joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405030
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x9e3779b9
mov byte [ebp - 0x11], 0x20
jmp 0x4050b1
mov cl, byte [ebp - 0xc]
and cl, 3
movsx eax, cl
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + eax*4]
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
shl eax, 4
mov edx, dword [ebp - 8]
shr edx, 5
xor eax, edx
add eax, dword [ebp - 8]
xor ecx, eax
add dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
shr eax, 0xb
and al, 3
movsx edx, al
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + edx*4]
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
shl edx, 4
mov ecx, dword [ebp - 4]
shr ecx, 5
xor edx, ecx
add edx, dword [ebp - 4]
xor eax, edx
add dword [ebp - 8], eax
mov al, byte [ebp - 0x11]
add byte [ebp - 0x11], 0xff
test al, al
jg 0x405059
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret

Function at 0x4050d4
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xc6ef3720
mov dword [ebp - 0x10], 0x9e3779b9
mov byte [ebp - 0x11], 0x20
jmp 0x405158
mov edx, dword [ebp - 0xc]
shr edx, 0xb
and dl, 3
movsx ecx, dl
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + ecx*4]
add edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
shl ecx, 4
mov eax, dword [ebp - 4]
shr eax, 5
xor ecx, eax
add ecx, dword [ebp - 4]
xor edx, ecx
sub dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
sub dword [ebp - 0xc], edx
mov cl, byte [ebp - 0xc]
and cl, 3
movsx eax, cl
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + eax*4]
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
shl eax, 4
mov edx, dword [ebp - 8]
shr edx, 5
xor eax, edx
add eax, dword [ebp - 8]
xor ecx, eax
sub dword [ebp - 4], ecx
mov cl, byte [ebp - 0x11]
add byte [ebp - 0x11], 0xff
test cl, cl
jg 0x4050ff
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x405178
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jge 0x4051b2
mov ecx, dword [0x451bac]
add ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 4]
and ecx, 0xf
mov al, byte [ecx + 0x451bb0]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor byte [ecx + edx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jl 0x405189
pop ecx
pop ebp
ret
Function at 0x408528
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
lea eax, [ebp - 0xf0]
push eax
push 0xef
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
lea edx, [ebp - 0xf0]
push edx
call sub.KERNEL32.DLL_GetTempFileNameA
mov esp, ebp
pop ebp
ret
Function at 0x40ac88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
call fcn.00429594
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40acb3
push str.SECUSTAR_STATICDATA_TO_XML
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
test eax, eax
jne 0x40ace0
cmp dword [ebp - 4], 0
je 0x40acc1
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x45b0bc
push 0x450425
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x40aeb1
push 0x4655a5
lea edx, [ebp - 0x118]
push edx
call fcn.004415c8
add esp, 8
push str.SecuStar_send.XML
lea ecx, [ebp - 0x118]
push ecx
call fcn.004414ec
add esp, 8
push 0
push 0
push 1
push 0x44ff67
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call fcn.00411764
add esp, 0x18
cmp byte [ebp - 0x118], 0
je 0x40aeb1
push 0x4650c8
lea edx, [ebp - 0x220]
push edx
call fcn.004415c8
add esp, 8
push str.0701_0702KaDrFeSt_Z745Y.xml
lea ecx, [ebp - 0x220]
push ecx
call fcn.004414ec
add esp, 8
jmp 0x40adbd
push str.Bitte
push 0x41
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x40ad87
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
jmp 0x40aeb1
push 0x4655a5
lea eax, [ebp - 0x220]
push eax
call fcn.004415c8
add esp, 8
push 0
push 0x44ff67
lea edx, [ebp - 0x220]
push edx
push dword [ebp + 8]
call fcn.004115d8
add esp, 0x10
cmp byte [ebp - 0x220], 0
je 0x40ad5c
push 0x456894
lea ecx, [ebp - 0x220]
push ecx
call fcn.0044362c
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40adfb
lea eax, [ebp - 0x220]
push eax
push 0x456897
push 0x30
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x40ad5c
push dword [ebp - 0x10]
call fcn.00442e70
pop ecx
push dword [ebp + 0x10]
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x118]
push ecx
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2710
jne 0x40ae56
push 0xffffffffffffffff
lea eax, [ebp - 0x220]
push eax
push 0x4568c2
push 0x30
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x14
lea edx, [ebp - 0x118]
push edx
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x40ad5c
cmp dword [ebp - 0xc], 0
jle 0x40ae82
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
lea ecx, [ebp - 0x118]
push ecx
push 0x4568e6
push 0x40
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x40aeb1
cmp dword [ebp - 0xc], 0
jne 0x40aeb1
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x456910
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov esp, ebp
pop ebp
ret
Function at 0x40aeb8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
call fcn.00429594
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40aee3
push str.SECUTEST4_STATICDATA_TO_XML
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
test eax, eax
jne 0x40af10
cmp dword [ebp - 4], 0
je 0x40aef1
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 0x45b0bc
push 0x450425
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
jmp 0x40afa0
push 0x4655a5
lea edx, [ebp - 0x118]
push edx
call fcn.004415c8
add esp, 8
push str.Secutest4_send.XML
lea ecx, [ebp - 0x118]
push ecx
call fcn.004414ec
add esp, 8
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 0xc]
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x40af71
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push 1
push 5
lea edx, [ebp - 0x118]
push edx
push dword [ebp + 8]
call fcn.00429360
add esp, 0x10
jmp 0x40afa0
cmp dword [ebp - 0xc], 0
jne 0x40afa0
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
push str.Keine_Daten_gespeichert.
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
mov esp, ebp
pop ebp
ret
Function at 0x40c770
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
sub edx, 2
je 0x40c991
sub edx, 0x10e
je 0x40c79b
dec edx
je 0x40c911
jmp 0x40c999
push 0
call fcn.0040c6d8
pop ecx
cmp dword [0x44f900], 0
jg 0x40c815
push str.Keine_COM_ist_vorhanden.
push 0x10
push dword [ebp + 8]
call fcn.0041124c
add esp, 0xc
push 0x2775
push 0x2776
push 0x2775
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
push 0
push 0x2776
push dword [ebp + 8]
call fcn.0041ca68
add esp, 0xc
push 0
push 0x4b3
push dword [ebp + 8]
call fcn.0041ca68
add esp, 0xc
push 0x2775
push 0x2776
push 0x2775
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
jmp 0x40c8c4
push str.AUTO
push 0
push 0x180
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40c88b
mov edx, dword [ebp - 8]
mov ecx, dword [edx*4 + 0x464cc8]
inc ecx
push ecx
push 0x456cfe
lea eax, [ebp - 0x4c]
push eax
call fcn.00444f70
add esp, 0xc
lea edx, [ebp - 0x4c]
push edx
push 0
push 0x180
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x464cc8]
cmp eax, dword [0x450110]
jne 0x40c888
mov edx, dword [ebp - 8]
inc edx
mov dword [ebp - 0xc], edx
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x44f900]
jl 0x40c83a
push 0
push dword [ebp - 0xc]
push 0x186
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
push 0x2776
push 0x2776
push 0x2775
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
push 0x2777
push 0x2778
push 0x2777
push dword [ebp + 8]
call sub.USER32.DLL_CheckRadioButton
push 0
push 0x2777
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
push 0
push 0x2778
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
mov dword [ebp - 4], 1
jmp 0x40c999
mov ax, word [ebp + 0x10]
and ax, 0xffff
cmp ax, 0x2775
je 0x40c94d
mov dx, word [ebp + 0x10]
and dx, 0xffff
cmp dx, 0x2776
je 0x40c94d
mov cx, word [ebp + 0x10]
and cx, 0xffff
cmp cx, 0x2777
je 0x40c94d
mov ax, word [ebp + 0x10]
and ax, 0xffff
cmp ax, 0x2778
jne 0x40c999
push 0x2776
push dword [0x46a120]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x40c975
push 0x2778
push dword [0x46a120]
call sub.USER32.DLL_IsDlgButtonChecked
test eax, eax
je 0x40c979
xor edx, edx
jmp 0x40c97e
mov edx, 1
push edx
push 0x4b3
push dword [ebp + 8]
call fcn.0041ca68
add esp, 0xc
jmp 0x40c999
xor ecx, ecx
mov dword [0x46a120], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cd98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x456d04
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jb 0x40cdc7
mov eax, 1
jmp 0x40ce38
push 0x456d09
push dword [ebp + 0xc]
push 0x4506b0
lea edx, [ebp - 0x20c]
push edx
call fcn.00444f70
add esp, 0x10
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004415f8
pop ecx
mov edx, 0x208
sub edx, eax
dec edx
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004415f8
pop ecx
lea ecx, [ebp - 0x20c]
add eax, ecx
push eax
push 0
push dword [ebp - 4]
push 0
push 0x1000
call sub.KERNEL32.DLL_FormatMessageA
lea eax, [ebp - 0x20c]
push eax
push 0x30
push dword [ebp + 8]
call fcn.0041124c
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41714c
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
cmp dword [0x44f9bc], 0
je 0x4172e4
cmp dword [0x44f9c0], 0
je 0x4172e4
mov dword [0x44ffa4], 4
push 0x465ed1
lea eax, [ebp - 0x110]
push eax
call fcn.004415c8
add esp, 8
jmp 0x4171f2
push 0x4572d2
push 0x24
push dword [ebp + 8]
call fcn.0041124c
add esp, 0xc
cmp eax, 6
jne 0x4172e4
mov dword [0x44ffa4], 1
push 0x465ed1
lea edx, [ebp - 0x110]
push edx
call fcn.004415c8
add esp, 8
push 1
push 0x44ffa4
push 1
push 0x46a051
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp + 8]
call fcn.00411764
add esp, 0x18
mov dword [0x44ffa4], 4
cmp byte [ebp - 0x110], 0
je 0x41718f
push 1
push 0x45730c
push 0x453848
call fcn.004051b8
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
jne 0x417241
cmp dword [ebp - 8], 0
je 0x417225
push dword [ebp - 8]
call fcn.00442e70
pop ecx
push 0x453848
push 0x450450
push 0x30
push dword [ebp + 8]
call fcn.0041124c
add esp, 0x10
jmp 0x41718f
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x417269
push dword [ebp - 8]
push 1
push 1
mov ecx, dword [0x44f9bc]
add ecx, dword [ebp - 4]
push ecx
call fcn.00405248
add esp, 0x10
cmp eax, 1
jne 0x417216
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x44f9c4]
jl 0x417248
push dword [ebp - 8]
call fcn.00442e70
pop ecx
push 0
lea edx, [ebp - 0x110]
push edx
push 0x453848
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x4172c6
lea ecx, [ebp - 0x110]
push ecx
push 0x450450
push 0x30
push dword [ebp + 8]
call fcn.0041124c
add esp, 0x10
push 0x453848
push str.Daten_werden_in_der_Datei__s_gespeichert.
push 0x40
push dword [ebp + 8]
call fcn.0041124c
add esp, 0x10
jmp 0x4172e4
push 0x453848
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x110]
push eax
push 0x465ed1
call fcn.004415c8
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x417bc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x44f94c], 0
je 0x417c72
push dword [0x44f94c]
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x417c72
push str.PCDW.pps
push 0x4650c8
call fcn.00404358
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417c72
push dword [ebp - 4]
call fcn.0040464c
pop ecx
test eax, eax
jne 0x417c30
push str.PCDW.pps
push 0x450425
push 0x40
push dword [0x44f94c]
call fcn.0041124c
add esp, 0x10
jmp 0x417c69
push 1
push 0
push 0
push dword [ebp - 4]
push 0x457343
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jg 0x417c69
push 0x457348
push str.PCDW.pps
push 0x4506b0
push 0x40
push dword [0x44f94c]
call fcn.0041124c
add esp, 0x14
push dword [ebp - 4]
call fcn.0044066c
pop ecx
pop ecx
pop ebp
ret
Function at 0x418afc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff1c
cmp dword [ebp + 8], 0
jne 0x418b12
xor eax, eax
jmp 0x418c9a
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 8]
push ecx
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_ClearCommError
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x18]
jae 0x418b31
mov ecx, dword [ebp + 0x10]
jmp 0x418b34
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x418b44
xor eax, eax
jmp 0x418c9a
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x418c60
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
jne 0x418c07
jmp 0x418be6
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e4
je 0x418be6
push 0
push 0xc7
lea ecx, [ebp - 0xe4]
push ecx
push 0
push dword [ebp - 0xc]
push 0
push 0x1000
call sub.KERNEL32.DLL_FormatMessageA
lea eax, [ebp - 0xe4]
push eax
push dword [ebp - 0xc]
push str.Rd_rdError01__0x_08X__s_r_n
call fcn.0040391c
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 8]
push ecx
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_ClearCommError
push 0xf
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_PurgeComm
or eax, 0xffffffff
jmp 0x418c9a
push 1
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_GetOverlappedResult
test eax, eax
je 0x418b79
jmp 0x418c60
push 0
push 0xc7
lea edx, [ebp - 0xe4]
push edx
push 0
push dword [ebp - 0xc]
push 0
push 0x1000
call sub.KERNEL32.DLL_FormatMessageA
lea ecx, [ebp - 0xe4]
push ecx
push dword [ebp - 0xc]
push str.Rd_rdError02__0x_08X__s_r_n
call fcn.0040391c
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
push dword [ecx]
call sub.KERNEL32.DLL_ClearCommError
push 0xf
mov eax, dword [ebp + 8]
push dword [eax]
call sub.KERNEL32.DLL_PurgeComm
or eax, 0xffffffff
jmp 0x418c9a
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x418c8f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [ecx + eax]
push edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [ecx + eax]
push edx
push str.Rd__c_0x_02X_OK_r_n
call fcn.0040391c
add esp, 0xc
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
jl 0x418c67
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41a4b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcfc
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x41a580
lea ecx, [ebp - 4]
push ecx
push 0
push 0x80000000
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x41a57d
xor eax, eax
mov dword [0x186c4bc], eax
jmp 0x41a553
lea edx, [ebp - 0x10c]
push edx
imul ecx, dword [ebp - 0xc], 0x136
add ecx, 0xf446dd
push ecx
call fcn.0044157c
add esp, 8
test eax, eax
jne 0x41a54d
mov dword [ebp - 8], 0xfa
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x304]
push edx
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
jne 0x41a54d
lea eax, [ebp - 0x304]
push eax
push 0
push 0x180
push 0x4b3
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
inc dword [ebp - 0x10]
inc dword [0x186c4bc]
push 0xfa
lea edx, [ebp - 0x10c]
push edx
push dword [0x186c4bc]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x41a4e9
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
inc dword [ebp - 0xc]
movsx ecx, byte [0xf446dc]
cmp ecx, dword [ebp - 0xc]
jg 0x41a4c8
cmp dword [ebp - 0x10], 0
jne 0x41a59d
mov byte [0xf446dc], 0
mov esp, ebp
pop ebp
ret
Function at 0x41aa08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc4
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
dec edx
je 0x41ab30
dec edx
je 0x41ab37
sub edx, 0x111
jne 0x41ab67
push dword [0x186c428]
call fcn.0041b304
pop ecx
mov dword [ebp - 0x10], eax
push dword [0x186c428]
call fcn.0041aba8
pop ecx
test eax, eax
jne 0x41aa65
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x45769c], eax
jmp 0x41aa8a
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [0x45769c]
cmp eax, 0x2710
jbe 0x41ab6c
mov dword [0x4576a8], 1
jmp 0x41ab6c
mov ecx, dword [0x186c420]
sub ecx, 1
jb 0x41ab6c
je 0x41aaa3
dec ecx
je 0x41ab1c
jmp 0x41ab6c
xor eax, eax
mov dword [0x186c420], eax
cmp dword [0x4576ac], 0
je 0x41ab10
push 0x679f44
call fcn.00447bb8
pop ecx
push 0x679f44
push 0x674df9
lea edx, [ebp - 0x33c]
push edx
call fcn.00444f70
add esp, 0xc
lea ecx, [ebp - 0x33c]
push ecx
push dword [ebp - 0x10]
push dword [0x186c428]
call fcn.0041af20
add esp, 0xc
cmp dword [0x4576a8], 0
jne 0x41ab10
push dword [ebp - 0x10]
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_BringWindowToTop
mov dword [0x186c41c], 1
mov dword [0x186c420], 2
jmp 0x41ab6c
xor eax, eax
mov dword [0x186c420], eax
push dword [0x186c424]
call sub.USER32.DLL_DestroyWindow
jmp 0x41ab6c
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x41ab6c
push dword [0x186c424]
push dword [0x186c424]
call sub.USER32.DLL_KillTimer
mov dword [0x4576a4], 1
call fcn.0041b11c
cmp dword [0x186c41c], 0
jne 0x41ab6c
call fcn.00419b4c
jmp 0x41ab6c
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x41ab77
mov eax, dword [ebp - 8]
jmp 0x41ab88
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.DLL_DefWindowProcA
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41ce88
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0040464c
pop ecx
test eax, eax
je 0x41cecd
push 0x80
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x41cecd
push dword [ebp + 8]
push str.Die_Datei__s_kann_nicht_gel
push 0x10
call sub.USER32.DLL_GetFocus
push eax
call fcn.0041124c
add esp, 0x10
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret
Function at 0x41eb78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x210]
push edx
call fcn.00444f98
add esp, 0xc
cmp dword [0x4577f0], 0
jne 0x41ecad
push 0x186c7d8
call sub.KERNEL32.DLL_InitializeCriticalSection
push 0x186c7f0
call sub.KERNEL32.DLL_InitializeCriticalSection
xor ecx, ecx
mov dword [0x186c808], ecx
xor eax, eax
mov dword [0x186c80c], eax
mov dword [0x186c814], 1
xor edx, edx
mov dword [0x186ca84], edx
call sub.USER32.DLL_GetFocus
mov dword [0x186c810], eax
push 0x207
lea ecx, [ebp - 0x210]
push ecx
push 0x186c818
call fcn.004046e0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x41ec16
push 0x63
push dword [ebp + 0xc]
push 0x186ca20
call fcn.004046e0
add esp, 0xc
jmp 0x41ec1d
mov byte [0x186ca20], 0
push 0
push 0
push 0
push 0x41ea90
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4577f0], eax
cmp dword [0x4577f0], 0
je 0x41ece4
push 0x186c7d8
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, dword [0x186c814]
mov dword [ebp - 4], eax
push 0x186c7d8
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp dword [ebp - 4], 1
jne 0x41ece4
push 0x186c7f0
call sub.KERNEL32.DLL_EnterCriticalSection
jmp 0x41ec89
lea edx, [ebp - 0x22c]
push edx
call sub.USER32.DLL_TranslateMessage
lea ecx, [ebp - 0x22c]
push ecx
call sub.USER32.DLL_DispatchMessageA
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
jne 0x41ec71
push 0x186c7f0
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x41ec43
push 0x186c7d8
call sub.KERNEL32.DLL_EnterCriticalSection
push 0x207
lea edx, [ebp - 0x210]
push edx
push 0x186c818
call fcn.004046e0
add esp, 0xc
mov dword [0x186c814], 1
push 0x186c7d8
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esp, ebp
pop ebp
ret