joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f584
Capabilities:
Delete directory
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffad0
push dword [ebp + 8]
lea eax, [ebp - 0x328]
push eax
call fcn.004415c8
add esp, 8
lea edx, [ebp - 0x328]
push edx
call fcn.004045c0
pop ecx
lea ecx, [ebp - 0x328]
push ecx
call fcn.004415f8
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jl 0x41f5cb
cmp dword [ebp - 8], 0xfa
jle 0x41f5d2
xor eax, eax
jmp 0x41f7ad
push dword [ebp + 0xc]
lea edx, [ebp - 0x530]
push edx
call fcn.004415c8
add esp, 8
lea ecx, [ebp - 0x530]
push ecx
call fcn.004045c0
pop ecx
lea eax, [ebp - 0x530]
push eax
call fcn.004415f8
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jl 0x41f610
cmp dword [ebp - 0xc], 0xfa
jle 0x41f617
xor eax, eax
jmp 0x41f7ad
mov edx, dword [ebp - 0xc]
mov byte [ebp + edx - 0x531], 0
lea ecx, [ebp - 0x530]
push ecx
call fcn.0040444c
pop ecx
test eax, eax
jne 0x41f63a
xor eax, eax
jmp 0x41f7ad
mov edx, dword [ebp - 0xc]
mov byte [ebp + edx - 0x531], 0x5c
push 0x459670
lea ecx, [ebp - 0x328]
add ecx, dword [ebp - 8]
push ecx
call fcn.004415c8
add esp, 8
push 0
lea eax, [ebp - 0x120]
push eax
lea edx, [ebp - 0x328]
push edx
call fcn.00443138
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f76b
movsx ecx, byte [ebp - 0x110]
cmp ecx, 0x2e
je 0x41f751
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x328]
add edx, dword [ebp - 8]
push edx
call fcn.004415c8
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
lea eax, [ebp - 0x530]
add eax, dword [ebp - 0xc]
push eax
call fcn.004415c8
add esp, 8
test byte [ebp - 0x118], 0x10
je 0x41f6fa
lea edx, [ebp - 0x530]
push edx
lea ecx, [ebp - 0x328]
push ecx
call fcn.0041f584
add esp, 8
test eax, eax
jne 0x41f751
lea eax, [ebp - 0x120]
push eax
call fcn.004431fc
pop ecx
xor eax, eax
jmp 0x41f7ad
push 0x80
lea edx, [ebp - 0x328]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
lea ecx, [ebp - 0x328]
push ecx
call fcn.0040464c
pop ecx
test eax, eax
je 0x41f73a
push 0x80
lea eax, [ebp - 0x530]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea edx, [ebp - 0x530]
push edx
call fcn.0041ce88
pop ecx
lea ecx, [ebp - 0x530]
push ecx
lea eax, [ebp - 0x328]
push eax
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je 0x41f6e6
lea edx, [ebp - 0x120]
push edx
call fcn.00443290
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41f681
lea ecx, [ebp - 0x120]
push ecx
call fcn.004431fc
pop ecx
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x329], 0
push 0x80
lea edx, [ebp - 0x328]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
lea ecx, [ebp - 0x328]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
je 0x41f7ab
mov eax, 1
jmp 0x41f7ad
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41ff90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x41ffcf
test byte [ebp - 0x5f], 0x80
je 0x41ffcf
test byte [ebp - 0x5d], 0x80
je 0x41ffcf
push 0
call fcn.0041fb20
pop ecx
test eax, eax
je 0x41ffc8
mov eax, 1
jmp 0x41ffd1
call fcn.0041ff20
jmp 0x41ffd1
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4206c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
mov dword [ebp - 0x18], 8
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x4206f1
xor eax, eax
jmp 0x420789
cmp dword [ebp - 0xa8], 3
ja 0x42070c
cmp dword [ebp - 0xa8], 3
jne 0x420778
cmp dword [ebp - 0xa4], 0x33
jbe 0x420778
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_Messaging_Subsystem
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420774
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
push edx
push 0
push 0x459ab4
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 4], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 4], 0
jne 0x420774
push 0x459ab9
lea ecx, [ebp - 0x10]
push ecx
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
jne 0x420774
mov eax, 1
jmp 0x420789
xor eax, eax
jmp 0x420789
push 0
push str.MAPI
push str.Mail
call sub.KERNEL32.DLL_GetProfileIntA
mov esp, ebp
pop ebp
ret
Function at 0x428d08
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [ebp + 8], 5
jne 0x428d4f
push 1
push dword [0x44f8dc]
call sub.USER32.DLL_EnableWindow
push 1
push dword [ebp + 0xc]
call sub.USER32.DLL_EnableWindow
cmp dword [0x45b0a4], 0
je 0x428ef8
push dword [0x45b0a4]
call sub.USER32.DLL_DestroyWindow
xor eax, eax
mov dword [0x45b0a4], eax
jmp 0x428ef8
xor edx, edx
mov dword [0x45b0a8], edx
cmp dword [ebp + 8], 2
jne 0x428d8b
mov dword [0x45b0b4], 1
push 0
push sym.htpwrdoc.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x4e0
push dword [0x44f8e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45b0a4], eax
jmp 0x428e38
cmp dword [ebp + 8], 3
jne 0x428dbc
mov dword [0x45b0b4], 3
push 0
push sym.htpwrdoc.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x1772
push dword [0x44f8e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45b0a4], eax
jmp 0x428e38
cmp dword [ebp + 8], 4
jne 0x428ded
mov dword [0x45b0b4], 4
push 0
push sym.htpwrdoc.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x1772
push dword [0x44f8e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45b0a4], eax
jmp 0x428e38
cmp dword [ebp + 8], 0
jne 0x428e0f
cmp dword [ebp + 0x10], 2
jne 0x428e05
mov dword [0x45b0b4], 5
jmp 0x428e19
xor ecx, ecx
mov dword [0x45b0b4], ecx
jmp 0x428e19
mov dword [0x45b0b4], 2
push 0
push sym.htpwrdoc.exe__InfPrcDlg_qqsp6HWND__uiuil
push dword [ebp + 0xc]
push 0x1770
push dword [0x44f8e0]
call sub.USER32.DLL_CreateDialogParamA
mov dword [0x45b0a4], eax
cmp dword [0x45b0a4], 0
je 0x428ee1
cmp dword [ebp + 8], 0
je 0x428e51
cmp dword [ebp + 8], 1
jne 0x428e79
cmp dword [ebp + 0x10], 0
je 0x428e69
push str.HT_Power_Test___Speicher_lesen
push dword [0x45b0a4]
call sub.USER32.DLL_SetWindowTextA
jmp 0x428e79
push 0x45e404
push dword [0x45b0a4]
call sub.USER32.DLL_SetWindowTextA
lea eax, [ebp - 0x10]
push eax
push dword [0x45b0a4]
call sub.USER32.DLL_GetWindowRect
push 5
push 0
push 0
push 0x3e
call sub.USER32.DLL_GetSystemMetrics
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
sub eax, edx
sar eax, 1
jns 0x428ea4
adc eax, 0
push eax
push 0x3d
call sub.USER32.DLL_GetSystemMetrics
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
sub eax, ecx
sar eax, 1
jns 0x428ebb
adc eax, 0
push eax
push 0
push dword [0x45b0a4]
call sub.USER32.DLL_SetWindowPos
push 5
push dword [0x45b0a4]
call sub.USER32.DLL_ShowWindow
push dword [0x45b0a4]
call sub.USER32.DLL_UpdateWindow
push 0
push dword [0x44f8dc]
call sub.USER32.DLL_EnableWindow
push 0
push dword [ebp + 0xc]
call sub.USER32.DLL_EnableWindow
mov esp, ebp
pop ebp
ret
Function at 0x429360
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
call fcn.00429594
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x429388
push 0x45e48e
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
test eax, eax
jne 0x4293a9
push str.XML_ETC
push str.Die_Datei__s_kann_nicht_ge
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x4293c5
push 0x4650c8
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4293d3
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x429b9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
cmp dword [ebp + 8], 0
jl 0x429bb1
cmp dword [ebp + 8], 0x100
jl 0x429bb8
xor eax, eax
jmp 0x429d51
push str.._
lea edx, [ebp - 0x34]
push edx
call fcn.004415c8
add esp, 8
mov ecx, dword [ebp + 8]
inc ecx
push ecx
push str.COM_d
lea eax, [ebp - 0x34]
push eax
call fcn.004415f8
pop ecx
lea edx, [ebp - 0x34]
add eax, edx
push eax
call fcn.00444f70
add esp, 0xc
push dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
push ecx
push str.ReadM5DeviceOpenComm____s___d__r_n
call fcn.0040391c
add esp, 0xc
push 0xc8
push 0x800
lea eax, [ebp - 0x34]
push eax
call fcn.0043fb90
mov dword [0x45c3d4], eax
test eax, eax
je 0x429d3c
push str.ReadM5DeviceOpenComm___OK_r_n
call fcn.0040391c
pop ecx
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [0x45c3d4]
push dword [ecx]
call sub.KERNEL32.DLL_GetCommState
mov byte [ebp - 0xe], 8
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
and byte [ebp - 0x18], 0xfb
and byte [ebp - 0x18], 0xf7
and byte [ebp - 0x18], 0xcf
and byte [ebp - 0x18], 0xbf
and byte [ebp - 0x17], 0xfe
and byte [ebp - 0x17], 0xfd
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
and byte [ebp - 0x17], 0xf7
mov word [ebp - 0x12], 0x32
mov word [ebp - 0x10], 0x1f4
or byte [ebp - 0x18], 1
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [0x45c3d4]
push dword [ecx]
call sub.KERNEL32.DLL_SetCommState
push 1
call fcn.00429b70
pop ecx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 4], eax
push 5
mov eax, dword [0x45c3d4]
push dword [eax]
call sub.KERNEL32.DLL_EscapeCommFunction
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x64
jb 0x429cb0
push 6
mov edx, dword [0x45c3d4]
push dword [edx]
call sub.KERNEL32.DLL_EscapeCommFunction
push 3
mov ecx, dword [0x45c3d4]
push dword [ecx]
call sub.KERNEL32.DLL_EscapeCommFunction
mov dword [0x45aff8], 0xffffffff
mov dword [0x45affc], 0xffffffff
mov dword [0x45b000], 0xffffffff
mov dword [0x45b004], 0xffffffff
mov dword [0x45b008], 0xffffffff
mov dword [0x45b00c], 0xffffffff
mov dword [0x45b010], 0xffffffff
mov dword [0x45b014], 0xffffffff
mov dword [0x45b018], 0xffffffff
mov eax, 1
jmp 0x429d51
push str.ReadM5DeviceOpenComm___ERR_r_n
call fcn.0040391c
pop ecx
xor edx, edx
mov dword [0x45c3d4], edx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x431fc4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
cmp dword [ebp + 8], 0
jl 0x43213e
cmp dword [ebp + 8], 3
jge 0x43213e
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x4650c8
lea edx, [ebp - 0x134]
push edx
call fcn.004415c8
add esp, 8
mov ecx, dword [ebp + 8]
push dword [ecx*4 + 0x45d628]
lea eax, [ebp - 0x134]
push eax
call fcn.004414ec
add esp, 8
push 0x460a38
lea edx, [ebp - 0x134]
push edx
call fcn.0044362c
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4320c4
push 2
push 0
push dword [ebp - 0x14]
call fcn.00443918
add esp, 0xc
push dword [ebp - 0x14]
call fcn.0044397c
pop ecx
mov dword [ebp - 0x18], eax
push 0
push 0
push dword [ebp - 0x14]
call fcn.00443918
add esp, 0xc
cmp dword [ebp - 0x18], 0x64
jle 0x4320bb
cmp dword [ebp - 0x18], 0x30d40
jge 0x4320bb
push dword [ebp - 0x18]
call fcn.0044065c
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4320bb
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x10]
call fcn.00443888
add esp, 0x10
cmp eax, dword [ebp - 0x18]
jne 0x4320ad
push 4
push str.RIFF
push dword [ebp - 0x10]
call fcn.004416c4
add esp, 0xc
test eax, eax
je 0x4320bb
push dword [ebp - 0x10]
call fcn.0044066c
pop ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push dword [ebp - 0x14]
call fcn.00442e70
pop ecx
cmp dword [ebp - 0x10], 0
je 0x4320df
push 6
push dword [ebp - 0x10]
call sub.WINMM.DLL_sndPlaySoundA
push dword [ebp - 0x10]
call fcn.0044066c
pop ecx
jmp 0x43213e
push 0x460a40
mov ax, word [ebp + 8]
add ax, 0x4e21
movzx edx, ax
push edx
push dword [0x44f8e0]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43213e
push dword [ebp - 4]
push dword [0x44f8e0]
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43213e
push dword [ebp - 8]
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x432136
push 6
push dword [ebp - 0xc]
call sub.WINMM.DLL_sndPlaySoundA
push dword [ebp - 8]
call sub.KERNEL32.DLL_FreeResource
mov esp, ebp
pop ebp
ret
Function at 0x433f24
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
sub edx, 0x110
je 0x433f47
dec edx
je 0x43405f
jmp 0x434121
push dword [ebp + 8]
call sub.USER32.DLL_GetParent
mov dword [0x187be9c], eax
cmp dword [0x450104], 1
jne 0x433f89
cmp dword [0x187be9c], 0
je 0x433f89
push dword [0x187be9c]
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x433f89
push 0xba4
push dword [0x187be9c]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
jne 0x433f9a
push 1
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
xor eax, eax
jmp 0x434124
cmp dword [0x187ab58], 0xfffffffe
je 0x433fb0
cmp dword [0x45aca4], 0
jle 0x433fb0
xor edx, edx
jmp 0x433fb5
mov edx, 1
mov dword [0x187bea0], edx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax*8 + 0x45b080]
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
push dword [0x187be9c]
call sub.USER32.DLL_IsDlgButtonChecked
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_CheckDlgButton
cmp dword [0x187bea0], 0
je 0x434004
push 0
push 2
push 0xf4
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x433fc0
cmp dword [0x187bea0], 0
je 0x43402a
push 0
push 2
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
jmp 0x434053
push 0x56a
push dword [0x187be9c]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x434053
push 0
push 0x186c
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
mov dword [ebp - 4], 1
jmp 0x434121
mov cx, word [ebp + 0x10]
and cx, 0xffff
cmp cx, 2
jne 0x434084
mov dword [ebp - 4], 1
push 1
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
jmp 0x434121
mov ax, word [ebp + 0x10]
and ax, 0xffff
cmp ax, 1
jne 0x434121
cmp dword [0x187bea0], 0
jne 0x43406e
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*8 + 0x45b080]
mov dword [ebp - 0x14], eax
mov ebx, 1
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
jne 0x4340c6
dec ebx
mov dword [ebp - 8], ebx
mov ebx, 1
push dword [ebp - 0x14]
push dword [0x187be9c]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
jne 0x4340e1
dec ebx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x434107
mov dword [0x187a7fc], 1
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [0x187be9c]
call sub.USER32.DLL_CheckDlgButton
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4340a4
mov dword [ebp - 4], 1
push 1
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4346c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x45c3d4], 0
jne 0x4346d6
xor eax, eax
jmp 0x43478a
push str.ReadM5DeviceOpenCheckMiele..._r_n
call fcn.0040391c
pop ecx
xor edx, edx
mov dword [ebp - 0xc], edx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 4], eax
jmp 0x43476a
push 1
lea ecx, [ebp - 5]
push ecx
call fcn.0043fbbc
dec eax
je 0x434708
push 0x64
call fcn.00404bf0
pop ecx
jmp 0x43476a
mov eax, dword [ebp - 0xc]
mov dl, byte [eax + 0x45d7f7]
cmp dl, byte [ebp - 5]
je 0x434740
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx + 0x45d7eb]
cmp al, byte [ebp - 5]
je 0x434740
mov edx, dword [ebp - 0xc]
mov cl, byte [edx + 0x45d7ef]
cmp cl, byte [ebp - 5]
je 0x434740
mov eax, dword [ebp - 0xc]
mov dl, byte [eax + 0x45d7f3]
cmp dl, byte [ebp - 5]
jne 0x434765
inc dword [ebp - 0xc]
push 0x45d7f7
call fcn.004415f8
pop ecx
cmp eax, dword [ebp - 0xc]
jne 0x43476a
push str.ReadM5DeviceOpenCheckMiele_FOUND_r_n
call fcn.0040391c
pop ecx
mov eax, 1
jmp 0x43478a
xor edx, edx
mov dword [ebp - 0xc], edx
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jb 0x4346f0
push str.ReadM5DeviceOpenCheckMiele___not_found___r_n
call fcn.0040391c
pop ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43f610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push 0xf0
lea eax, [ebp - 0x11c]
push eax
push dword [0x44f8e0]
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x11c]
push edx
call fcn.004416fd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43f653
mov ecx, dword [ebp - 4]
mov byte [ecx + 1], 0
jmp 0x43f667
push 0x461e84
lea eax, [ebp - 0x11c]
push eax
call fcn.004414ec
add esp, 8
push str.PCDOCWL1.DAT
lea edx, [ebp - 0x11c]
push edx
call fcn.004414ec
add esp, 8
push 0x461e86
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0044362c
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43f6b7
lea eax, [ebp - 0x11c]
push eax
push 0x450425
push 0x30
push 0
call fcn.0041124c
add esp, 0x10
xor eax, eax
jmp 0x43f774
mov dword [ebp - 8], 0x45bcfa
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor byte [eax + ecx], 0xaa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x230
jl 0x43f6c3
push dword [ebp - 0xc]
push 1
push 0x230
push 0x45bcfa
call fcn.00443888
add esp, 0x10
cmp eax, 1
jne 0x43f718
push dword [ebp - 0xc]
push 1
push 2
lea edx, [ebp - 0xe]
push edx
call fcn.00443888
add esp, 0x10
cmp eax, 1
jne 0x43f718
call fcn.0043f5dc
cmp ax, word [ebp - 0xe]
je 0x43f73d
push dword [ebp - 0xc]
call fcn.00442e70
pop ecx
lea ecx, [ebp - 0x11c]
push ecx
push 0x45050c
push 0x30
push 0
call fcn.0041124c
add esp, 0x10
xor eax, eax
jmp 0x43f774
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor byte [eax + ecx], 0xaa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x230
jl 0x43f742
push 0x230
push 0x45bcfa
push 0x45b6b0
call fcn.004413d8
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x43f778
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push 0xf0
lea eax, [ebp - 0x11c]
push eax
push dword [0x44f8e0]
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x11c]
push edx
call fcn.004416fd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43f7bb
mov ecx, dword [ebp - 4]
mov byte [ecx + 1], 0
jmp 0x43f7cf
push 0x461e89
lea eax, [ebp - 0x11c]
push eax
call fcn.004414ec
add esp, 8
push str.PCDOCWL1.DAT
lea edx, [ebp - 0x11c]
push edx
call fcn.004414ec
add esp, 8
push 0x461e8b
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0044362c
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43f820
lea eax, [ebp - 0x11c]
push eax
push 0x450450
push 0x30
push dword [ebp + 8]
call fcn.0041124c
add esp, 0x10
xor eax, eax
jmp 0x43f8c3
push 0x230
push 0x45b6b0
push 0x45bcfa
call fcn.004413d8
add esp, 0xc
mov dword [ebp - 0x14], 0x45bcfa
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
xor byte [ecx + eax], 0xaa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x230
jl 0x43f843
call fcn.0043f5dc
mov word [ebp - 0xa], ax
push dword [ebp - 8]
push 1
push 0x230
push 0x45bcfa
call fcn.00443ad0
add esp, 0x10
cmp eax, 1
jne 0x43f896
push dword [ebp - 8]
push 1
push 2
lea edx, [ebp - 0xa]
push edx
call fcn.00443ad0
add esp, 0x10
cmp eax, 1
je 0x43f8b1
push dword [ebp - 8]
call fcn.00442e70
pop ecx
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00442d38
pop ecx
jmp 0x43f800
push dword [ebp - 8]
call fcn.00442e70
pop ecx
test eax, eax
jne 0x43f89f
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4410a4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4425ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x442608
call fcn.00443e24
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x442623
test bl, 1
je 0x442623
mov dword [0x463db0], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4427d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4427ef
mov eax, dword [0x462a34]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4427fc
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x442829
je 0x44283b
sub ecx, 0x100
je 0x442849
sub ecx, 0x100
je 0x442850
sub ecx, 0x100
je 0x442842
jmp 0x442857
sub ecx, 0x600
je 0x442850
sub ecx, 0x100
je 0x44283b
jmp 0x442857
mov edi, 1
jmp 0x44285c
mov edi, 2
jmp 0x44285c
mov edi, 4
jmp 0x44285c
mov edi, 5
jmp 0x44285c
mov edi, 3
test byte [ebp + 0xd], 1
je 0x442883
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4624a8]
test al, 0x80
je 0x44287c
mov ebx, 0x80
jmp 0x442895
mov ebx, 1
jmp 0x442895
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x442895
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4428a7
je 0x4428b0
dec eax
je 0x4428b9
jmp 0x4428c2
mov dword [ebp - 4], 0x80000000
jmp 0x4428d1
mov dword [ebp - 4], 0x40000000
jmp 0x4428d1
mov dword [ebp - 4], 0xc0000000
jmp 0x4428d1
push 1
call fcn.00443dc0
pop ecx
mov ebx, eax
jmp 0x4429bd
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4428ed
sub eax, 0x10
je 0x4428f4
sub eax, 0x10
je 0x4428fd
sub eax, 0x10
je 0x442906
jmp 0x442906
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x44290d
mov dword [ebp - 8], 1
jmp 0x44290d
mov dword [ebp - 8], 2
jmp 0x44290d
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x442976
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x44296b
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x44296b
add ebx, 0xffffffb2
push ebx
call fcn.00443dc0
pop ecx
mov ebx, eax
jmp 0x4429bd
mov edi, esi
push edi
call fcn.00442740
pop ecx
test eax, eax
je 0x44298a
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x442996
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00443b04
add esp, 8
mov ebx, eax
inc eax
jne 0x4429bd
push 4
call fcn.00443dc0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442e2c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x442e48
call fcn.00443e24
jmp 0x442e69
test byte [ebp + 0xc], 0x80
jne 0x442e53
or ebx, 1
jmp 0x442e56
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
dec eax
je 0x442e67
call fcn.00443e24
jmp 0x442e69
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x443180
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x187c860
call fcn.004439fc
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x187c860
call fcn.00443474
add esp, 0x14
push 0x462a2c
lea ecx, [ebp - 8]
push ecx
call fcn.004414ec
add esp, 8
mov byte [0x187c860], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x187c860
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4431f3
mov eax, 0x187c860
jmp 0x4431f5
xor eax, eax
pop ecx
pop ecx
pop ebp
ret