joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043f4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x404419
xor eax, eax
jmp 0x40445e
test byte [ebp - 0x144], 0x10
je 0x404441
mov eax, 1
jmp 0x40445e
test byte [ebp - 0x144], 0x10
je 0x404441
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
mov eax, 1
jmp 0x40445e
lea edx, [ebp - 0x144]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x404429
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404c08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, 0x32
cmp eax, edx
jb 0x404c14
pop ecx
pop ebp
ret

Function at 0x404d08
Capabilities:
Check for time delay via gettickcount
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
cmp dword [ebp + 8], 0
jne 0x404d1f
call sub.USER32.DLL_GetFocus
mov dword [ebp + 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [0x454c90], 0
jne 0x404ddb
mov dword [0x454c90], 1
mov dword [ebp - 0x10], 1
xor edx, edx
mov dword [0x454c8c], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x404d93
push 0xc7
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 4]
call sub.USER32.DLL_GetClassNameA
mov byte [ebp - 0x11], 0
push str.PcDocWClass
lea edx, [ebp - 0xd8]
push edx
call fcn.00444310
add esp, 8
test eax, eax
je 0x404d93
push dword [ebp - 4]
call sub.USER32.DLL_GetParent
mov dword [ebp - 4], eax
jmp 0x404d50
cmp dword [ebp - 4], 0
je 0x404da5
push dword [ebp - 4]
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x404ddb
push 0xc7
push dword [ebp + 0xc]
push 0xf55bcc
call fcn.004046f8
add esp, 0xc
xor ecx, ecx
mov dword [0x454c88], ecx
push 0
push 0
push 0
push 0x404ca8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x454c8c], eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
je 0x404e54
cmp dword [0x454c8c], 0
je 0x404e4c
mov dword [0x454c88], 1
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
jmp 0x404e1e
push 0x1f4
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0xc]
cmp eax, 0x1388
jge 0x404e36
cmp dword [0x454c8c], 0
jne 0x404e14
cmp dword [0x454c8c], 0
je 0x404e4c
push 0
push dword [0x454c8c]
call sub.KERNEL32.DLL_TerminateThread
xor edx, edx
mov dword [0x454c90], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x405048
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x9e3779b9
mov byte [ebp - 0x11], 0x20
jmp 0x4050c9
mov cl, byte [ebp - 0xc]
and cl, 3
movsx eax, cl
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + eax*4]
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
shl eax, 4
mov edx, dword [ebp - 8]
shr edx, 5
xor eax, edx
add eax, dword [ebp - 8]
xor ecx, eax
add dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
shr eax, 0xb
and al, 3
movsx edx, al
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + edx*4]
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
shl edx, 4
mov ecx, dword [ebp - 4]
shr ecx, 5
xor edx, ecx
add edx, dword [ebp - 4]
xor eax, edx
add dword [ebp - 8], eax
mov al, byte [ebp - 0x11]
add byte [ebp - 0x11], 0xff
test al, al
jg 0x405071
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret

Function at 0x4050ec
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xc6ef3720
mov dword [ebp - 0x10], 0x9e3779b9
mov byte [ebp - 0x11], 0x20
jmp 0x405170
mov edx, dword [ebp - 0xc]
shr edx, 0xb
and dl, 3
movsx ecx, dl
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + ecx*4]
add edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
shl ecx, 4
mov eax, dword [ebp - 4]
shr eax, 5
xor ecx, eax
add ecx, dword [ebp - 4]
xor edx, ecx
sub dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
sub dword [ebp - 0xc], edx
mov cl, byte [ebp - 0xc]
and cl, 3
movsx eax, cl
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + eax*4]
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
shl eax, 4
mov edx, dword [ebp - 8]
shr edx, 5
xor eax, edx
add eax, dword [ebp - 8]
xor ecx, eax
sub dword [ebp - 4], ecx
mov cl, byte [ebp - 0x11]
add byte [ebp - 0x11], 0xff
test cl, cl
jg 0x405117
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x405190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jge 0x4051ca
mov ecx, dword [0x454c94]
add ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 4]
and ecx, 0xf
mov al, byte [ecx + 0x454c98]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor byte [ecx + edx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jl 0x4051a1
pop ecx
pop ebp
ret
Function at 0x4087ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
lea eax, [ebp - 0xf0]
push eax
push 0xef
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
lea edx, [ebp - 0xf0]
push edx
call sub.KERNEL32.DLL_GetTempFileNameA
mov esp, ebp
pop ebp
ret
Function at 0x40b5b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
call fcn.0042c014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b5df
push str.SECUSTAR_STATICDATA_TO_XML
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
test eax, eax
jne 0x40b60c
cmp dword [ebp - 4], 0
je 0x40b5ed
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x45e97c
push 0x453511
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x40b7dd
push 0x468fd5
lea edx, [ebp - 0x118]
push edx
call fcn.0044435c
add esp, 8
push str.SecuStar_send.XML
lea ecx, [ebp - 0x118]
push ecx
call fcn.00444280
add esp, 8
push 0
push 0
push 1
push 0x452f53
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call fcn.00412074
add esp, 0x18
cmp byte [ebp - 0x118], 0
je 0x40b7dd
push 0x468af8
lea edx, [ebp - 0x220]
push edx
call fcn.0044435c
add esp, 8
push str.0701_0702KaDrFeSt_Z745Y.xml
lea ecx, [ebp - 0x220]
push ecx
call fcn.00444280
add esp, 8
jmp 0x40b6e9
push str.Bitte
push 0x41
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x40b6b3
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
jmp 0x40b7dd
push 0x468fd5
lea eax, [ebp - 0x220]
push eax
call fcn.0044435c
add esp, 8
push 0
push 0x452f53
lea edx, [ebp - 0x220]
push edx
push dword [ebp + 8]
call fcn.00411ee8
add esp, 0x10
cmp byte [ebp - 0x220], 0
je 0x40b688
push 0x459ac3
lea ecx, [ebp - 0x220]
push ecx
call fcn.004463c0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40b727
lea eax, [ebp - 0x220]
push eax
push 0x459ac6
push 0x30
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x40b688
push dword [ebp - 0x10]
call fcn.00445c04
pop ecx
push dword [ebp + 0x10]
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x118]
push ecx
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2710
jne 0x40b782
push 0xffffffffffffffff
lea eax, [ebp - 0x220]
push eax
push 0x459af1
push 0x30
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x14
lea edx, [ebp - 0x118]
push edx
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x40b688
cmp dword [ebp - 0xc], 0
jle 0x40b7ae
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
lea ecx, [ebp - 0x118]
push ecx
push 0x459b15
push 0x40
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x40b7dd
cmp dword [ebp - 0xc], 0
jne 0x40b7dd
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x459b3f
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov esp, ebp
pop ebp
ret
Function at 0x40b7e4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
call fcn.0042c014
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b80f
push str.SECUTEST4_STATICDATA_TO_XML
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
test eax, eax
jne 0x40b839
cmp dword [ebp - 4], 0
je 0x40b81d
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x45e97c
push 0x453511
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
jmp 0x40b8af
push 0x468fd5
lea edx, [ebp - 0x118]
push edx
call fcn.0044435c
add esp, 8
push 0
push dword [ebp + 0x10]
lea ecx, [ebp - 0x118]
push ecx
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [ebp - 0xc], 0
jle 0x40b888
push 1
push 5
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call fcn.0042bde0
add esp, 0x10
jmp 0x40b8af
cmp dword [ebp - 0xc], 0
jne 0x40b8af
push str.Keine_Daten_gespeichert.
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call sub.KERNEL32.DLL_DeleteFileA
mov esp, ebp
pop ebp
ret
Function at 0x40d15c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
sub edx, 2
je 0x40d37d
sub edx, 0x10e
je 0x40d187
dec edx
je 0x40d2fd
jmp 0x40d385
push 0
call fcn.0040d0c4
pop ecx
cmp dword [0x452900], 0
jg 0x40d201
push str.Keine_COM_ist_vorhanden.
push 0x10
push dword [ebp + 8]
call fcn.00411b5c
add esp, 0xc
push 0x2775
push 0x2776
push 0x2775
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
push 0
push 0x2776
push dword [ebp + 8]
call fcn.0041d6b0
add esp, 0xc
push 0
push 0x4b3
push dword [ebp + 8]
call fcn.0041d6b0
add esp, 0xc
push 0x2775
push 0x2776
push 0x2775
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
jmp 0x40d2b0
push str.AUTO
push 0
push 0x180
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40d277
mov edx, dword [ebp - 8]
mov ecx, dword [edx*4 + 0x4686f8]
inc ecx
push ecx
push 0x459efd
lea eax, [ebp - 0x4c]
push eax
call fcn.00447d04
add esp, 0xc
lea edx, [ebp - 0x4c]
push edx
push 0
push 0x180
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4686f8]
cmp eax, dword [0x453108]
jne 0x40d274
mov edx, dword [ebp - 8]
inc edx
mov dword [ebp - 0xc], edx
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x452900]
jl 0x40d226
push 0
push dword [ebp - 0xc]
push 0x186
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
push 0x2776
push 0x2776
push 0x2775
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
push 0x2777
push 0x2778
push 0x2777
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
push 0
push 0x2777
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
push 0
push 0x2778
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
mov dword [ebp - 4], 1
jmp 0x40d385
mov ax, word [ebp + 0x10]
and ax, 0xffff
cmp ax, 0x2775
je 0x40d339
mov dx, word [ebp + 0x10]
and dx, 0xffff
cmp dx, 0x2776
je 0x40d339
mov cx, word [ebp + 0x10]
and cx, 0xffff
cmp cx, 0x2777
je 0x40d339
mov ax, word [ebp + 0x10]
and ax, 0xffff
cmp ax, 0x2778
jne 0x40d385
push 0x2776
push dword [0x46db50]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x40d361
push 0x2778
push dword [0x46db50]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x40d365
xor edx, edx
jmp 0x40d36a
mov edx, 1
push edx
push 0x4b3
push dword [ebp + 8]
call fcn.0041d6b0
add esp, 0xc
jmp 0x40d385
xor ecx, ecx
mov dword [0x46db50], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d6e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x459f03
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jb 0x40d713
mov eax, 1
jmp 0x40d784
push 0x459f08
push dword [ebp + 0xc]
push 0x45379c
lea edx, [ebp - 0x20c]
push edx
call fcn.00447d04
add esp, 0x10
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0044438c
pop ecx
mov edx, 0x208
sub edx, eax
dec edx
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.0044438c
pop ecx
lea ecx, [ebp - 0x20c]
add eax, ecx
push eax
push 0
push dword [ebp - 4]
push 0
push 0x1000
call sub.KERNEL32.DLL_FormatMessageA
lea eax, [ebp - 0x20c]
push eax
push 0x30
push dword [ebp + 8]
call fcn.00411b5c
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x417834
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
cmp dword [0x4529a8], 0
je 0x417998
cmp dword [0x4529ac], 0
je 0x417998
push 0x45a542
push 0x24
push dword [ebp + 8]
call fcn.00411b5c
add esp, 0xc
cmp eax, 6
jne 0x417998
push 0x469901
lea eax, [ebp - 0x110]
push eax
call fcn.0044435c
add esp, 8
push 1
push 0x452f9c
push 1
push 0x46da81
lea edx, [ebp - 0x110]
push edx
push dword [ebp + 8]
call fcn.00412074
add esp, 0x18
cmp byte [ebp - 0x110], 0
je 0x417857
push 1
push 0x45a57c
push 0x4569a0
call fcn.004051d0
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
jne 0x4178f5
cmp dword [ebp - 8], 0
je 0x4178d9
push dword [ebp - 8]
call fcn.00445c04
pop ecx
push 0x4569a0
push 0x45353c
push 0x30
push dword [ebp + 8]
call fcn.00411b5c
add esp, 0x10
jmp 0x417857
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x41791d
push dword [ebp - 8]
push 1
push 1
mov ecx, dword [0x4529a8]
add ecx, dword [ebp - 4]
push ecx
call fcn.00405260
add esp, 0x10
cmp eax, 1
jne 0x4178ca
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x4529b0]
jl 0x4178fc
push dword [ebp - 8]
call fcn.00445c04
pop ecx
push 0
lea edx, [ebp - 0x110]
push edx
push 0x4569a0
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x41797a
lea ecx, [ebp - 0x110]
push ecx
push 0x45353c
push 0x30
push dword [ebp + 8]
call fcn.00411b5c
add esp, 0x10
push 0x4569a0
push str.Daten_werden_in_der_Datei__s_gespeichert.
push 0x40
push dword [ebp + 8]
call fcn.00411b5c
add esp, 0x10
jmp 0x417998
push 0x4569a0
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x110]
push eax
push 0x469901
call fcn.0044435c
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4181c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x45294c], 0
je 0x41826e
push dword [0x45294c]
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x41826e
push str.PCDW.pps
push 0x468af8
call fcn.00404370
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41826e
push dword [ebp - 4]
call fcn.00404664
pop ecx
test eax, eax
jne 0x41822c
push str.PCDW.pps
push 0x453511
push 0x40
push dword [0x45294c]
call fcn.00411b5c
add esp, 0x10
jmp 0x418265
push 1
push 0
push 0
push dword [ebp - 4]
push 0x45a5ab
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jg 0x418265
push 0x45a5b0
push str.PCDW.pps
push 0x45379c
push 0x40
push dword [0x45294c]
call fcn.00411b5c
add esp, 0x14
push dword [ebp - 4]
call fcn.00443384
pop ecx
pop ecx
pop ebp
ret
Function at 0x4190f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff1c
cmp dword [ebp + 8], 0
jne 0x41910e
xor eax, eax
jmp 0x419296
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 8]
push ecx
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_ClearCommError
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x18]
jae 0x41912d
mov ecx, dword [ebp + 0x10]
jmp 0x419130
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x419140
xor eax, eax
jmp 0x419296
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x41925c
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
jne 0x419203
jmp 0x4191e2
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e4
je 0x4191e2
push 0
push 0xc7
lea ecx, [ebp - 0xe4]
push ecx
push 0
push dword [ebp - 0xc]
push 0
push 0x1000
call sub.KERNEL32.DLL_FormatMessageA
lea eax, [ebp - 0xe4]
push eax
push dword [ebp - 0xc]
push str.Rd_rdError01__0x_08X__s_r_n
call fcn.00403934
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 8]
push ecx
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_ClearCommError
push 0xf
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_PurgeComm
or eax, 0xffffffff
jmp 0x419296
push 1
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
je 0x419175
jmp 0x41925c
push 0
push 0xc7
lea edx, [ebp - 0xe4]
push edx
push 0
push dword [ebp - 0xc]
push 0
push 0x1000
call sub.KERNEL32.DLL_FormatMessageA
lea ecx, [ebp - 0xe4]
push ecx
push dword [ebp - 0xc]
push str.Rd_rdError02__0x_08X__s_r_n
call fcn.00403934
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
push dword [ecx]
call sub.KERNEL32.DLL_ClearCommError
push 0xf
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_PurgeComm
or eax, 0xffffffff
jmp 0x419296
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x41928b
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [ecx + eax]
push edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [ecx + eax]
push edx
push str.Rd__c_0x_02X_OK_r_n
call fcn.00403934
add esp, 0xc
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
jl 0x419263
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41b0f8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcfc
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x41b1c8
lea ecx, [ebp - 4]
push ecx
push 0
push 0x80000000
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x41b1c5
xor eax, eax
mov dword [0x186ff88], eax
jmp 0x41b19b
lea edx, [ebp - 0x10c]
push edx
imul ecx, dword [ebp - 0xc], 0x136
add ecx, 0xf480a7
push ecx
call fcn.00444310
add esp, 8
test eax, eax
jne 0x41b195
mov dword [ebp - 8], 0xfa
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x304]
push edx
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
jne 0x41b195
lea eax, [ebp - 0x304]
push eax
push 0
push 0x180
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
inc dword [ebp - 0x10]
inc dword [0x186ff88]
push 0xfa
lea edx, [ebp - 0x10c]
push edx
push dword [0x186ff88]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x41b131
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
inc dword [ebp - 0xc]
movsx ecx, byte [0xf480a6]
cmp ecx, dword [ebp - 0xc]
jg 0x41b110
cmp dword [ebp - 0x10], 0
jne 0x41b1e5
mov byte [0xf480a6], 0
mov esp, ebp
pop ebp
ret
Function at 0x41b650
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc4
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
dec edx
je 0x41b778
dec edx
je 0x41b77f
sub edx, 0x111
jne 0x41b7af
push dword [0x186fef4]
call fcn.0041bf4c
pop ecx
mov dword [ebp - 0x10], eax
push dword [0x186fef4]
call fcn.0041b7f0
pop ecx
test eax, eax
jne 0x41b6ad
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x45a8b8], eax
jmp 0x41b6d2
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [0x45a8b8]
cmp eax, 0x2710
jbe 0x41b7b4
mov dword [0x45a8c4], 1
jmp 0x41b7b4
mov ecx, dword [0x186feec]
sub ecx, 1
jb 0x41b7b4
je 0x41b6eb
dec ecx
je 0x41b764
jmp 0x41b7b4
xor eax, eax
mov dword [0x186feec], eax
cmp dword [0x45a8c8], 0
je 0x41b758
push 0x67d974
call fcn.0044a94c
pop ecx
push 0x67d974
push 0x678829
lea edx, [ebp - 0x33c]
push edx
call fcn.00447d04
add esp, 0xc
lea ecx, [ebp - 0x33c]
push ecx
push dword [ebp - 0x10]
push dword [0x186fef4]
call fcn.0041bb68
add esp, 0xc
cmp dword [0x45a8c4], 0
jne 0x41b758
push dword [ebp - 0x10]
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_BringWindowToTop
mov dword [0x186fee8], 1
mov dword [0x186feec], 2
jmp 0x41b7b4
xor eax, eax
mov dword [0x186feec], eax
push dword [0x186fef0]
call sub.USER32.DLL_DestroyWindow
jmp 0x41b7b4
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x41b7b4
push dword [0x186fef0]
push dword [0x186fef0]
call sub.USER32.DLL_KillTimer
mov dword [0x45a8c0], 1
call fcn.0041bd64
cmp dword [0x186fee8], 0
jne 0x41b7b4
call fcn.0041a794
jmp 0x41b7b4
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x41b7bf
mov eax, dword [ebp - 8]
jmp 0x41b7d0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.DLL_DefWindowProcA
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41d9cc
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00404664
pop ecx
test eax, eax
je 0x41da1e
push 0x80
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x41da02
push dword [ebp + 8]
call fcn.00404664
pop ecx
test eax, eax
je 0x41da1e
push dword [ebp + 8]
push 0x45b7c7
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.00411b5c
add esp, 0x10
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret
Function at 0x41ed60
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffad4
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.0044435c
add esp, 8
lea edx, [ebp - 0x210]
push edx
call fcn.0044438c
pop ecx
cmp eax, 1
jbe 0x41edbb
lea ecx, [ebp - 0x210]
push ecx
call fcn.0044438c
pop ecx
movsx eax, byte [ebp + eax - 0x211]
cmp eax, 0x5c
je 0x41edbb
push 0x45c1db
lea edx, [ebp - 0x210]
push edx
call fcn.00444280
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call fcn.0044438c
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x210]
push eax
lea edx, [ebp - 0x418]
push edx
call fcn.0044435c
add esp, 8
push dword [ebp + 0xc]
lea ecx, [ebp - 0x210]
add ecx, dword [ebp - 8]
push ecx
call fcn.0044435c
add esp, 8
push 0
lea eax, [ebp - 0x52c]
push eax
lea edx, [ebp - 0x210]
push edx
call fcn.00445ecc
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41ee82
test byte [ebp - 0x524], 0x10
jne 0x41ee6c
lea ecx, [ebp - 0x51c]
push ecx
lea eax, [ebp - 0x418]
add eax, dword [ebp - 8]
push eax
call fcn.0044435c
add esp, 8
push 0x80
lea edx, [ebp - 0x418]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
lea ecx, [ebp - 0x418]
push ecx
call fcn.0041d9cc
pop ecx
test eax, eax
jne 0x41ee6c
lea eax, [ebp - 0x52c]
push eax
call fcn.00445f90
pop ecx
xor eax, eax
jmp 0x41ee94
lea edx, [ebp - 0x52c]
push edx
call fcn.00446024
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41ee17
lea ecx, [ebp - 0x52c]
push ecx
call fcn.00445f90
pop ecx
mov eax, 1
mov esp, ebp
pop ebp
ret