joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428b31
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00424949
test eax, eax
je 0x428b69
push 0
push 0x2000000
push 3
push 0
push 7
push dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x428ba0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x428ba2
test dword [esp + 0xc], 0x40000000
je 0x428ba0
push 0
push 0x2000000
push 1
push 0
push 7
push dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x428ba0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x428b64
xor eax, eax
pop esi
ret 8

Function at 0x428ba6
Capabilities:
Copy file
Create directory
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
push str._ALLUSERSPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5c
lea eax, [ebp - 0x414]
push eax
call fcn.00424780
push str.Uwe_Sieber
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, 0x4f9890
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x449eb0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call fcn.00424949
mov dword [ebp - 4], eax
mov ebx, 0x44d58c
test eax, eax
je 0x428c78
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x61c]
push eax
push 0x449d34
push str.NoIniWrite
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x428c78
push 0x4f9cf0
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x428c78
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x428d3e
push esi
call fcn.004249a0
xor edi, edi
cmp eax, edi
je 0x428cc7
cmp dword [ebp - 4], edi
je 0x428d3e
lea eax, [ebp - 0x20c]
push eax
call fcn.00425284
push esi
mov edi, eax
mov ebx, edx
call fcn.00425284
cmp ebx, edx
jb 0x428d3e
ja 0x428cb5
cmp edi, eax
jbe 0x428d3e
push 0
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x428d3e
push esi
call fcn.00424979
test eax, eax
jne 0x428d3e
lea eax, [ebp - 0x414]
push eax
call fcn.00424949
test eax, eax
jne 0x428cef
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00424949
test eax, eax
je 0x428d18
lea eax, [ebp - 0x20c]
push eax
call fcn.00424949
test eax, eax
jne 0x428d18
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
push 0x4f9cf0
push str.NoIniWrite
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4293bb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x429434
cmp word [esi], 0
je 0x429434
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x100
ja 0x429434
cmp word [esi], 0x5c
jne 0x4293f7
cmp word [esi + 2], 0x5c
jne 0x4293f7
cmp word [esi + 6], 0x5c
jne 0x4293f7
add esi, 8
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
lea eax, [ebp - 0x208]
push eax
call fcn.004247ac
push 0x104
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
neg eax
sbb eax, eax
neg eax
jmp 0x42945c
push str.DosDeviceNameExists
push 0x1ac2
push str..Tools.cpp
push str.INT3_in__S_line__u__function__S
push 1
call fcn.004453fb
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
leave
ret 4
Function at 0x429461
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, eax
push edi
mov word [ecx], ax
push ebx
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
lea eax, [ebp - 0x260]
push eax
call fcn.00424780
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x44a8d8
xor esi, esi
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x42951e
push str.53f5630d_b6bf_11d0_94f2_00a0c91efb8b
push ebx
call edi
test eax, eax
jne 0x42951e
push esi
push esi
push 3
push esi
push 3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x429539
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 9
pop ecx
push esi
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push 0x28
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x700a0
push dword [ebp + 8]
call ebx
test eax, eax
je 0x429578
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
jmp 0x429573
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x429540
xor eax, eax
jmp 0x429622
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push 0x7405c
push dword [ebp + 8]
call ebx
test eax, eax
je 0x429578
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
jmp 0x4295cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
jne 0x4295cf
xor eax, eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push 0x18
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push 0x70000
push dword [ebp + 8]
call ebx
test eax, eax
je 0x4295cf
mov eax, dword [ebp - 0x18]
mul dword [ebp - 0x14]
push esi
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00447ceb
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edx
push eax
call fcn.00447ceb
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 1
jne 0x429609
cmp dword [ebp - 4], esi
jne 0x429609
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x429609
cmp dword [ebp - 0x10], 2
je 0x4295ff
push 5
pop eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], eax
jne 0x429606
mov dword [ebp - 8], 6
mov dword [ebp - 4], esi
mov edi, dword [ebp + 0xc]
push 1
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041a185
xor eax, eax
cmp word [edi], si
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x429a0b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, dword [ebp + 8]
push str.DeviceCdRom
push esi
call fcn.0042549b
test eax, eax
je 0x429a44
add esi, 0x1a
push esi
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
xor eax, eax
inc eax
jmp 0x429bbd
push str.DeviceFloppy
push esi
call fcn.0042549b
test eax, eax
je 0x429a58
add esi, 0x1c
jmp 0x429a2a
cmp dword [0x4f9b48], 6
jae 0x429a68
xor eax, eax
jmp 0x429bbd
push str.HarddiskVolume
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x429a61
push edi
push esi
push str.GetNt6VolumeDeviceAndPartitionNumber__s_...
push 3
call fcn.004453fb
mov eax, dword [0x492a14]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f641
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
add esp, 0x10
xor esi, esi
jmp 0x429ae8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x429ba5
push dword [ebp - 4]
call fcn.0043f6b6
add dword [0x492a14], 0x1000
mov eax, dword [0x492a14]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f641
pop ecx
pop ecx
mov ecx, dword [0x492a14]
dec ecx
push ecx
push eax
push esi
mov dword [ebp - 4], eax
call edi
mov dword [ebp - 8], eax
cmp eax, esi
je 0x429aac
push ebx
xor ebx, ebx
cmp eax, esi
jle 0x429b93
mov eax, dword [ebp - 4]
lea esi, [eax + ebx*2]
cmp word [esi], 0
je 0x429b93
push str.Harddisk
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, esi
jne 0x429b7f
push str.Partition
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x429b7f
push 0x104
lea eax, [ebp - 0x214]
push eax
push esi
call edi
test eax, eax
je 0x429b7f
cmp dword [0x506bac], 5
jl 0x429b6b
lea eax, [ebp - 0x214]
push eax
push esi
push str.___s___s
push 5
call fcn.004453fb
add esp, 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x429bc2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax + 1]
cmp ebx, dword [ebp - 8]
jl 0x429b09
push str._not_found
push 3
call fcn.004453fb
pop ecx
pop ecx
xor esi, esi
jmp 0x429bf7
call fcn.00443016
push eax
push str._qdd_all__err_S
push 3
call fcn.004453fb
add esp, 0xc
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov edi, dword [sym.imp.SHLWAPI.dll_StrToIntW]
lea eax, [esi + 0x10]
push eax
call edi
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
add eax, 0x12
push eax
call edi
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ecx], eax
push dword [ebx]
push esi
push str._found__s____pDevNum_i_pPartNum_i
push 3
call fcn.004453fb
xor esi, esi
add esp, 0x14
inc esi
push dword [ebp - 4]
call fcn.0043f6b6
pop ecx
mov eax, esi
pop ebx
jmp 0x429bbc
Function at 0x42a3ba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x4f9c70
lea eax, [ebp - 0x25c]
push str._sSystem32_rundll32.exe
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x65c]
push str.__s__url_OpenURL__s
push eax
call esi
add esp, 0x1c
cmp dword [0x4f9b48], 6
jb 0x42a42f
call fcn.00425867
test eax, eax
je 0x42a42f
call fcn.004291b9
test eax, eax
je 0x42a42f
push 3
push 0x4f9808
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.004288b0
jmp 0x42a49b
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x38
stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x4670a0
call fcn.0043f481
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x42a499
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
inc eax
jmp 0x42a49b
xor eax, eax
pop esi
leave
ret 4
Function at 0x42cde2
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42ce0f
mov eax, dword [0x4fc630]
cmp eax, esi
je 0x42cfe3
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [0x4fc630], esi
jmp 0x42cfe3
cmp dword [0x4fc630], esi
jne 0x42cfb3
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42cfb3
mov eax, dword [0x492a28]
cmp eax, 0xf0
push ebx
push edi
jl 0x42ce48
push 8
call fcn.00428559
mov ebx, eax
jmp 0x42ce70
cmp eax, 0xc0
jl 0x42ce53
push 0x10
jmp 0x42ce5c
cmp eax, 0xa8
jl 0x42ce5f
push 0xe
pop ebx
jmp 0x42ce70
xor ebx, ebx
cmp eax, 0x90
setge bl
lea ebx, [ebx*4 + 8]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
push eax
push esi
mov dword [0x4fc62c], eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [0x4fc62c]
push esi
sub eax, dword [ebp - 0x14]
mov dword [0x4fc628], esi
mov dword [0x4fc624], eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov dword [0x4fc630], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
push ebx
push 1
push 0xbe
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push 0xcc0020
push dword [0x4fc628]
mov edi, eax
push dword [0x4fc624]
mov eax, dword [0x4fc62c]
push dword [ebp + 0xc]
push eax
push eax
push esi
push esi
push dword [0x4fc630]
call dword [sym.imp.GDI32.dll_BitBlt]
push 1
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 5
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [0x4fc62c]
push 3
push esi
sub ecx, ebx
push esi
lea eax, [ecx + 1]
cdq
push ebx
sub eax, edx
sar eax, 1
push ebx
push edi
push eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push dword [0x4fc630]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [0x4fc62c]
mov ecx, dword [0x4fc624]
mov edx, dword [0x4fc628]
lea edi, [ecx + eax]
mov dword [0x4fc530], edi
lea edi, [edx + eax]
mov dword [0x4fc534], edi
pop edi
mov dword [0x4fc528], ecx
mov dword [0x4fc52c], edx
mov dword [0x4fc538], eax
pop ebx
jmp 0x42cfc4
mov edx, dword [0x4fc628]
mov ecx, dword [0x4fc624]
mov eax, dword [0x4fc62c]
push 0xcc0020
push esi
push esi
push dword [0x4fc630]
lea esi, [edx + eax]
push esi
add eax, ecx
push eax
push edx
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
pop esi
leave
ret 8
Function at 0x42f2d9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push dword [ebp + 8]
call fcn.00424949
test eax, eax
jne 0x42f316
push 0x10
push 0x44d534
push str.File_not_found
push dword [0x4fa140]
call fcn.00446a6c
mov dword [0x4fa84c], 1
xor eax, eax
jmp 0x42f53a
mov eax, dword [0x4fc5b0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42f32f
push eax
call fcn.0043f6b6
pop ecx
mov dword [0x4fc5b0], ebx
push 0x4fc5b0
push dword [ebp + 8]
call fcn.00428077
cmp eax, 0x64
jge 0x42f360
mov eax, dword [0x4fc5b0]
cmp eax, ebx
je 0x42f537
push eax
call fcn.0043f6b6
pop ecx
mov dword [0x4fc5b0], ebx
jmp 0x42f537
push str.Report
push ebx
push 0x7f02
call fcn.0042eaf5
push dword [0x4fa158]
mov dword [0x4fa100], 1
call fcn.0042e1c9
push dword [0x4fa160]
call fcn.0042e1c9
push dword [0x4fa148]
push dword [0x4fc5b0]
call fcn.00446c42
test eax, eax
je 0x42f531
push esi
push edi
xor eax, eax
push 0x3fe
mov word [ebp - 0x408], ax
lea eax, [ebp - 0x406]
push ebx
push eax
call fcn.0043f481
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x408]
push eax
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x42f437
mov esi, 0x44be30
push esi
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, ebx
je 0x42f401
xor ecx, ecx
mov word [eax], cx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x408]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
lea eax, [ebp - 0x408]
push eax
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x4fc598]
mov esi, dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
cmp eax, ebx
je 0x42f449
push eax
call esi
mov eax, dword [0x4fc59c]
mov dword [0x4fc598], ebx
cmp eax, ebx
je 0x42f45b
push eax
call esi
mov ecx, dword [0x4fc544]
mov dword [0x4fc59c], ebx
call fcn.00401475
mov ecx, dword [0x4fc540]
call fcn.00406f42
mov ecx, dword [0x4fc53c]
call fcn.0040c2ad
mov ecx, dword [0x4fc548]
call fcn.0043ce25
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push ebx
push dword [0x4fa140]
call esi
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call edi
push 2
push dword [0x4fa140]
mov dword [ebp - 8], eax
call esi
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x9cae
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
xor edi, edi
push 0x401
push edi
push dword [ebp - 4]
call esi
inc edi
cmp edi, 0xe
jl 0x42f4cc
push dword [0x4f9ad8]
push dword [0x4f9b44]
push dword [0x4fa03c]
push dword [0x4f9568]
push str.Host_Controllers:__i____Root_Hubs:__i____Standard_Hubs:__i____Peripheral_Devices:__i
push ebx
push ebx
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x20
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x453a78
push ebx
push 1
push dword [0x4fa870]
call fcn.004055ed
add esp, 0x14
xor eax, eax
pop edi
inc eax
pop esi
jmp 0x42f539
mov dword [0x4fa100], ebx
xor eax, eax
pop ebx
leave
ret 4
Function at 0x42f631
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor edi, edi
push edi
push edi
push 0xce
push dword [0x4fa14c]
call esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x4dd
push dword [0x4fa14c]
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xb0
push dword [0x4fa14c]
call esi
push edi
push edi
push 0xb
push dword [0x4fa14c]
call esi
mov ebx, 0x4fb318
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x4fa038]
push 0xffffffffffffffff
push edi
push dword [0x4fa14c]
cmp eax, 2
jae 0x42f6b4
call fcn.004266c9
jmp 0x42f7d9
call fcn.004266c9
push dword [0x4fa14c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x42f7d9
xor eax, eax
push 0x7fe
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82a]
push edi
push eax
call fcn.0043f481
mov edi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043f641
add esp, 0x10
inc edi
push edi
push eax
push dword [0x4fa14c]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
push dword [ebp - 4]
jmp 0x42f7bd
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 4]
push ebx
sar edi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push dword [0x4fa14c]
add eax, edi
mov dword [ebp - 0x14], eax
call fcn.00426656
push 0
push edi
push 0xc9
push dword [0x4fa14c]
mov dword [ebp - 0x1c], eax
call esi
lea ecx, [ebp - 0x82c]
push ecx
push eax
push 0xc4
push dword [0x4fa14c]
mov dword [ebp - 0x82c], 0x3ff
call esi
cmp eax, 1
jle 0x42f7b5
push 0x3a
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ecx, eax
lea edx, [ebp - 0x82c]
sub eax, edx
sar eax, 1
neg ecx
sbb ecx, ecx
and ecx, eax
cmp dword [ebp - 0x1c], ecx
jle 0x42f7b5
push dword [0x492a34]
push dword [ebp - 0x14]
push edi
push dword [0x4fa14c]
call fcn.004266c9
mov eax, dword [ebp - 8]
push ebx
add eax, 2
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x42f723
push dword [ebp - 4]
call fcn.0043f6b6
pop ecx
xor edi, edi
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0xb1
push dword [0x4fa14c]
call esi
push edi
push edi
push 0xce
push dword [0x4fa14c]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
je 0x42f813
sub ecx, eax
push ecx
push edi
push 0xb6
push dword [0x4fa14c]
call esi
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x4dd
push dword [0x4fa14c]
call esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], eax
je 0x42f845
movzx eax, ax
push edi
shl eax, 0x10
or eax, 4
push eax
push 0x114
push dword [0x4fa14c]
call esi
push edi
push 1
push 0xb
push dword [0x4fa14c]
call esi
push 5
push edi
push edi
push dword [0x4fa14c]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4330e9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push str.Generischer_USB_Hub
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43310c
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp + 8]
push 4
pop ebx
cmp dword [0x506bac], ebx
jl 0x433166
mov eax, edi
test edi, edi
jne 0x433125
mov eax, 0x449a30
lea ecx, [esi + 0xcf6]
push ecx
push eax
push dword [esi + 0x81c]
push str.ChangeLeaf_name_s__text_s______s
push ebx
call fcn.004453fb
add esp, 0x14
cmp dword [0x506bac], ebx
jl 0x433166
push dword [esi + 8]
push dword [0x4fa148]
call fcn.0042fa68
push eax
push str._currenttext_s
push ebx
call fcn.004453fb
add esp, 0xc
push dword [esi + 8]
push dword [0x4fa148]
call fcn.004264bc
test eax, eax
jne 0x433191
cmp dword [0x506bac], ebx
jl 0x433271
push dword [esi + 8]
push str._0x_08Ix_is_not_a_tree_item____abort
jmp 0x433268
push 0x34
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.0043f481
mov eax, dword [esi + 8]
mov dword [ebp - 0x34], eax
xor eax, eax
add esp, 0xc
test edi, edi
setne al
push esi
mov dword [ebp - 0x28], edi
or eax, 0x22
mov dword [ebp - 0x38], eax
call fcn.00432b00
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
push eax
xor esi, esi
push esi
push 0x113f
push dword [0x4fa148]
mov dword [0x4fa120], esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x433254
push dword [0x4fa148]
mov dword [0x4fa120], esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 0x34]
cmp eax, dword [0x4fa864]
jne 0x43324f
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x505b40]
cmp eax, 0xbb8
jae 0x433231
push 0x414329
push 0xa
push 0x12340005
push dword [0x4fa140]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x433248
push dword [0x4fa864]
push dword [0x4fa148]
push dword [0x4fa14c]
call fcn.004141cd
call esi
mov dword [0x505b40], eax
xor eax, eax
inc eax
jmp 0x433273
cmp dword [0x506bac], ebx
jl 0x433271
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TreeView_SetItem_err_u
push ebx
call fcn.004453fb
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43357e
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042eaf5
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.0043f481
xor eax, eax
push esi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push edi
push eax
call fcn.0043f481
xor eax, eax
push esi
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push edi
push eax
call fcn.0043f481
add esp, 0x24
push 0x4f9890
mov esi, 0x104
push esi
lea eax, [ebp - 0x410]
push eax
push 0x449d34
mov ebx, str.ReportPath
push ebx
mov edi, 0x44d58c
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00425f1f
test eax, eax
je 0x433686
lea eax, [ebp - 0x208]
push eax
call fcn.0042f2d9
mov esi, eax
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00428143
push 0x4f9890
lea eax, [ebp - 0x208]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042eaf5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
jmp 0x43366e