joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41415a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x40c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
xor ebp, ebp
push edi
push 0x60
push ebp
push dword [esp + 0x428]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call esi
mov edi, eax
push 2
pop eax
test edi, edi
jne 0x4141aa
push eax
push ebp
push dword [esp + 0x428]
call esi
mov edi, eax
test edi, edi
jne 0x4141aa
call fcn.00412cd8
mov esi, eax
jmp 0x41426f
push dword [esp + 0x428]
push dword [esp + 0x428]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4141cf
call fcn.00412cd8
jmp 0x414262
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4141c5
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x4141f5
mov esi, 0x8007000e
jmp 0x414264
push 2
pop ecx
mul ecx
cmp edx, ebp
ja 0x414291
jb 0x41420d
cmp eax, 0xffffffff
ja 0x414291
cmp eax, 0x400
jbe 0x414220
push eax
lea ecx, [esp + 0x1c]
call fcn.00412cb6
jmp 0x414228
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebp
je 0x4141ee
push esi
push dword [esp + 0x1c]
push esi
push ebx
push ebp
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4141c5
mov eax, dword [esp + 0x18]
xor edx, edx
push dword [esp + 0x42c]
mov word [eax + ecx*2], dx
lea ecx, [esp + 0x14]
push dword [esp + 0x1c]
call fcn.00414038
mov esi, eax
test edi, edi
je 0x41426f
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [esp + 0x1c]
cmp dword [esp + 0x18], eax
je 0x414282
lea ecx, [esp + 0x18]
call fcn.00412cad
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
push 0x80070216
call fcn.004135b7
int3
Function at 0x415009
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov byte [ebp - 1], 1
push esi
push edi
mov ecx, dword [ebx + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x415056
mov eax, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.USER32.dll_GetParent]
push dword [ebx + 4]
mov esi, eax
call edi
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x4e
jmp 0x41507d
shr ecx, 2
test cl, 1
je 0x415086
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [ebx + 4]
mov esi, eax
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push edi
movzx eax, ax
push eax
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4150b4
push 1
xor esi, esi
push esi
push esi
push dword [ebx + 0x28]
push 0x467f1c
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
jbe 0x4150b4
or byte [ebx + 0x58], 2
push 1
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415c9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
xor ebx, ebx
mov dword [esp + 0x10], ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, eax
movzx eax, word [esp + 0x18]
push 0x46d9b0
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x415dd3
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
cmp esi, 0x10
jbe 0x415dd2
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
test ebp, ebp
je 0x415dd2
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x415dd2
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x415dcb
push esi
push ebp
push eax
mov dword [esp + 0x28], ebx
call fcn.0041be70
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x415dc4
mov ecx, dword [esp + 0x1c]
call fcn.00415e16
mov ebp, eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test ebp, ebp
je 0x415dc4
push dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push 0xfc
push 0x1e0
mov dword [esp + 0x1c], ebx
call fcn.00415fa4
test al, al
je 0x415dbb
push dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
push dword [ebp + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x415d94
mov dword [ebp + 8], eax
jmp 0x415dbb
mov esi, dword [esp + 0x10]
test esi, esi
je 0x415dbb
push dword [esp + 0x28]
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test esi, esi
je 0x415db9
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov bl, 1
mov eax, dword [ebp]
mov ecx, ebp
push 1
call dword [eax]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
pop ecx
ret 0x10

Function at 0x417565
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
mov esi, ecx
call fcn.004175f4
mov ebx, dword [esp + 0x70]
test ebx, ebx
je 0x4175e9
xor ebp, ebp
cmp word [ebx], bp
je 0x4175e9
push edi
push 0x44
lea eax, [esp + 0x30]
push ebp
push eax
call fcn.0041c3f0
xor eax, eax
mov dword [esp + 0x1c], 0xc
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 1
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push ebp
push ebp
push 8
push ebp
push ebp
push ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
pop edi
test eax, eax
je 0x4175e9
mov ecx, dword [esp + 0x18]
mov al, 1
mov dword [esi], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
jmp 0x4175eb
xor al, al
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 0x14
Function at 0x417795
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x4178a5
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4178a5
lea ecx, [ebp - 0x240]
call fcn.00403195
push edi
push ebx
mov eax, ecx
push str._sFonts_s
push eax
call fcn.004011fb
add esp, 0x10
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4178a5
cmp byte [ebx + 0x3698], 0
jne 0x4178a5
lea ecx, [ebp - 0x458]
call fcn.00403195
push edi
mov eax, ecx
push str.https:__download.mql5.com_cdn_web_components__s
push eax
call fcn.004011fb
lea esi, [ebx + 0x210]
add esp, 0xc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x454]
call dword [eax + 0x38]
cmp eax, 0xc8
jne 0x4178a5
lea ecx, [ebp - 0x28]
call fcn.004037e2
mov eax, ecx
lea ecx, [ebx + 0x3670]
push eax
call fcn.0040307f
xor esi, esi
cmp dword [ebp - 0x1c], esi
ja 0x41785a
cmp dword [ebp - 0x20], 0x4e20
jbe 0x41789d
push ecx
push ecx
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x28]
call fcn.00403f55
test al, al
je 0x41789d
push ecx
push edi
push ecx
push dword [ebp + 8]
mov edx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004039b8
push edi
push str.value_sunitfile
push str.Install_Component
push esi
push esi
push 0x4ae1c0
call fcn.0043d9fd
add esp, 0x28
lea ecx, [ebp - 0x28]
call fcn.00403805
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4178ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
je 0x4179a1
lea ecx, [ebp - 0x240]
call fcn.00403195
push dword [ebp + 0xc]
mov eax, ecx
push edi
push str._s_s
push eax
call fcn.004011fb
add esp, 0x10
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4179a1
cmp byte [edi + 0x3698], 0
jne 0x4179a1
lea ecx, [ebp - 0x458]
call fcn.00403195
push dword [ebp + 8]
mov eax, ecx
push str.https:__download.mql5.com_cdn_web_components__s
push eax
call fcn.004011fb
lea esi, [edi + 0x210]
add esp, 0xc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x454]
call dword [eax + 0x38]
cmp eax, 0xc8
jne 0x4179a1
lea ecx, [ebp - 0x28]
call fcn.004037e2
mov eax, ecx
lea ecx, [edi + 0x3670]
push eax
call fcn.0040307f
xor esi, esi
cmp dword [ebp - 0x1c], esi
ja 0x417969
cmp dword [ebp - 0x20], 0x186a0
jbe 0x417999
push ecx
push ecx
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x28]
call fcn.00403f55
test al, al
je 0x417999
push dword [ebp + 8]
push str.value_sunitfile
push str.Install_Component
push esi
push esi
push 0x4ae1c0
call fcn.0043d9fd
add esp, 0x18
lea ecx, [ebp - 0x28]
call fcn.00403805
pop edi
pop esi
leave
ret 8
Function at 0x417a43
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48d480]
sub esp, 0x11c
push esi
push edi
xor edi, edi
mov esi, ecx
test eax, eax
jg 0x417aac
push 0x118
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.0041c3f0
add esp, 0xc
mov dword [ebp - 0x11c], 0x11c
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x417b1d
imul eax, dword [ebp - 0x118], 0x64
add eax, dword [ebp - 0x114]
mov dword [0x48d484], eax
mov eax, dword [ebp - 0x110]
mov dword [0x48d480], eax
cmp eax, 0x1db1
jl 0x417b1d
push esi
push edi
push edi
push 0x24
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x417b1d
push ebx
mov ecx, esi
call fcn.004176cc
push str.oledlg.dll
mov bl, al
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
je 0x417aec
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov byte [esi + 0x3699], 1
jmp 0x417af5
cmp byte [esi + 0x3699], 0
je 0x417af9
test bl, bl
je 0x417b1c
lea edi, [esi + 0x208]
mov ecx, edi
call fcn.004038c1
test al, al
jne 0x417b1c
push 0x400000
push esi
push 0x417a10
mov ecx, edi
call fcn.00403860
pop ebx
pop edi
pop esi
leave
ret
Function at 0x418967
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x66c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
lea ecx, [esp + 0x268]
mov dword [esp + 0x14], edi
call fcn.004045b8
cmp dword [ebp + 0xc], 0x80
mov bl, 1
ja 0x418b20
mov ecx, esi
call fcn.00401b2b
test al, al
jne 0x418b20
cmp dword [esi + 8], 3
jbe 0x418b20
push dword [edi + 4]
lea eax, [esp + 0x26c]
push dword [esi + 4]
push str._s_s
push eax
call fcn.004011fb
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x270]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x418b22
test byte [esp + 0x18], 0x10
je 0x418a9e
mov edx, 0x46a540
lea ecx, [esp + 0x44]
call fcn.004163ce
test eax, eax
je 0x418b03
mov edx, 0x46ed6c
lea ecx, [esp + 0x44]
call fcn.004163ce
test eax, eax
je 0x418b03
lea eax, [esp + 0x44]
push eax
push dword [esi + 4]
lea eax, [esp + 0x270]
push str._s_s
push eax
call fcn.004011fb
and dword [esp + 0x20], 0
lea ecx, [esp + 0x278]
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x24]
inc eax
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00418967
add esp, 0x18
push dword [esp + 0x26c]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x418acc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x418b01
push 0x80
push dword [esp + 0x270]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 0x26c]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x418afd
lea eax, [esp + 0x44]
push eax
push dword [esi + 4]
lea eax, [esp + 0x270]
push str._s_s
push eax
call fcn.004011fb
add esp, 0x10
push dword [esp + 0x26c]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x418ad3
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x418b03
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x418b01
push 0x80
push dword [esp + 0x270]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 0x26c]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x418b03
xor bl, bl
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4189ea
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x418b22
xor bl, bl
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418b53
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], 0x460424
push edi
mov dword [esp + 0x14], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x1c], 0x10
xor edi, edi
mov word [esp + 0x20], ax
push 0x471064
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edi
call fcn.00402fc9
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x471060
push edi
push eax
lea edx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov ecx, esi
call fcn.00418967
pop ecx
pop ecx
test al, al
je 0x418beb
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
call edi
test eax, eax
jne 0x418be7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x418beb
push 0x80
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esi + 4]
call edi
test eax, eax
je 0x418beb
mov al, 1
jmp 0x418bed
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f944
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d7e8
push 0x45d7e0
push str.FlsAlloc
push 0x1e
call fcn.0042f7c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f978
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a6b4]
call esi
jmp 0x42f97e
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42f9c2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d7f8
push 0x45d7f0
push str.FlsGetValue
push 0x20
call fcn.0042f7c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f9f9
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a6b4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsGetValue]

Function at 0x4319a6
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x476014]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4319f1
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00431b45
test al, al
jne 0x4319eb
sub edx, 2
cmp edx, edi
jne 0x4319d1
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x431a13
lea eax, [edi + 2]
cmp edx, eax
je 0x431a13
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004318f2
add esp, 0x10
jmp 0x431b0d
push esi
lea ecx, [ebp - 0x255]
call fcn.00431b45
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x431a56
push dword [ebp - 0x25c]
jmp 0x431a03
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x431a93
cmp word [ebp - 0x226], 0
je 0x431ab4
cmp word [ebp - 0x226], ax
jne 0x431a93
cmp word [ebp - 0x224], 0
je 0x431ab4
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004318f2
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x431b00
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x431a6d
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x431ae8
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
jmp 0x431b0d
push 0x431722
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00428430
add esp, 0x10
jmp 0x431add
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ac16
leave
ret
Function at 0x431c4b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x431c5c
pop esi
ret
push ebx
push edi
push esi
call fcn.00431c14
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042dc12
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x431c84
push ebx
push esi
push edi
call fcn.0041be70
add esp, 0xc
push 0
call fcn.0042dbd8
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x432048
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00431c99
Function at 0x43d287
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0041b500
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x43d2e0
mov edi, 0x4ae1c0
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov esi, dword [0x4b2dcc]
jmp 0x43d2d5
push dword [ebp + 8]
push esi
call fcn.0042a115
pop ecx
pop ecx
test eax, eax
jne 0x43d2cf
lea ecx, [esi + 0x894]
call fcn.00401b2b
test al, al
je 0x43d2e9
mov esi, dword [esi + 0x18e0]
test esi, esi
jne 0x43d2b1
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1004], 0x800
mov dword [ebp - 0x100c], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1008], ebx
cmp byte [esi + 0x80], bl
mov ecx, 0x10a4
mov word [ebp - 0x1000], ax
mov eax, 0x894
cmove eax, ecx
mov dword [ebp - 0x1010], 0x467ee4
add eax, esi
lea ecx, [ebp - 0x1010]
push eax
call fcn.004035f7
mov byte [esi + 0x80], bl
cmp dword [ebp + 0xc], ebx
je 0x43d397
cmp dword [ebp - 0x100c], ebx
je 0x43d379
cmp dword [ebp - 0x1008], ebx
jbe 0x43d379
push 0x467f28
push dword [ebp - 0x100c]
call fcn.0041b6ce
pop ecx
pop ecx
test eax, eax
je 0x43d379
sub eax, dword [ebp - 0x100c]
test eax, 0xfffffffe
jge 0x43d389
push str._firstfalse
lea ecx, [ebp - 0x1010]
call fcn.004034ba
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1010]
call fcn.004034ba
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 1
push ebx
push ebx
push dword [ebp - 0x100c]
push 0x467f1c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
jmp 0x43d2e2
Function at 0x4413e5
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x380
push esi
mov esi, dword [esp + 0x38c]
test esi, esi
jne 0x4413fe
xor al, al
jmp 0x441627
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx eax, ax
mov ebp, 0xff
push eax
push str.utm_codepage_u
push ebp
push esi
call fcn.00404e2f
lea ebx, [ebp + 1]
push ebx
lea eax, [esp + 0x24]
push 0
push eax
call fcn.0041c3f0
push ebx
push 0xfe
lea eax, [esp + 0x34]
mov edx, str.SOFTWAREMetaQuotes_Software
push eax
push 0x467fd0
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00403acb
add esp, 0x2c
mov edi, 0x2710
test al, al
je 0x44146c
lea eax, [esp + 0x10]
push eax
call fcn.00429dc0
pop ecx
test edx, edx
jg 0x4414a7
jl 0x44146c
cmp eax, edi
jae 0x4414a7
push ebx
push 0xfe
lea eax, [esp + 0x18]
mov edx, str.SOFTWAREMetaQuotes_Software
push eax
push 0x467fd0
mov ecx, SysReAllocStringLen
call fcn.00403acb
add esp, 0x10
test al, al
je 0x4414ae
lea eax, [esp + 0x10]
push eax
call fcn.00429dc0
pop ecx
test edx, edx
jg 0x4414a7
jl 0x4414ae
cmp eax, edi
jb 0x4414ae
mov ax, word [esp + 0x10]
jmp 0x4414b5
xor eax, eax
mov word [esp + 0x10], ax
test ax, ax
je 0x4414ff
push 0
push 0
push 0x7f
lea eax, [esp + 0x11c]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
je 0x4414ff
push str.utm_uniq
mov edx, ebp
mov ecx, esi
call fcn.00406d36
lea eax, [esp + 0x110]
mov edx, ebp
push eax
mov ecx, esi
call fcn.00406d36
cmp byte [0x4b3c40], 0
je 0x441524
push str.utm_link
mov edx, ebp
mov ecx, esi
call fcn.00406d36
push 0x4b3c40
mov edx, ebp
mov ecx, esi
call fcn.00406d36
push ebp
lea eax, [esp + 0x194]
push eax
push str.https:__www.mql5.com
call fcn.00441305
test al, al
je 0x44160b
push 0x4b3270
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [0x4b3cc8], 0
je 0x441600
mov edi, dword [0x4b3cc4]
jmp 0x4415f8
lea eax, [esp + 0x190]
push eax
push edi
call fcn.00441232
test al, al
je 0x4415eb
lea ebp, [edi + 0x80]
mov edx, str.utm_campaign
xor ecx, ecx
movzx eax, byte [ecx + ebp]
cmp al, byte [edx + ecx]
jne 0x441592
inc ecx
cmp ecx, 0xd
jne 0x441581
jmp 0x4415a8
mov edx, str.utm_source
xor ecx, ecx
movzx eax, byte [ecx + ebp]
cmp al, byte [edx + ecx]
jne 0x4415eb
inc ecx
cmp ecx, 0xb
jne 0x441599
lea ebx, [edi + 0xc0]
cmp byte [ebx], 0
je 0x4415eb
push 0x4680a8
mov edx, 0xff
mov ecx, esi
call fcn.00406d36
push ebp
mov ebp, 0xff
mov ecx, esi
mov edx, ebp
call fcn.00406d36
push 0x4680ac
mov edx, ebp
mov ecx, esi
call fcn.00406d36
push ebx
mov edx, ebp
mov ecx, esi
call fcn.00406d36
push edi
mov ecx, 0x4b3cc0
call fcn.00406d06
mov edi, eax
test edi, edi
jne 0x441562
push 0x4b3270
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop ebp
pop ebx
jmp 0x44161f
cmp al, 0x20
jne 0x441619
mov byte [esi], 0x2b
jmp 0x44161e
jge 0x44161e
mov byte [esi], 0x5f
inc esi
mov al, byte [esi]
test al, al
jne 0x441610
inc al
pop esi
add esp, 0x380
ret 0xc