstallLocation
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408e7e
add esp, 0x28
test al, al
je 0x44314c
push dword [0x47cbac]
lea eax, [esp + 0x21c]
push eax
call fcn.00425930
pop ecx
pop ecx
test eax, eax
je 0x443178
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push dword [esp + 0x30]
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4430ce
jmp 0x443193
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x54]
add eax, 0x414
push 0x104
push eax
call fcn.0041caeb
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x54]
pop edi
pop esi
cmp word [eax + 0x414], bp
pop ebp
setne al
add esp, 0x624
ret 4
Function at 0x4431b6
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0xc58
push ebx
push ebp
push esi
push edi
push 0x3c
xor ebx, ebx
mov dword [esp + 0x18], 0x463ee4
lea eax, [esp + 0x20]
or ebp, 0xffffffff
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x24], ebp
call fcn.004183a0
mov edi, 0x208
lea eax, [esp + 0x26c]
push edi
push ebx
push eax
call fcn.004183a0
push edi
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.004183a0
push 0x800
lea eax, [esp + 0x490]
push ebx
push eax
call fcn.004183a0
add esp, 0x30
mov dword [esp + 0x10], ebx
mov edi, 0x104
lea eax, [esp + 0x260]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
dec edi
test eax, eax
jne 0x443282
push ebp
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0x60]
push edi
push eax
call fcn.00423035
lea eax, [esp + 0x68]
push 0x5c
push eax
call fcn.00417a20
add esp, 0x18
test eax, eax
je 0x443271
lea ecx, [esp + 0x58]
sub eax, ecx
sar eax, 1
jmp 0x443273
mov eax, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x443282
xor ecx, ecx
mov word [esp + eax*2 + 0x58], cx
push str.mtuninstall.bat
lea eax, [esp + 0x5c]
push edi
push eax
call fcn.0041cb4f
mov eax, dword [esi + 0x54]
add esp, 0xc
test byte [eax + 0x83c], 1
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x264]
je 0x4432e7
push dword [0x47cbac]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
lea eax, [esp + 0x270]
push eax
push str.cd_r_n__S___processwait:_u_r_ndel__Q___S__r_nrd___S__r_ndel__Q___S__r_n
lea eax, [esp + 0x480]
push 0x7ff
push eax
call fcn.00413073
add esp, 0x20
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x443319
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
lea eax, [esp + 0x26c]
push eax
push str.cd_r_n__S___processwait:_u_r_ndel__Q___S__r_ndel__Q___S__r_n
lea eax, [esp + 0x47c]
push 0x7ff
push eax
call fcn.00413073
add esp, 0x1c
neg eax
sbb al, al
inc al
mov bl, al
test bl, bl
je 0x4433d4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x46c]
call fcn.00442faf
mov esi, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
cmovs esi, ecx
sete cl
mov bl, cl
jne 0x4433d4
push ecx
push 2
push 3
push 0x40000000
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x28]
call fcn.004011ce
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
je 0x4433c9
push esi
lea eax, [esp + 0x46c]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040a9bb
cmp eax, esi
jne 0x4433c9
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x44338d
push esi
call edi
mov esi, ebp
and dword [esp + 0x30], 0
lea eax, [esp + 0x58]
and dword [esp + 0x38], 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x2c], str.Open
mov dword [esp + 0x24], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
jmp 0x4433cd
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x4433d4
push esi
call edi
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xc58
ret
Function at 0x4433e1
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov eax, dword [esi + 0x54]
cmp word [eax + 0x414], bp
je 0x44347f
lea ecx, [esp + 0x10]
call fcn.0040b6e3
mov eax, dword [esi + 0x54]
add eax, 0x414
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040c813
add esp, 0xc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443465
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x443465
push ebp
push 0x20206
push dword [esp + 0x1c]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
push ebp
push 0x20106
push dword [esp + 0x1c]
push ebx
call edi
jmp 0x443474
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test esi, esi
je 0x44347f
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret

Function at 0x4433e9
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov eax, dword [esi + 0x54]
cmp word [eax + 0x414], bp
je 0x44347f
lea ecx, [esp + 0x10]
call fcn.0040b6e3
mov eax, dword [esi + 0x54]
add eax, 0x414
push eax
mov eax, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.0040c813
add esp, 0xc
push str.advapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443465
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x443465
push ebp
push 0x20206
push dword [esp + 0x1c]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call edi
push ebp
push 0x20106
push dword [esp + 0x1c]
push ebx
call edi
jmp 0x443474
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test esi, esi
je 0x44347f
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x4436d5
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
push esi
mov esi, ecx
lea ecx, [ebp - 0x4a0]
call fcn.0040b6e3
lea ecx, [ebp - 0x288]
call fcn.0040b6e3
lea ecx, [ebp - 0x70]
call fcn.0043a71b
push dword [ebp - 0x49c]
xor eax, eax
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x4a0]
call fcn.00401be0
push 0x47cba8
lea ecx, [ebp - 0x288]
call fcn.0040d181
mov edx, dword [ebp - 0x284]
test edx, edx
je 0x44374b
push dword [ebp - 0x27c]
push edx
call fcn.00425830
mov edx, dword [ebp - 0x284]
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
call fcn.0043a89f
mov eax, dword [ebp - 0x280]
add eax, eax
push eax
push edx
call fcn.0043a631
lea ecx, [ebp - 0x70]
call fcn.0043a5be
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x70]
push dword [ebp - 0x284]
call fcn.0043a55c
push str.MetaQuotes_
lea ecx, [ebp - 0x4a0]
call fcn.0040c7b8
mov eax, dword [esi + 0x54]
lea ecx, [ebp - 0x4a0]
add eax, 0xa50
push eax
call fcn.0040c7b8
push 0x45dc94
lea ecx, [ebp - 0x4a0]
call fcn.0040c7b8
push dword [ebp - 0x284]
lea ecx, [ebp - 0x4a0]
call fcn.0040c7b8
push dword [ebp - 0x49c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4437df
lea ecx, [ebp - 0x4a0]
call fcn.004132ae
lea ecx, [ebp - 0x70]
call fcn.0043a6ef
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4437ec
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 0
jne 0x44381a
push 0xc8
push 7
push 0
mov ecx, esi
call fcn.004376d6
mov ecx, esi
call fcn.00437829
cmp dword [esp + 0xc], 1
jne 0x443835
mov ecx, esi
call fcn.0043780e
push 0
push 8
push 8
mov ecx, esi
call fcn.004376d6
pop esi
ret 8

Function at 0x443dee
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0x3023
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 2
push 0
push 0x470
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop edi
ret
Function at 0x443e2c
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x804
push ebx
push ebp
push esi
push edi
mov esi, 0x400
lea eax, [esp + 0x414]
push esi
xor ebp, ebp
mov ebx, ecx
push ebp
push eax
call fcn.004183a0
push esi
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.004183a0
add esp, 0x18
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.0041291b
push ecx
push ecx
mov ecx, ebx
call fcn.0041339c
push 5
push dword [ebx + 4]
call fcn.0043917d
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x14]
mov edi, 0x200
push edi
push eax
push dword [ebx + 0x5c]
call esi
mov eax, dword [ebx + 0x54]
mov ebp, 0x848
add eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push edi
push eax
call fcn.00412d1f
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x424]
add esp, 0x10
push eax
push dword [ebx + 0x5c]
call edi
push 0x200
lea eax, [esp + 0x18]
push eax
push dword [ebx + 0x80]
call esi
mov eax, dword [ebx + 0x54]
add eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push 0x200
push eax
call fcn.00412d1f
add esp, 0x10
lea eax, [esp + 0x414]
push eax
push dword [ebx + 0x80]
call edi
push dword [0x47cbac]
push dword [ebx + 0xa4]
call edi
push 0
push 0
push 0xf1
push dword [ebx + 0xc8]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x804
ret 0x10
Function at 0x444da8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc24
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push edi
call fcn.00409bff
call fcn.00447938
lea edi, [esi + 0x426c]
xor ebx, ebx
cmp word [edi], bx
je 0x444e12
push str.ref
lea ecx, [esp + 0x14]
call fcn.0040c7b8
push edi
lea ecx, [esp + 0x14]
call fcn.0040c7b8
push 0x45dd4c
push 0x45dd54
lea ecx, [esp + 0x18]
call fcn.0040c872
push 0x45dd68
push 0x45dc98
lea ecx, [esp + 0x18]
call fcn.0040c872
push dword [esp + 0x14]
lea eax, [esi + 0x384c]
push eax
call fcn.00413d0c
xor edi, edi
inc edi
test al, al
jne 0x444e83
push 0x400
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x428]
call fcn.00401c3e
push dword [esp + 0x14]
mov eax, ecx
mov dword [esp + 0x424], 0x45dd98
push str.https:__www.mql5.com__lang__auth_register_nobannertrue_s
push eax
call fcn.0040c813
pop ecx
pop ecx
lea eax, [esp + 0x424]
push eax
call fcn.0043923b
push edi
push ebx
push ebx
push dword [esp + 0x430]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x14]
and dword [esi + 0x3838], 0xfffffffb
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x444eb0
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
lea eax, [ebp - 0x410]
push ebx
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.004183a0
push 0x250
lea eax, [ebp - 0x660]
push esi
push eax
call fcn.004183a0
add esp, 0x18
lea eax, [ebp - 0x410]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x444fb1
lea eax, [ebp - 0x410]
mov ebx, 0x104
push eax
push str._sMetaQuotesWebInstall.png
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041144b
add esp, 0x10
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x444fb1
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x410]
push eax
push str._sMetaQuotesWebInstall_s
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041144b
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x444f98
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x444f98
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp - 0x660]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x444f3a
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret