joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42069c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x210]
push edx
call fcn.00447d2c
add esp, 0xc
cmp dword [0x45aa30], 0
jne 0x4207d1
push 0x18702ac
call sub.KERNEL32.DLL_InitializeCriticalSection
push 0x18702c4
call sub.KERNEL32.DLL_InitializeCriticalSection
xor ecx, ecx
mov dword [0x18702dc], ecx
xor eax, eax
mov dword [0x18702e0], eax
mov dword [0x18702e8], 1
xor edx, edx
mov dword [0x1870558], edx
call sub.USER32.DLL_GetFocus
mov dword [0x18702e4], eax
push 0x207
lea ecx, [ebp - 0x210]
push ecx
push 0x18702ec
call fcn.004046f8
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x42073a
push 0x63
push dword [ebp + 0xc]
push 0x18704f4
call fcn.004046f8
add esp, 0xc
jmp 0x420741
mov byte [0x18704f4], 0
push 0
push 0
push 0
push 0x4205b4
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x45aa30], eax
cmp dword [0x45aa30], 0
je 0x420808
push 0x18702ac
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, dword [0x18702e8]
mov dword [ebp - 4], eax
push 0x18702ac
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp dword [ebp - 4], 1
jne 0x420808
push 0x18702c4
call sub.KERNEL32.DLL_EnterCriticalSection
jmp 0x4207ad
lea edx, [ebp - 0x22c]
push edx
call sub.USER32.DLL_TranslateMessage
lea ecx, [ebp - 0x22c]
push ecx
call sub.USER32.DLL_DispatchMessageA
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
jne 0x420795
push 0x18702c4
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x420767
push 0x18702ac
call sub.KERNEL32.DLL_EnterCriticalSection
push 0x207
lea edx, [ebp - 0x210]
push edx
push 0x18702ec
call fcn.004046f8
add esp, 0xc
mov dword [0x18702e8], 1
push 0x18702ac
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esp, ebp
pop ebp
ret
Function at 0x4210a8
Capabilities:
Delete directory
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffad0
push dword [ebp + 8]
lea eax, [ebp - 0x328]
push eax
call fcn.0044435c
add esp, 8
lea edx, [ebp - 0x328]
push edx
call fcn.004045d8
pop ecx
lea ecx, [ebp - 0x328]
push ecx
call fcn.0044438c
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jl 0x4210ef
cmp dword [ebp - 8], 0xfa
jle 0x4210f6
xor eax, eax
jmp 0x4212d1
push dword [ebp + 0xc]
lea edx, [ebp - 0x530]
push edx
call fcn.0044435c
add esp, 8
lea ecx, [ebp - 0x530]
push ecx
call fcn.004045d8
pop ecx
lea eax, [ebp - 0x530]
push eax
call fcn.0044438c
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jl 0x421134
cmp dword [ebp - 0xc], 0xfa
jle 0x42113b
xor eax, eax
jmp 0x4212d1
mov edx, dword [ebp - 0xc]
mov byte [ebp + edx - 0x531], 0
lea ecx, [ebp - 0x530]
push ecx
call fcn.00404464
pop ecx
test eax, eax
jne 0x42115e
xor eax, eax
jmp 0x4212d1
mov edx, dword [ebp - 0xc]
mov byte [ebp + edx - 0x531], 0x5c
push 0x45ceee
lea ecx, [ebp - 0x328]
add ecx, dword [ebp - 8]
push ecx
call fcn.0044435c
add esp, 8
push 0
lea eax, [ebp - 0x120]
push eax
lea edx, [ebp - 0x328]
push edx
call fcn.00445ecc
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42128f
movsx ecx, byte [ebp - 0x110]
cmp ecx, 0x2e
je 0x421275
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x328]
add edx, dword [ebp - 8]
push edx
call fcn.0044435c
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
lea eax, [ebp - 0x530]
add eax, dword [ebp - 0xc]
push eax
call fcn.0044435c
add esp, 8
test byte [ebp - 0x118], 0x10
je 0x42121e
lea edx, [ebp - 0x530]
push edx
lea ecx, [ebp - 0x328]
push ecx
call fcn.004210a8
add esp, 8
test eax, eax
jne 0x421275
lea eax, [ebp - 0x120]
push eax
call fcn.00445f90
pop ecx
xor eax, eax
jmp 0x4212d1
push 0x80
lea edx, [ebp - 0x328]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
lea ecx, [ebp - 0x328]
push ecx
call fcn.00404664
pop ecx
test eax, eax
je 0x42125e
push 0x80
lea eax, [ebp - 0x530]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea edx, [ebp - 0x530]
push edx
call fcn.0041d9cc
pop ecx
lea ecx, [ebp - 0x530]
push ecx
lea eax, [ebp - 0x328]
push eax
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je 0x42120a
lea edx, [ebp - 0x120]
push edx
call fcn.00446024
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4211a5
lea ecx, [ebp - 0x120]
push ecx
call fcn.00445f90
pop ecx
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x329], 0
push 0x80
lea edx, [ebp - 0x328]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
lea ecx, [ebp - 0x328]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
je 0x4212cf
mov eax, 1
jmp 0x4212d1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x421a00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x421a3f
test byte [ebp - 0x5f], 0x80
je 0x421a3f
test byte [ebp - 0x5d], 0x80
je 0x421a3f
push 0
call fcn.00421644
pop ecx
test eax, eax
je 0x421a38
mov eax, 1
jmp 0x421a41
call fcn.00421990
jmp 0x421a41
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x422130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
mov dword [ebp - 0x18], 8
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x422161
xor eax, eax
jmp 0x4221f9
cmp dword [ebp - 0xa8], 3
ja 0x42217c
cmp dword [ebp - 0xa8], 3
jne 0x4221e8
cmp dword [ebp - 0xa4], 0x33
jbe 0x4221e8
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_Messaging_Subsystem
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4221e4
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
push edx
push 0
push 0x45d35f
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 4], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 4], 0
jne 0x4221e4
push 0x45d364
lea ecx, [ebp - 0x10]
push ecx
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
jne 0x4221e4
mov eax, 1
jmp 0x4221f9
xor eax, eax
jmp 0x4221f9
push 0
push str.MAPI
push str.Mail
call sub.KERNEL32.DLL_GetProfileIntA
mov esp, ebp
pop ebp
ret
Function at 0x422670
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push esi
push edi
push 0xc7
lea eax, [ebp - 0x104]
push eax
mov edx, dword [ebp + 0xc]
push dword [edx + 0x14]
call sub.USER32.DLL_GetWindowTextA
mov byte [ebp - 0x3d], 0
mov ecx, dword [ebp + 0xc]
lea esi, [ecx + 0x1c]
lea edi, [ebp - 0x114]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp + 0x10], 0
je 0x4226c8
mov eax, dword [ebp + 0xc]
test byte [eax + 0x10], 1
je 0x4226c8
push 1
push 1
lea edx, [ebp - 0x114]
push edx
call sub.USER32.DLL_OffsetRect
lea esi, [ebp - 0x114]
lea edi, [ebp - 0x124]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ax, 0x10
cmp dword [ebp + 0x18], 0
jne 0x4226e8
add eax, 0x10
or ax, 1
mov word [ebp - 2], ax
movzx edx, word [ebp - 2]
or edx, 0x400
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0xffffffffffffffff
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.USER32.DLL_DrawTextA
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x114]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0x108]
sub ecx, dword [ebp - 0x110]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x124]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x118]
sub edx, dword [ebp - 0x120]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xc]
sar ecx, 1
jns 0x42275c
adc ecx, 0
mov dword [ebp - 0x1c], ecx
cmp word [ebp + 0x1c], 1
jne 0x422778
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
sar eax, 1
jns 0x422773
adc eax, 0
mov dword [ebp - 0x18], eax
jmp 0x4227b0
cmp word [ebp + 0x1c], 2
jne 0x42278a
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
jmp 0x4227b0
cmp word [ebp + 0x1c], 4
jne 0x4227ab
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
jg 0x4227a0
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x4227b0
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
jmp 0x4227b0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
lea eax, [ebp - 0x114]
push eax
call sub.USER32.DLL_OffsetRect
push 1
push dword [ebp + 8]
call sub.GDI32.DLL_SetBkMode
cmp dword [ebp + 0x10], 0
je 0x422807
mov edx, dword [ebp + 0xc]
test byte [edx + 0x10], 4
je 0x422807
push 0x5c5c5c
push dword [ebp + 8]
call sub.GDI32.DLL_SetTextColor
movzx ecx, word [ebp - 2]
push ecx
lea eax, [ebp - 0x114]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x104]
push edx
push dword [ebp + 8]
call sub.USER32.DLL_DrawTextA
jmp 0x422844
cmp dword [ebp + 0x10], 0
je 0x42281c
push 0xc8c8c8
push dword [ebp + 8]
call sub.GDI32.DLL_SetTextColor
jmp 0x422827
push dword [ebp + 0x14]
push dword [ebp + 8]
call sub.GDI32.DLL_SetTextColor
movzx ecx, word [ebp - 2]
push ecx
lea eax, [ebp - 0x114]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x104]
push edx
push dword [ebp + 8]
call sub.USER32.DLL_DrawTextA
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42b798
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [ebp + 8], 5
jne 0x42b7df
push 1
push dword [0x4528dc]
call sub.USER32.DLL_EnableWindow
push 1
push dword [ebp + 0xc]
call sub.USER32.DLL_EnableWindow
cmp dword [0x45e964], 0
je 0x42b978
push dword [0x45e964]
call sub.USER32.DLL_DestroyWindow
xor eax, eax
mov dword [0x45e964], eax
jmp 0x42b978
xor edx, edx
mov dword [0x45e968], edx
cmp dword [ebp + 8], 2
jne 0x42b81b
mov dword [0x45e974], 1
push 0
push sym.PCDOCW.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x4e0
push dword [0x4528e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45e964], eax
jmp 0x42b8b8
cmp dword [ebp + 8], 3
jne 0x42b84c
mov dword [0x45e974], 3
push 0
push sym.PCDOCW.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x1772
push dword [0x4528e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45e964], eax
jmp 0x42b8b8
cmp dword [ebp + 8], 4
jne 0x42b87d
mov dword [0x45e974], 4
push 0
push sym.PCDOCW.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x1772
push dword [0x4528e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45e964], eax
jmp 0x42b8b8
cmp dword [ebp + 8], 0
jne 0x42b88f
mov dword [0x45e974], 1
jmp 0x42b899
mov dword [0x45e974], 2
push 0
push sym.PCDOCW.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x1770
push dword [0x4528e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45e964], eax
cmp dword [0x45e964], 0
je 0x42b961
cmp dword [ebp + 8], 0
je 0x42b8d1
cmp dword [ebp + 8], 1
jne 0x42b8f9
cmp dword [ebp + 0x10], 0
je 0x42b8e9
push str.MINITEST_Speicher_lesen
push dword [0x45e964]
call sub.USER32.DLL_SetWindowTextA
jmp 0x42b8f9
push 0x461cbd
push dword [0x45e964]
call sub.USER32.DLL_SetWindowTextA
lea ecx, [ebp - 0x10]
push ecx
push dword [0x45e964]
call sub.USER32.DLL_GetWindowRect
push 5
push 0
push 0
push 0x3e
call sub.USER32.DLL_GetSystemMetrics
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
sub eax, edx
sar eax, 1
jns 0x42b924
adc eax, 0
push eax
push 0x3d
call sub.USER32.DLL_GetSystemMetrics
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
sub eax, ecx
sar eax, 1
jns 0x42b93b
adc eax, 0
push eax
push 0
push dword [0x45e964]
call sub.USER32.DLL_SetWindowPos
push 5
push dword [0x45e964]
call sub.USER32.DLL_ShowWindow
push dword [0x45e964]
call sub.USER32.DLL_UpdateWindow
push 0
push dword [0x4528dc]
call sub.USER32.DLL_EnableWindow
push 0
push dword [ebp + 0xc]
call sub.USER32.DLL_EnableWindow
mov esp, ebp
pop ebp
ret
Function at 0x42bde0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
call fcn.0042c014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42be08
push 0x461d4b
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
test eax, eax
jne 0x42be29
push str.XML_ETC
push str.Die_Datei__s_kann_nicht_ge
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x42be45
push 0x468af8
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x42be53
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x42c61c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
cmp dword [ebp + 8], 0
jl 0x42c631
cmp dword [ebp + 8], 0x100
jl 0x42c638
xor eax, eax
jmp 0x42c7d1
push str.._
lea edx, [ebp - 0x34]
push edx
call fcn.0044435c
add esp, 8
mov ecx, dword [ebp + 8]
inc ecx
push ecx
push str.COM_d
lea eax, [ebp - 0x34]
push eax
call fcn.0044438c
pop ecx
lea edx, [ebp - 0x34]
add eax, edx
push eax
call fcn.00447d04
add esp, 0xc
push dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
push ecx
push str.ReadM5DeviceOpenComm____s___d__r_n
call fcn.00403934
add esp, 0xc
push 0xc8
push 0x800
lea eax, [ebp - 0x34]
push eax
call fcn.00442610
mov dword [0x45fc94], eax
test eax, eax
je 0x42c7bc
push str.ReadM5DeviceOpenComm___OK_r_n
call fcn.00403934
pop ecx
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [0x45fc94]
push dword [ecx]
call sub.KERNEL32.DLL_GetCommState
mov byte [ebp - 0xe], 8
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
and byte [ebp - 0x18], 0xfb
and byte [ebp - 0x18], 0xf7
and byte [ebp - 0x18], 0xcf
and byte [ebp - 0x18], 0xbf
and byte [ebp - 0x17], 0xfe
and byte [ebp - 0x17], 0xfd
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
and byte [ebp - 0x17], 0xf7
mov word [ebp - 0x12], 0x32
mov word [ebp - 0x10], 0x1f4
or byte [ebp - 0x18], 1
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [0x45fc94]
push dword [ecx]
call sub.KERNEL32.DLL_SetCommState
push 1
call fcn.0042c5f0
pop ecx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 4], eax
push 5
mov eax, dword [0x45fc94]
push dword [eax]
call sub.KERNEL32.DLL_EscapeCommFunction
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x64
jb 0x42c730
push 6
mov edx, dword [0x45fc94]
push dword [edx]
call sub.KERNEL32.DLL_EscapeCommFunction
push 3
mov ecx, dword [0x45fc94]
push dword [ecx]
call sub.KERNEL32.DLL_EscapeCommFunction
mov dword [0x45e8b8], 0xffffffff
mov dword [0x45e8bc], 0xffffffff
mov dword [0x45e8c0], 0xffffffff
mov dword [0x45e8c4], 0xffffffff
mov dword [0x45e8c8], 0xffffffff
mov dword [0x45e8cc], 0xffffffff
mov dword [0x45e8d0], 0xffffffff
mov dword [0x45e8d4], 0xffffffff
mov dword [0x45e8d8], 0xffffffff
mov eax, 1
jmp 0x42c7d1
push str.ReadM5DeviceOpenComm___ERR_r_n
call fcn.00403934
pop ecx
xor edx, edx
mov dword [0x45fc94], edx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x434a44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
cmp dword [ebp + 8], 0
jl 0x434bbe
cmp dword [ebp + 8], 3
jge 0x434bbe
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x468af8
lea edx, [ebp - 0x134]
push edx
call fcn.0044435c
add esp, 8
mov ecx, dword [ebp + 8]
push dword [ecx*4 + 0x460ee8]
lea eax, [ebp - 0x134]
push eax
call fcn.00444280
add esp, 8
push 0x4642f6
lea edx, [ebp - 0x134]
push edx
call fcn.004463c0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x434b44
push 2
push 0
push dword [ebp - 0x14]
call fcn.004466ac
add esp, 0xc
push dword [ebp - 0x14]
call fcn.00446710
pop ecx
mov dword [ebp - 0x18], eax
push 0
push 0
push dword [ebp - 0x14]
call fcn.004466ac
add esp, 0xc
cmp dword [ebp - 0x18], 0x64
jle 0x434b3b
cmp dword [ebp - 0x18], 0x30d40
jge 0x434b3b
push dword [ebp - 0x18]
call fcn.00443374
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x434b3b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x10]
call fcn.0044661c
add esp, 0x10
cmp eax, dword [ebp - 0x18]
jne 0x434b2d
push 4
push str.RIFF
push dword [ebp - 0x10]
call fcn.00444458
add esp, 0xc
test eax, eax
je 0x434b3b
push dword [ebp - 0x10]
call fcn.00443384
pop ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push dword [ebp - 0x14]
call fcn.00445c04
pop ecx
cmp dword [ebp - 0x10], 0
je 0x434b5f
push 6
push dword [ebp - 0x10]
call sub.WINMM.DLL_sndPlaySoundA
push dword [ebp - 0x10]
call fcn.00443384
pop ecx
jmp 0x434bbe
push 0x4642fe
mov ax, word [ebp + 8]
add ax, 0x4e21
movzx edx, ax
push edx
push dword [0x4528e0]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x434bbe
push dword [ebp - 4]
push dword [0x4528e0]
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x434bbe
push dword [ebp - 8]
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x434bb6
push 6
push dword [ebp - 0xc]
call sub.WINMM.DLL_sndPlaySoundA
push dword [ebp - 8]
call sub.KERNEL32.DLL_FreeResource
mov esp, ebp
pop ebp
ret
Function at 0x4369a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
sub edx, 0x110
je 0x4369c7
dec edx
je 0x436adf
jmp 0x436ba1
push dword [ebp + 8]
call sub.USER32.DLL_GetParent
mov dword [0x187f970], eax
cmp dword [0x4530fc], 1
jne 0x436a09
cmp dword [0x187f970], 0
je 0x436a09
push dword [0x187f970]
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x436a09
push 0xba4
push dword [0x187f970]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
jne 0x436a1a
push 1
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
xor eax, eax
jmp 0x436ba4
cmp dword [0x187e62c], 0xfffffffe
je 0x436a30
cmp dword [0x45e564], 0
jle 0x436a30
xor edx, edx
jmp 0x436a35
mov edx, 1
mov dword [0x187f974], edx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax*8 + 0x45e940]
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
push dword [0x187f970]
call sub.USER32.DLL_IsDlgButtonChecked
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_CheckDlgButton
cmp dword [0x187f974], 0
je 0x436a84
push 0
push 2
push 0xf4
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x436a40
cmp dword [0x187f974], 0
je 0x436aaa
push 0
push 2
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
jmp 0x436ad3
push 0x56a
push dword [0x187f970]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x436ad3
push 0
push 0x186c
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
mov dword [ebp - 4], 1
jmp 0x436ba1
mov cx, word [ebp + 0x10]
and cx, 0xffff
cmp cx, 2
jne 0x436b04
mov dword [ebp - 4], 1
push 1
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
jmp 0x436ba1
mov ax, word [ebp + 0x10]
and ax, 0xffff
cmp ax, 1
jne 0x436ba1
cmp dword [0x187f974], 0
jne 0x436aee
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*8 + 0x45e940]
mov dword [ebp - 0x14], eax
mov ebx, 1
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
jne 0x436b46
dec ebx
mov dword [ebp - 8], ebx
mov ebx, 1
push dword [ebp - 0x14]
push dword [0x187f970]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
jne 0x436b61
dec ebx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x436b87
mov dword [0x187e2d0], 1
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [0x187f970]
call sub.USER32.DLL_CheckDlgButton
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x436b24
mov dword [ebp - 4], 1
push 1
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x437140
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x45fc94], 0
jne 0x437156
xor eax, eax
jmp 0x43720a
push str.ReadM5DeviceOpenCheckMiele..._r_n
call fcn.00403934
pop ecx
xor edx, edx
mov dword [ebp - 0xc], edx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 4], eax
jmp 0x4371ea
push 1
lea ecx, [ebp - 5]
push ecx
call fcn.0044263c
dec eax
je 0x437188
push 0x64
call fcn.00404c08
pop ecx
jmp 0x4371ea
mov eax, dword [ebp - 0xc]
mov dl, byte [eax + 0x4610b7]
cmp dl, byte [ebp - 5]
je 0x4371c0
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx + 0x4610ab]
cmp al, byte [ebp - 5]
je 0x4371c0
mov edx, dword [ebp - 0xc]
mov cl, byte [edx + 0x4610af]
cmp cl, byte [ebp - 5]
je 0x4371c0
mov eax, dword [ebp - 0xc]
mov dl, byte [eax + 0x4610b3]
cmp dl, byte [ebp - 5]
jne 0x4371e5
inc dword [ebp - 0xc]
push 0x4610b7
call fcn.0044438c
pop ecx
cmp eax, dword [ebp - 0xc]
jne 0x4371ea
push str.ReadM5DeviceOpenCheckMiele_FOUND_r_n
call fcn.00403934
pop ecx
mov eax, 1
jmp 0x43720a
xor edx, edx
mov dword [ebp - 0xc], edx
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jb 0x437170
push str.ReadM5DeviceOpenCheckMiele___not_found___r_n
call fcn.00403934
pop ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x442090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push 0xf0
lea eax, [ebp - 0x11c]
push eax
push dword [0x4528e0]
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x11c]
push edx
call fcn.00444491
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4420d3
mov ecx, dword [ebp - 4]
mov byte [ecx + 1], 0
jmp 0x4420e7
push 0x46573d
lea eax, [ebp - 0x11c]
push eax
call fcn.00444280
add esp, 8
push str.PCDOCWL1.DAT
lea edx, [ebp - 0x11c]
push edx
call fcn.00444280
add esp, 8
push 0x46573f
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004463c0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x442137
lea eax, [ebp - 0x11c]
push eax
push 0x453511
push 0x30
push 0
call fcn.00411b5c
add esp, 0x10
xor eax, eax
jmp 0x4421f4
mov dword [ebp - 8], 0x45f5ba
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor byte [eax + ecx], 0xaa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x230
jl 0x442143
push dword [ebp - 0xc]
push 1
push 0x230
push 0x45f5ba
call fcn.0044661c
add esp, 0x10
cmp eax, 1
jne 0x442198
push dword [ebp - 0xc]
push 1
push 2
lea edx, [ebp - 0xe]
push edx
call fcn.0044661c
add esp, 0x10
cmp eax, 1
jne 0x442198
call fcn.0044205c
cmp ax, word [ebp - 0xe]
je 0x4421bd
push dword [ebp - 0xc]
call fcn.00445c04
pop ecx
lea ecx, [ebp - 0x11c]
push ecx
push 0x4535f8
push 0x30
push 0
call fcn.00411b5c
add esp, 0x10
xor eax, eax
jmp 0x4421f4
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor byte [eax + ecx], 0xaa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x230
jl 0x4421c2
push 0x230
push 0x45f5ba
push 0x45ef70
call fcn.0044416c
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret