joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f5b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdddd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f4fa0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push eax
push 0x212
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.004b3e00
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov dword [edi], 0
cmovae edx, dword [ebp - 0x28]
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49f651
sub eax, esi
mov ecx, edi
sar eax, 1
push eax
push edx
call fcn.004b41a0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x49f6a5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49f69b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x49f69b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bec24
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf1dd
mov esp, ebp
pop ebp
ret

Function at 0x49f6d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cde2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4f4fa0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x212
mov ecx, edi
mov dword [ebp - 0x10], 2
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push 0x212
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
mov ecx, edi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a6a50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf8ac
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4f4fa0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x512438]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5116b4]
cmp eax, dword [ecx + 4]
jg 0x4a6c0c
cmp dword [ebp + 8], 0
mov ecx, 0x5116a4
push 0x2a5e
push str.Ver98
push 0x4d76d4
je 0x4a6bc2
call fcn.00480420
cmp eax, 0x2a5e
jne 0x4a6b4e
push 0x9830
push str.Ver98
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004a6e90
push 0
push str.DeveloperOnly
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.00480420
test eax, eax
jne 0x4a6b4e
push 0xe59e
push str.DeveloperOnly
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004a6e90
push str.DeveloperName
push str.DeveloperUser
push 0x4d76d4
lea eax, [ebp - 0x10]
mov ecx, 0x5116a4
push eax
call fcn.00488950
push str.DeveloperName
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
test eax, eax
je 0x4a6b61
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 0x400
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x14]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push dword [ebp + 8]
mov ecx, 0x5116a4
push str.DeveloperUser
push 0x4d76d4
call fcn.004aac20
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x4a6bf6
call fcn.004a6e90
push 0
push str.DeveloperOnly
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004a6e90
push str.DeveloperName
push str.DeveloperUser
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004aac20
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
push 0x5116b4
call fcn.004bf0ef
add esp, 4
cmp dword [0x5116b4], 0xffffffff
jne 0x4a6a95
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.00487fe0
add esp, 4
push dword [eax]
mov ecx, 0x5116a4
mov byte [ebp - 4], 1
call fcn.00462070
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d35a0
call fcn.004befa7
push 0x5116b4
mov dword [ebp - 4], 0xffffffff
call fcn.004bf0a5
add esp, 8
jmp 0x4a6a95
Function at 0x4abac0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x18], 8
lea edx, [ecx + 4]
jb 0x4abace
mov edx, dword [edx]
mov eax, dword [ecx + 0x1c]
or eax, dword [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 4
Function at 0x4023a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4023c4
xor eax, eax
jmp 0x402444
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4023db
xor eax, eax
jmp 0x402444
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x402427
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x402427
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4023fe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x402433
xor eax, eax
jmp 0x402444
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x402441
xor eax, eax
jmp 0x402444
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x402c20
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x11], 1
mov dword [ebp - 0x1c], 0
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x402c61
xor al, al
jmp 0x402cab
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0x1c]
push edx
push 0x28
mov eax, dword [ebp + 8]
push eax
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0x2d1400
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret
Function at 0x402e20
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 1
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x402e4d
xor al, al
jmp 0x402e96
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
push 0x2d1080
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 1]
test edx, edx
je 0x402e90
cmp dword [ebp - 0xc], 0
je 0x402e94
xor al, al
jmp 0x402e96
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x402ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x23e], 0
mov byte [ebp - 0x23d], 1
push 0x200
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402e20
add esp, 8
mov byte [ebp - 0x23d], al
movzx eax, byte [ebp - 0x23d]
test eax, eax
jne 0x402eff
mov al, byte [ebp - 0x23e]
jmp 0x402f76
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + edx - 0x224]
push eax
push str.._c:
lea ecx, [ebp - 0x24]
push ecx
call fcn.00402210
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00402e20
add esp, 8
mov byte [ebp - 0x23d], al
movzx ecx, byte [ebp - 0x23d]
test ecx, ecx
jne 0x402f4d
mov al, byte [ebp - 0x23e]
jmp 0x402f76
mov edx, dword [ebp - 0x230]
cmp edx, dword [ebp - 0x23c]
jne 0x402f70
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x238]
jne 0x402f70
mov byte [ebp - 0x23e], 1
mov al, byte [ebp - 0x23e]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret
Function at 0x402f90
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x20], 0x6e8
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x402ff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5fa3a8
call fcn.00406800
add esp, 0xc
xor al, al
jmp 0x403052
push 0
lea eax, [ebp - 0x20]
push eax
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0x2d1080
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x403038
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.DeviceIoControl_fail___FileName_is__s___u32Err_is__d___r_n
call fcn.00406800
add esp, 0xc
xor al, al
jmp 0x403052
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
cmp dword [ebp - 0x18], 0
je 0x403050
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret
Function at 0x403a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00586690
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00586690
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.004392f4
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x403ae3
mov byte [ebp - 0x219], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x219]
jmp 0x403cab
lea edx, [ebp - 0x218]
push edx
call fcn.0040a290
add esp, 4
lea eax, [ebp - 0x218]
push eax
push str._s_resourcemiddle.exe
lea ecx, [ebp - 0x114]
push ecx
call fcn.00402210
add esp, 0xc
push 0
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x240]
call fcn.0043959a
test eax, eax
jne 0x403b5b
push 0x5fa5c0
push 0x5fa5d0
call fcn.00406800
add esp, 8
mov byte [ebp - 0x21a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21a]
jmp 0x403cab
push 0x3c
push 0
lea eax, [ebp - 0x27c]
push eax
call fcn.00586690
add esp, 0xc
mov dword [ebp - 0x27c], 0x3c
mov dword [ebp - 0x278], 0x40
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0x5fa600
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x25c], 0x20
jae 0x403c1c
mov ecx, dword [ebp - 0x25c]
push ecx
push 0x5fa608
push 0x5fa618
call fcn.00406800
add esp, 0xc
mov byte [ebp - 0x21b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21b]
jmp 0x403cab
push 0xffffffffffffffff
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x224], 0
je 0x403c8c
mov edx, dword [ebp - 0x224]
push edx
push str.CallMiddleExe
push 0x5fa650
call fcn.00406800
add esp, 0xc
mov byte [ebp - 0x21c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21c]
jmp 0x403cab
mov byte [ebp - 0x21d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret
Function at 0x4042b0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 1], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x404304
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.Open_handle_fail___FileName_is__s___u32Err_is__d___r_n
call fcn.00406800
add esp, 0xc
xor al, al
jmp 0x404448
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x1030
mov eax, dword [ebp - 0x14]
push eax
call fcn.0058ca39
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40434a
xor al, al
jmp 0x404448
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx], 0x31
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 8]
mov dword [ecx], 3
mov edx, dword [ebp - 8]
mov dword [edx + 4], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
cmp dword [ebp + 0x10], 0
jne 0x4043a1
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], 1
jmp 0x4043ab
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0x28
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], 0x1000
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x2d1400
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00586110
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call fcn.0058c624
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x404420
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x404446
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
push str.IssueNvmeDrectIdentify___fail___u32Err_is__d___r_n
call fcn.00406800
add esp, 8
xor al, al
jmp 0x404448
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x404500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae9d0
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00586690
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00586690
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.004392f4
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x404593
mov byte [ebp - 0x219], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x219]
jmp 0x40475b
lea edx, [ebp - 0x218]
push edx
call fcn.0040a290
add esp, 4
lea eax, [ebp - 0x218]
push eax
push str._s_resourcedevcon.exe
lea ecx, [ebp - 0x114]
push ecx
call fcn.00402210
add esp, 0xc
push 0
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x240]
call fcn.0043959a
test eax, eax
jne 0x40460b
push 0x5fa954
push str.Function___s_Fail__tdevcon.exe_is_not_exist_
call fcn.00406800
add esp, 8
mov byte [ebp - 0x21a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21a]
jmp 0x40475b
push 0x3c
push 0
lea eax, [ebp - 0x27c]
push eax
call fcn.00586690
add esp, 0xc
mov dword [ebp - 0x27c], 0x3c
mov dword [ebp - 0x278], 0x40
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0x5fa994
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x25c], 0x20
jae 0x4046cc
mov ecx, dword [ebp - 0x25c]
push ecx
push 0x5fa99c
push 0x5fa9ac
call fcn.00406800
add esp, 0xc
mov byte [ebp - 0x21b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21b]
jmp 0x40475b
push 0xffffffffffffffff
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x224], 0
je 0x40473c
mov edx, dword [ebp - 0x224]
push edx
push str.CallDevconExe
push 0x5fa9e4
call fcn.00406800
add esp, 0xc
mov byte [ebp - 0x21c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21c]
jmp 0x40475b
mov byte [ebp - 0x21d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00439497
mov al, byte [ebp - 0x21d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret
Function at 0x405670
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4056bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
push 0x5fb068
push 0x5fb07c
call fcn.00406800
add esp, 0xc
xor al, al
jmp 0x40571f
push 0
lea edx, [ebp - 0x14]
push edx
push 0x1000
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push 0x70050
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405713
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push str.GetDiskDriveLayout
push str.Function___s_fail__last_err__0x_x_r_n
call fcn.00406800
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40571f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4058d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [0x655c18]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x655c18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x405929
push str.Write_SerialPort_is__Fail___r_n
call fcn.00406800
add esp, 4
xor al, al
jmp 0x40593a
push 0xf
mov ecx, dword [0x655c18]
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret
Function at 0x405950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x625e6c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x655c18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jne 0x4059fe
cmp dword [ebp - 0x18], 1
jne 0x4059fe
mov dword [ebp - 0x14], 0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [0x655c18]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jbe 0x4059bc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
jmp 0x4059c2
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4059f7
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [0x655c18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, 1
jmp 0x405a00
mov eax, 1
jmp 0x405a00
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00582196
mov esp, ebp
pop ebp
ret