joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429c6e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, dword [ebp + 8]
push str.DeviceCdRom
push esi
call fcn.0042568e
test eax, eax
je 0x429ca7
add esi, 0x1a
push esi
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
xor eax, eax
inc eax
jmp 0x429e20
push str.DeviceFloppy
push esi
call fcn.0042568e
test eax, eax
je 0x429cbb
add esi, 0x1c
jmp 0x429c8d
cmp dword [0x4f9f50], 6
jae 0x429ccb
xor eax, eax
jmp 0x429e20
push str.HarddiskVolume
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x429cc4
push edi
push esi
push str.GetNt6VolumeDeviceAndPartitionNumber__s_...
push 3
call fcn.004452a3
mov eax, dword [0x492a1c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f698
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
add esp, 0x10
xor esi, esi
jmp 0x429d4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x429e08
push dword [ebp - 4]
call fcn.0043f70d
add dword [0x492a1c], 0x1000
mov eax, dword [0x492a1c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f698
pop ecx
pop ecx
mov ecx, dword [0x492a1c]
dec ecx
push ecx
push eax
push esi
mov dword [ebp - 4], eax
call edi
mov dword [ebp - 8], eax
cmp eax, esi
je 0x429d0f
push ebx
xor ebx, ebx
cmp eax, esi
jle 0x429df6
mov eax, dword [ebp - 4]
lea esi, [eax + ebx*2]
cmp word [esi], 0
je 0x429df6
push str.Harddisk
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, esi
jne 0x429de2
push str.Partition
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x429de2
push 0x104
lea eax, [ebp - 0x214]
push eax
push esi
call edi
test eax, eax
je 0x429de2
cmp dword [0x506fb4], 5
jl 0x429dce
lea eax, [ebp - 0x214]
push eax
push esi
push str.___s___s
push 5
call fcn.004452a3
add esp, 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x429e25
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax + 1]
cmp ebx, dword [ebp - 8]
jl 0x429d6c
push str._not_found
push 3
call fcn.004452a3
pop ecx
pop ecx
xor esi, esi
jmp 0x429e5a
call fcn.00442f0e
push eax
push str._qdd_all__err_S
push 3
call fcn.004452a3
add esp, 0xc
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov edi, dword [sym.imp.SHLWAPI.dll_StrToIntW]
lea eax, [esi + 0x10]
push eax
call edi
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
add eax, 0x12
push eax
call edi
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ecx], eax
push dword [ebx]
push esi
push str._found__s____pDevNum_i_pPartNum_i
push 3
call fcn.004452a3
xor esi, esi
add esp, 0x14
inc esi
push dword [ebp - 4]
call fcn.0043f70d
pop ecx
mov eax, esi
pop ebx
jmp 0x429e1f
Function at 0x42a61d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x4fa078
lea eax, [ebp - 0x25c]
push str._sSystem32_rundll32.exe
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x65c]
push str.__s__url_OpenURL__s
push eax
call esi
add esp, 0x1c
cmp dword [0x4f9f50], 6
jb 0x42a692
call fcn.00425a5a
test eax, eax
je 0x42a692
call fcn.0042941c
test eax, eax
je 0x42a692
push 3
push 0x4f9c10
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00428b12
jmp 0x42a6fe
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x38
stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x467150
call fcn.0043f4d8
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x42a6fc
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
inc eax
jmp 0x42a6fe
xor eax, eax
pop esi
leave
ret 4
Function at 0x42cffd
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42d02a
mov eax, dword [0x4fca38]
cmp eax, esi
je 0x42d1fe
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [0x4fca38], esi
jmp 0x42d1fe
cmp dword [0x4fca38], esi
jne 0x42d1ce
push dword [0x4fa548]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42d1ce
mov eax, dword [0x492a30]
cmp eax, 0xf0
push ebx
push edi
jl 0x42d063
push 8
call fcn.004287bb
mov ebx, eax
jmp 0x42d08b
cmp eax, 0xc0
jl 0x42d06e
push 0x10
jmp 0x42d077
cmp eax, 0xa8
jl 0x42d07a
push 0xe
pop ebx
jmp 0x42d08b
xor ebx, ebx
cmp eax, 0x90
setge bl
lea ebx, [ebx*4 + 8]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
push eax
push esi
mov dword [0x4fca34], eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [0x4fca34]
push esi
sub eax, dword [ebp - 0x14]
mov dword [0x4fca30], esi
mov dword [0x4fca2c], eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov dword [0x4fca38], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
push ebx
push 1
push 0xbe
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push 0xcc0020
push dword [0x4fca30]
mov edi, eax
push dword [0x4fca2c]
mov eax, dword [0x4fca34]
push dword [ebp + 0xc]
push eax
push eax
push esi
push esi
push dword [0x4fca38]
call dword [sym.imp.GDI32.dll_BitBlt]
push 1
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 5
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [0x4fca34]
push 3
push esi
sub ecx, ebx
push esi
lea eax, [ecx + 1]
cdq
push ebx
sub eax, edx
sar eax, 1
push ebx
push edi
push eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push dword [0x4fca38]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [0x4fca34]
mov ecx, dword [0x4fca2c]
mov edx, dword [0x4fca30]
lea edi, [ecx + eax]
mov dword [0x4fc938], edi
lea edi, [edx + eax]
mov dword [0x4fc93c], edi
pop edi
mov dword [0x4fc930], ecx
mov dword [0x4fc934], edx
mov dword [0x4fc940], eax
pop ebx
jmp 0x42d1df
mov edx, dword [0x4fca30]
mov ecx, dword [0x4fca2c]
mov eax, dword [0x4fca34]
push 0xcc0020
push esi
push esi
push dword [0x4fca38]
lea esi, [edx + eax]
push esi
add eax, ecx
push eax
push edx
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
pop esi
leave
ret 8
Function at 0x42f4eb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push dword [ebp + 8]
call fcn.00424b3c
test eax, eax
jne 0x42f528
push 0x10
push 0x44d65c
push str.File_not_found
push dword [0x4fa548]
call fcn.00446914
mov dword [0x4fac54], 1
xor eax, eax
jmp 0x42f74c
mov eax, dword [0x4fc9b8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42f541
push eax
call fcn.0043f70d
pop ecx
mov dword [0x4fc9b8], ebx
push 0x4fc9b8
push dword [ebp + 8]
call fcn.004282d9
cmp eax, 0x64
jge 0x42f572
mov eax, dword [0x4fc9b8]
cmp eax, ebx
je 0x42f749
push eax
call fcn.0043f70d
pop ecx
mov dword [0x4fc9b8], ebx
jmp 0x42f749
push str.Report
push ebx
push 0x7f02
call fcn.0042ed07
push dword [0x4fa560]
mov dword [0x4fa508], 1
call fcn.0042e3db
push dword [0x4fa568]
call fcn.0042e3db
push dword [0x4fa550]
push dword [0x4fc9b8]
call fcn.00446aea
test eax, eax
je 0x42f743
push esi
push edi
xor eax, eax
push 0x3fe
mov word [ebp - 0x408], ax
lea eax, [ebp - 0x406]
push ebx
push eax
call fcn.0043f4d8
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x408]
push eax
push dword [0x4fa548]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x42f649
mov esi, 0x44bf70
push esi
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, ebx
je 0x42f613
xor ecx, ecx
mov word [eax], cx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x408]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
lea eax, [ebp - 0x408]
push eax
push dword [0x4fa548]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x4fc9a0]
mov esi, dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
cmp eax, ebx
je 0x42f65b
push eax
call esi
mov eax, dword [0x4fc9a4]
mov dword [0x4fc9a0], ebx
cmp eax, ebx
je 0x42f66d
push eax
call esi
mov ecx, dword [0x4fc94c]
mov dword [0x4fc9a4], ebx
call fcn.00401473
mov ecx, dword [0x4fc948]
call fcn.0040737b
mov ecx, dword [0x4fc944]
call fcn.0040c5d0
mov ecx, dword [0x4fc950]
call fcn.0043ce7e
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push ebx
push dword [0x4fa548]
call esi
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call edi
push 2
push dword [0x4fa548]
mov dword [ebp - 8], eax
call esi
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x9cae
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
xor edi, edi
push 0x401
push edi
push dword [ebp - 4]
call esi
inc edi
cmp edi, 0xe
jl 0x42f6de
push dword [0x4f9ee0]
push dword [0x4f9f4c]
push dword [0x4fa444]
push dword [0x4f9970]
push str.Host_Controllers:__i____Root_Hubs:__i____Standard_Hubs:__i____Peripheral_Devices:__i
push ebx
push ebx
push dword [0x4fac78]
call fcn.00405605
add esp, 0x20
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x453b08
push ebx
push 1
push dword [0x4fac78]
call fcn.00405605
add esp, 0x14
xor eax, eax
pop edi
inc eax
pop esi
jmp 0x42f74b
mov dword [0x4fa508], ebx
xor eax, eax
pop ebx
leave
ret 4
Function at 0x42f843
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor edi, edi
push edi
push edi
push 0xce
push dword [0x4fa554]
call esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x4dd
push dword [0x4fa554]
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xb0
push dword [0x4fa554]
call esi
push edi
push edi
push 0xb
push dword [0x4fa554]
call esi
mov ebx, 0x4fb720
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x4fa440]
push 0xffffffffffffffff
push edi
push dword [0x4fa554]
cmp eax, 2
jae 0x42f8c6
call fcn.004268bc
jmp 0x42f9eb
call fcn.004268bc
push dword [0x4fa554]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x42f9eb
xor eax, eax
push 0x7fe
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82a]
push edi
push eax
call fcn.0043f4d8
mov edi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f698
add esp, 0x10
inc edi
push edi
push eax
push dword [0x4fa554]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
push dword [ebp - 4]
jmp 0x42f9cf
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 4]
push ebx
sar edi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push dword [0x4fa554]
add eax, edi
mov dword [ebp - 0x14], eax
call fcn.00426849
push 0
push edi
push 0xc9
push dword [0x4fa554]
mov dword [ebp - 0x1c], eax
call esi
lea ecx, [ebp - 0x82c]
push ecx
push eax
push 0xc4
push dword [0x4fa554]
mov dword [ebp - 0x82c], 0x3ff
call esi
cmp eax, 1
jle 0x42f9c7
push 0x3a
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ecx, eax
lea edx, [ebp - 0x82c]
sub eax, edx
sar eax, 1
neg ecx
sbb ecx, ecx
and ecx, eax
cmp dword [ebp - 0x1c], ecx
jle 0x42f9c7
push dword [0x492a3c]
push dword [ebp - 0x14]
push edi
push dword [0x4fa554]
call fcn.004268bc
mov eax, dword [ebp - 8]
push ebx
add eax, 2
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x42f935
push dword [ebp - 4]
call fcn.0043f70d
pop ecx
xor edi, edi
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0xb1
push dword [0x4fa554]
call esi
push edi
push edi
push 0xce
push dword [0x4fa554]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
je 0x42fa25
sub ecx, eax
push ecx
push edi
push 0xb6
push dword [0x4fa554]
call esi
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x4dd
push dword [0x4fa554]
call esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], eax
je 0x42fa57
movzx eax, ax
push edi
shl eax, 0x10
or eax, 4
push eax
push 0x114
push dword [0x4fa554]
call esi
push edi
push 1
push 0xb
push dword [0x4fa554]
call esi
push 5
push edi
push edi
push dword [0x4fa554]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4331c5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push str.Generischer_USB_Hub
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4331e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 8]
push 4
pop ebx
cmp dword [0x506fb4], ebx
jl 0x433242
mov eax, edi
test edi, edi
jne 0x433201
mov eax, 0x449a38
lea ecx, [esi + 0xcf6]
push ecx
push eax
push dword [esi + 0x81c]
push str.ChangeLeaf_name_s__text_s______s
push ebx
call fcn.004452a3
add esp, 0x14
cmp dword [0x506fb4], ebx
jl 0x433242
push dword [esi + 8]
push dword [0x4fa550]
call fcn.0042fc7a
push eax
push str._currenttext_s
push ebx
call fcn.004452a3
add esp, 0xc
push dword [esi + 8]
push dword [0x4fa550]
call fcn.004266af
test eax, eax
jne 0x43326d
cmp dword [0x506fb4], ebx
jl 0x43334d
push dword [esi + 8]
push str._0x_08Ix_is_not_a_tree_item____abort
jmp 0x433344
push 0x34
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.0043f4d8
mov eax, dword [esi + 8]
mov dword [ebp - 0x34], eax
xor eax, eax
add esp, 0xc
test edi, edi
setne al
push esi
mov dword [ebp - 0x28], edi
or eax, 0x22
mov dword [ebp - 0x38], eax
call fcn.00432bdc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
push eax
xor esi, esi
push esi
push 0x113f
push dword [0x4fa550]
mov dword [0x4fa528], esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x433330
push dword [0x4fa550]
mov dword [0x4fa528], esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 0x34]
cmp eax, dword [0x4fac6c]
jne 0x43332b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x505f48]
cmp eax, 0xbb8
jae 0x43330d
push 0x414521
push 0xa
push 0x12340005
push dword [0x4fa548]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x433324
push dword [0x4fac6c]
push dword [0x4fa550]
push dword [0x4fa554]
call fcn.004143c5
call esi
mov dword [0x505f48], eax
xor eax, eax
inc eax
jmp 0x43334f
cmp dword [0x506fb4], ebx
jl 0x43334d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TreeView_SetItem_err_u
push ebx
call fcn.004452a3
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43365a
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ed07
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push edi
push eax
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push edi
push eax
call fcn.0043f4d8
add esp, 0x24
push 0x4f9c98
mov esi, 0x104
push esi
lea eax, [ebp - 0x410]
push eax
push 0x449d24
mov ebx, str.ReportPath
push ebx
mov edi, 0x44d6b4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00426112
test eax, eax
je 0x433762
lea eax, [ebp - 0x208]
push eax
call fcn.0042f4eb
mov esi, eax
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004283a5
push 0x4f9c98
lea eax, [ebp - 0x208]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042ed07
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
jmp 0x43374a
Function at 0x435eac
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ed07
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.0043f4d8
push 0x4f9988
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x4f9c98
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x449d24
mov ebx, str.ReportPath
push ebx
mov edi, 0x44d6b4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00425f9e
test eax, eax
je 0x435fd6
push dword [0x4fa548]
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x20c]
push eax
call fcn.00435dfd
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x435fd6
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x435fd6
xor ecx, ecx
push 0x4f9c98
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042ed07
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435fef
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ed07
push dword [0x4fac6c]
call fcn.0042ebfb
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x436039
push 0x40
push 0x44d65c
push str.No_device_selected
push dword [0x4fa548]
call fcn.00446914
jmp 0x436218
push ebx
push esi
xor eax, eax
push 0x7fe
mov word [ebp - 0xc18], ax
lea eax, [ebp - 0xc16]
push edi
push eax
call fcn.0043f4d8
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.0043f4d8
add esp, 0x24
push 0x4f9c98
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x449d24
push str.DevReportPath
mov ebx, 0x44d6b4
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x418], di
je 0x4360e0
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.00424973
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xfc0]
cmp eax, edi
je 0x436101
lea ecx, [eax + 0x1734]
cmp word [ecx], di
jne 0x4360fe
lea ecx, [eax + 0x1834]
push ecx
jmp 0x436107
push dword [ecx + 0x81c]
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x20
lea eax, [ebp - 0xc18]
push eax
call fcn.0042676c
push str..txt
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xc18]
push eax
call fcn.00425f9e
test eax, eax
je 0x436206
cmp dword [0x4fa508], edi
jne 0x436168
push edi
push fcn.00414290
push dword [0x4fac6c]
call fcn.0042e943
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [0x4fac6c]
mov dword [ebp - 4], edi
call fcn.00433f5c
mov esi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f698
pop ecx
push edi
xor ecx, ecx
mov dword [0x4fc9c0], eax
mov word [eax], cx
push 0x42f425
push dword [0x4fac6c]
mov dword [0x4fc9c4], esi
call fcn.0042e943
lea eax, [ebp - 0xc18]
push eax
call fcn.0040cb13
push dword [0x4fc9c0]
call fcn.0043f70d
pop ecx
lea eax, [ebp - 0xc18]
push eax
mov dword [0x4fc9c0], edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
je 0x436206
xor ecx, ecx
push 0x4f9c98
mov word [eax], cx
lea eax, [ebp - 0xc18]
push eax
push str.DevReportPath
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push edi
push 0x7f00
call fcn.0042ed07
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4363cf
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ed07
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.0043f4d8
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.0043f4d8
push 0x4f9988
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.xml
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x4f9c98
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x449d24
mov ebx, str.ReportPath
push ebx
mov edi, 0x44d6b4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00426058
test eax, eax
je 0x43650f
push dword [0x4fa548]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0040c8ef
push 0
call fcn.0040c92d
lea eax, [ebp - 0x20c]
push eax
call fcn.0043621b
mov dword [ebp - 4], eax
call fcn.0040c96d
call fcn.0040c90e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x43650f
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x43650f
xor ecx, ecx
push 0x4f9c98
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042ed07
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret