joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aebf
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x43b025
lea eax, [ebp - 4]
push eax
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x43b025
cmp dword [ebp - 4], ebx
je 0x43b025
push 0x208
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x43b017
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
mov esi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0041144b
add esp, 0x14
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 0xc]
push eax
push 0x44d6f0
push 1
push ebx
push 0x44d720
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43b016
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43b016
lea edx, [ebp - 8]
mov dword [ebp - 8], ebx
mov eax, dword [ecx]
push edx
push 0x44d730
push ecx
call dword [eax]
test eax, eax
js 0x43aff6
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x43aff6
mov eax, dword [ecx]
lea edx, [ebp - 0x418]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x43afed
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x620]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test eax, eax
js 0x43afed
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x620]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43afe3
test dx, dx
je 0x43afe8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43afe3
add eax, 4
add ecx, 4
test dx, dx
jne 0x43afbf
jmp 0x43afe8
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x43b016
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop esi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x43b027
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b02e
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.004183a0
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x43b12a
cmp dword [esp + 0x220], 0
je 0x43b12a
cmp dword [esp + 0x228], 0
je 0x43b12a
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x43b12a
mov esi, dword [esp + 0x230]
test esi, esi
je 0x43b12a
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x43b12a
cmp dword [esp + 8], 0
je 0x43b12a
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x43b124
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.0041144b
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.0043ad7c
jmp 0x43b12c
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x43b1c9
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x210]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004183a0
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x43b2c8
cmp dword [ebp + 0x10], ebx
je 0x43b2c8
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x43b2c8
cmp dword [ebp - 4], ebx
je 0x43b2c8
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x43b2ba
push 0x45dc94
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.004113af
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.004113af
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43b2a3
lea eax, [ebp - 0x210]
push eax
push 0x104
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x428]
call fcn.0041137a
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x428], 0x45dae4
call fcn.0040a51f
mov bl, al
jmp 0x43b2a5
mov bl, 1
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp + 0x14]
lea edx, [eax + eax]
call fcn.00411426
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x43b2ca
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43b30e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push ebx
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.004183a0
add esp, 0xc
cmp dword [ebp + 0xc], edi
je 0x43b3a2
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x43b33c
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jb 0x43b3a2
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43b3a2
push 0x45dc94
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.004113af
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.004113af
push 1
push 1
push 0x4607f8
lea eax, [ebp - 0x208]
mov ecx, 0x4ab428
push eax
call fcn.0043a9de
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43b3eb
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov edx, 0x208
push ebx
push SysReAllocString
push dword [ebp + 8]
mov ebx, ecx
push ecx
lea ecx, [ebp - 0x410]
call fcn.0043a927
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x43b42f
cmp word [eax], 0x5c
je 0x43b43b
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x43b426
jmp 0x43b473
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43b473
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x43b473
lea eax, [ebp - 0x410]
mov ecx, ebx
push eax
call fcn.0043b3eb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
pop ebx
cmp eax, 0xffffffff
jne 0x43b48f
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x43b492
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 4
Function at 0x43fd49
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.004183a0
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x468]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00409bff
mov ecx, dword [esi + 0x54]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x468]
push str.__s_s___install
push eax
call fcn.0040c813
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push dword [ebp - 0x464]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x43fdd1
push ecx
push str.InstallFailStartProgram
call fcn.00411f77
jmp 0x43fdfb
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x43fdef
push 0xea60
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
je 0x43fdf9
push dword [ebp - 0xc]
call esi
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440078
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x218]
call fcn.0040b6e3
lea ecx, [ebp - 0x430]
call fcn.0040b6e3
push dword [ebp - 0x20c]
xor ebx, ebx
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
call fcn.00401be0
mov eax, dword [esi + 0x54]
add eax, 0x29c
push eax
lea eax, [ebp - 0x430]
push str._suninstall.exe
push eax
call fcn.0040c813
add esp, 0xc
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x4400ff
lea eax, [ebp - 0x430]
mov ecx, esi
push eax
mov bl, 1
call fcn.0043fe04
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x440107
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x430]
push edi
call fcn.0040b6e3
lea ecx, [ebp - 0x648]
call fcn.0040b6e3
lea ecx, [ebp - 0x218]
call fcn.0040b6e3
mov eax, dword [esi + 0x54]
xor bl, bl
cmp dword [eax + 8], 9
je 0x44014d
cmp dword [eax + 8], 0xb
je 0x44014d
cmp dword [eax + 8], 3
jne 0x44018e
add eax, 0x29c
push eax
lea eax, [ebp - 0x218]
push str._s_terminal.ico
push eax
call fcn.0040c813
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44018e
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x44018e
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x54]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push 0x45c788
push eax
call fcn.0040c813
mov ecx, dword [esi + 0x54]
lea edi, [esi + 0x888]
add esp, 0x10
lea eax, [ecx + 0x94]
push dword [ebp - 0x214]
push dword [ebp - 0x424]
push dword [ebp - 0x42c]
push eax
push dword [ebp - 0x644]
lea eax, [ecx + 0x29c]
push eax
call fcn.0043b163
test eax, eax
je 0x440205
lea ecx, [ebp - 0x430]
call fcn.00401be0
push dword [ebp - 0x42c]
mov ecx, edi
call fcn.004123f1
mov bl, al
mov ecx, dword [esi + 0x54]
cmp dword [ecx + 8], 9
je 0x440218
cmp dword [ecx + 8], 3
jne 0x4402c6
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x440231
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 0x54]
cmp dword [ecx + 4], 2
mov edx, 0x45ad90
mov eax, 0x4615a4
cmovne eax, edx
push eax
lea eax, [ecx + 0x29c]
push eax
lea eax, [ebp - 0x648]
push str._smetaeditor_s.exe
push eax
call fcn.0040c813
add esp, 0x10
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4402c6
push dword [ebp - 0x214]
mov edx, dword [esi + 0x54]
mov ecx, str.MetaEditor_5
push dword [ebp - 0x424]
mov eax, str.MetaEditor_4
push dword [ebp - 0x42c]
cmp dword [edx + 8], 9
cmovne eax, ecx
push eax
push dword [ebp - 0x644]
lea eax, [edx + 0x29c]
push eax
call fcn.0043b163
test eax, eax
je 0x4402c6
lea ecx, [ebp - 0x430]
call fcn.00401be0
push dword [ebp - 0x42c]
mov ecx, edi
call fcn.004123f1
mov bl, al
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4403e4
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10a0
call fcn.004309c0
cmp word [0x4a030a], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x44043b
push ecx
push 0x4a030a
push ecx
mov edx, 0x7ff
lea ecx, [ebp - 0x109c]
call fcn.004363cf
mov ecx, dword [ebp + 8]
push str..exe
call fcn.00411d77
test eax, eax
jle 0x44043b
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0044b157
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4404ce
lea ecx, [ebp - 0x9c]
call fcn.0043a71b
push ebx
lea ecx, [ebp - 0x9c]
call fcn.0043a4cc
lea ecx, [ebp - 0x9c]
call fcn.0043a5be
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0043a89f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043a631
lea ecx, [ebp - 0x9c]
call fcn.0043a5be
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c]
push 0x10
push eax
lea eax, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00430f64
add esp, 0xc
lea ecx, [ebp - 0x9c]
mov esi, eax
call fcn.0043a6ef
test esi, esi
jne 0x4404ce
mov al, 1
jmp 0x440593
or dword [ebp - 8], 0xffffffff
mov esi, 0x40000000
push ecx
push 2
push 3
push esi
push dword [ebx + 4]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x463ee4
call fcn.004011ce
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test al, al
jne 0x44053a
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x440515
push 0x80
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push ecx
push 2
push 3
push esi
push dword [ebx + 4]
lea ecx, [ebp - 0xc]
call fcn.004011ce
test al, al
jne 0x44053a
push ecx
push str.InstallFailFileWriteOpen
call fcn.00411f77
mov esi, dword [ebp - 8]
jmp 0x44056f
push dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.0040a9bb
cmp eax, dword [ebp + 0x10]
je 0x440573
push ecx
push str.InstallFailFileWrite
call fcn.00411f77
mov esi, dword [ebp - 8]
cmp esi, 0xffffffff
je 0x440566
push esi
call edi
or esi, 0xffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor bl, bl
jmp 0x440589
mov esi, dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, 0xffffffff
je 0x440587
push esi
call edi
or esi, 0xffffffff
mov bl, 1
cmp esi, 0xffffffff
je 0x440591
push esi
call edi
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44114a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esi + 0x54]
mov edi, 0x29c
add eax, edi
push eax
call fcn.0044b75b
mov eax, dword [esi + 0x54]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44119e
mov eax, dword [esi + 0x54]
add eax, edi
je 0x441196
push eax
mov ecx, 0x4ab428
call fcn.0043b3eb
test eax, eax
jne 0x44119e
push ecx
push str.InstallFailCreateFolder
jmp 0x4411b2
push dword [esi + 0x5c]
mov ecx, esi
call fcn.00440861
test al, al
jne 0x4411d7
push ecx
push str.InstallFailExtractCore
call fcn.00411f77
push ebx
push 6
push 0x464
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004402cf
test al, al
je 0x4411b7
mov ecx, esi
call fcn.00440998
mov byte [esi + 0x22ee], al
test al, al
je 0x4411b7
mov ecx, esi
call fcn.00440950
test al, al
je 0x4411b7
mov ecx, esi
call fcn.00440107
test al, al
jne 0x441214
push ecx
push str.InstallFailCreateShortcut
call fcn.00411f77
mov ecx, esi
call fcn.00440078
test al, al
jne 0x44122a
push ecx
push str.InstallFailCreateUninstall
call fcn.00411f77
mov ecx, esi
call fcn.0043fd49
test al, al
je 0x4411b7
mov ecx, esi
call fcn.00440e9a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov bl, 1
jmp 0x4411ce
Function at 0x4414a5
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1338
call fcn.004309c0
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x22ed], 0
jne 0x441662
cmp byte [esi + 0x22ec], 0
je 0x441662
mov ecx, dword [esi + 0x54]
xor edi, edi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebp, str.open
test byte [ecx], 4
je 0x441535
lea ecx, [esp + 0x338]
call fcn.00409bff
lea ecx, [esp + 0x128]
call fcn.00401cb7
call fcn.00447938
push dword [esp + 0x12c]
lea eax, [esp + 0x33c]
push str.https:__www.mql5.com__utm_campaignWebInstallerutm_mediumspecialutm_sourceinstaller_s
push eax
call fcn.0040c813
add esp, 0xc
push 1
push edi
push edi
push dword [esp + 0x348]
push ebp
push edi
call ebx
mov ecx, dword [esi + 0x54]
lea eax, [ecx + 0x4a4]
push eax
lea eax, [ecx + 0x29c]
push eax
push str.__s_s_
push 0xffffffffffffffff
lea eax, [esp + 0xb58]
push 0x400
push eax
call fcn.00401acf
add esp, 0x18
call fcn.0040856d
cmp eax, 0x258
jl 0x441589
mov eax, dword [esi + 0x54]
push 1
add eax, 0x29c
push eax
lea eax, [esp + 0xb50]
push eax
push str.explorer.exe
push ebp
push edi
call ebx
jmp 0x4415e1
lea eax, [esp + 0xb48]
mov dword [esp + 0x20], edi
push eax
push 0x400
lea eax, [esp + 0x350]
mov dword [esp + 0x2c], edi
xorps xmm0, xmm0
lea ecx, [esp + 0x340]
push eax
movups xmmword [esp + 0x1c], xmm0
call fcn.0041137a
push ecx
push ecx
lea eax, [esp + 0x340]
mov dword [esp + 0x340], 0x45dd98
push eax
lea ecx, [esp + 0x1c]
call fcn.00411eb7
lea ecx, [esp + 0x10]
call fcn.00411f2f
mov esi, 0x100
lea eax, [esp + 0x28]
push esi
push edi
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [esp + 0x28]
mov ebx, str.SOFTWAREMetaQuotes_Software
mov ebp, SysReAllocString
mov edx, ebx
mov ecx, ebp
push esi
push esi
push eax
push str.Install.Time
call fcn.00408e7e
add esp, 0x10
test al, al
jne 0x4416a2
push edi
call fcn.004233e0
pop ecx
push edx
push eax
push str._I64d
lea eax, [esp + 0x34]
push 0x7f
push eax
call fcn.0041144b
add esp, 0x14
mov edx, ebx
mov ecx, ebp
push esi
call fcn.00406c90
pop ecx
push esi
lea eax, [esp + 0x2c]
mov edx, ebx
push eax
push 1
push str.Install.Time
mov ecx, ebp
call fcn.00406cf0
add esp, 0x10
jmp 0x4416a2
cmp byte [esi + 0x22ee], 0
je 0x441679
mov eax, dword [esi + 0x54]
add eax, 0x6ac
push eax
call fcn.0043b3aa
xor edi, edi
cmp dword [esi + 0x890], edi
jbe 0x4416a2
mov eax, dword [esi + 0x898]
imul eax, edi
add eax, dword [esi + 0x88c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x890]
jb 0x441683
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4418ef
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0x3023
push esi
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3024
push esi
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp + 0x20c0], 1
mov dword [ebp + 0x20bc], ebx
cmp dword [ebp + 0x20b8], ebx
jne 0x441957
push ebx
push 0x64
push 0x5ba0
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp + 0x20b8], eax
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x44195d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x10], ebx
cmp eax, dword [ebx + 0x20b8]
jne 0x441b1b
cmp byte [ebx + 0x20c4], 0
jne 0x4419a5
lea eax, [ebx + 0x20c8]
push eax
mov eax, dword [ebx + 0x54]
add eax, 0x14
push eax
call fcn.00412353
test al, al
je 0x4419a5
mov byte [ebx + 0x20c4], 1
mov eax, dword [ebx + 0x20c0]
sub eax, 1
je 0x441a76
sub eax, 1
je 0x441a7d
sub eax, 1
je 0x441a3b
sub eax, 1
jne 0x441b1b
mov eax, dword [0x4ab690]
or eax, dword [0x4ab694]
push 0
pop esi
jne 0x4419ed
push esi
call fcn.004233e0
pop ecx
mov dword [0x4ab690], eax
mov dword [0x4ab694], edx
push esi
call fcn.004233e0
sub eax, dword [0x4ab690]
pop ecx
sbb edx, dword [0x4ab694]
mov dword [esp + 0x14], edx
js 0x441b1b
jg 0x441a15
cmp eax, 0xe
jbe 0x441b1b
push dword [ebx + 4]
mov dword [ebx + 0x20c0], esi
call dword [sym.imp.USER32.dll_GetParent]
push esi
push 0x3025
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x441b1b
lea ecx, [ebx + 0x22f8]
call fcn.004376b1
test al, al
je 0x441b1b
xor edi, edi
push edi
push dword [ebx + 0x2360]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push edi
mov ecx, ebx
call fcn.00441b24
mov dword [ebx + 0x20c0], 4
jmp 0x441b1b
mov ecx, ebx
call fcn.0044134b
add dword [ebx + 0x20bc], 0x64
cmp dword [ebx + 0x20bc], 0xfa0
jbe 0x441b1b
cmp dword [ebx + 0x20cc], 0
jbe 0x441b1b
push 0
push dword [ebx + 0x2384]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [ebx + 0x20cc]
mov esi, dword [ebx + 0x20c8]
add ebx, 0x22f8
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push ecx
push ecx
push edi
push esi
mov ecx, ebx
call fcn.00437756
push 0xfa0
push 0xffffffffffffffff
xor edi, edi
mov ecx, ebx
push edi
call fcn.004376d6
mov ecx, ebx
call fcn.00437829
mov esi, dword [esp + 0x10]
push 1
push edi
push dword [esi + 0x2360]
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esi + 0x20c8]
call fcn.0040d5ee
cmp dword [esi + 0x2320], edi
je 0x441b1b
mov eax, dword [esi + 0x54]
add eax, 0x14
push eax
call fcn.004122a4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441b24
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
push ebx
push esi
mov ebx, ecx
lea ecx, [esp + 0x1c]
push edi
call fcn.00401cb7
cmp byte [ebp + 8], 0
lea edi, [ebx + 0x22f8]
lea esi, [ebx + 0x2384]
je 0x441b85
mov eax, ecx
push eax
push 0x190
call fcn.0043914a
push dword [esp + 0x24]
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push ecx
push ecx
push 0x83
mov ecx, edi
call fcn.0043771c
jmp 0x441c37
mov ecx, edi
call fcn.0043780e
push 0x2710
push 0
push 0
mov ecx, edi
call fcn.004376d6
movzx edi, byte [ebp + 0xc]
lea eax, [esp + 0x20]
xor edi, 1
push eax
lea eax, [edi + 0x191]
push eax
call fcn.0043914a
push dword [esp + 0x24]
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
lea ecx, [ebx + 4]
call fcn.00404679
mov eax, dword [esp + 0x14]
sub dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
and dword [esp + 0x14], 0
push ecx
push eax
lea ecx, [ebx + 0x2384]
call fcn.0040469f
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push ecx
push ecx
lea eax, [edi + 0x84]
push eax
lea ecx, [ebx + 0x22f8]
call fcn.0043771c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x105
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea esi, [ebx + 0x2384]
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x442126
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
movzx eax, word [esp + 8]
push ebp
push esi
push edi
push 0x4621a4
push eax
push dword [0x47dbc8]
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x4421f5
push esi
push dword [0x47dbc4]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
cmp edi, 0x32
jbe 0x4421f5
push esi
push dword [0x47dbc4]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x4421f5
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
test ebp, ebp
je 0x4421f5
push ebx
push 0x44d836
mov eax, edi
xor ecx, ecx
shr eax, 1
mov dword [esp + 0x1c], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004166c6
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4421b6
xor bl, bl
jmp 0x4421e9
lea eax, [edi - 2]
push eax
lea eax, [ebp + 2]
push eax
push ebx
call fcn.004309f0
mov eax, dword [esp + 0x24]
add esp, 0xc
xor ecx, ecx
mov word [ebx + eax*2 - 4], cx
mov eax, dword [esp + 0x10]
push ebx
push dword [eax + 0x60]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call fcn.004166cf
pop ecx
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, bl
pop ebx
jmp 0x4421f7
xor al, al
pop edi
pop esi
pop ebp
pop ecx
ret 4