joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ea3d
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.00435888
push dword [0x50efe8]
call fcn.0043577c
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x43ea87
push 0x40
push 0x459870
push str.No_device_selected
push dword [0x50e67c]
call fcn.0045149d
jmp 0x43ec66
push ebx
push esi
xor eax, eax
push 0x7fe
mov word [ebp - 0xc18], ax
lea eax, [ebp - 0xc16]
push edi
push eax
call fcn.00449c78
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00449c78
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.00449c78
add esp, 0x24
push 0x50dcd0
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x4551b0
push str.DevReportPath
mov ebx, 0x4598c8
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x418], di
je 0x43eb2e
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.004288a1
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x1154]
cmp eax, edi
je 0x43eb4f
lea ecx, [eax + 0x1738]
cmp word [ecx], di
jne 0x43eb4c
lea ecx, [eax + 0x1838]
push ecx
jmp 0x43eb55
push dword [ecx + 0x828]
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x20
lea eax, [ebp - 0xc18]
push eax
call fcn.0042a7b5
push str..txt
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xc18]
push eax
call fcn.00429f69
test eax, eax
je 0x43ec54
cmp dword [0x50e628], edi
jne 0x43ebb6
push edi
push fcn.00417832
push dword [0x50efe8]
call fcn.00435441
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [0x50efe8]
mov dword [ebp - 4], edi
call fcn.0043c7b2
mov esi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00449e38
pop ecx
push edi
xor ecx, ecx
mov dword [0x510cc0], eax
mov word [eax], cx
push 0x435fbd
push dword [0x50efe8]
mov dword [0x510cc4], esi
call fcn.00435441
lea eax, [ebp - 0xc18]
push eax
call fcn.0040f735
push dword [0x510cc0]
call fcn.00449e73
pop ecx
lea eax, [ebp - 0xc18]
push eax
mov dword [0x510cc0], edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
je 0x43ec54
xor ecx, ecx
push 0x50dcd0
mov word [eax], cx
lea eax, [ebp - 0xc18]
push eax
push str.DevReportPath
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push edi
push 0x7f00
call fcn.00435888
pop esi
pop ebx
pop edi
leave
ret
Function at 0x43ee3f
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.00435888
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.00449c78
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.00449c78
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.00449c78
push 0x50d938
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.xml
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x50dcd0
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x4551b0
mov ebx, str.ReportPath
push ebx
mov edi, 0x4598c8
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042a023
test eax, eax
je 0x43ef7f
push dword [0x50e67c]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0040f511
push 0
call fcn.0040f54f
lea eax, [ebp - 0x20c]
push eax
call fcn.0043ec69
mov dword [ebp - 4], eax
call fcn.0040f58f
call fcn.0040f530
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x43ef7f
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x43ef7f
xor ecx, ecx
push 0x50dcd0
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.00435888
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446e18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
push ebx
push dword [ebp + 8]
push str.GetDiskFreeSpaceExTimeout__s___u_
push 3
call fcn.0044fe2e
push 0x228
call fcn.00449e38
mov esi, eax
add esp, 0x14
push dword [ebp + 8]
xor edi, edi
push esi
mov dword [esi + 0x208], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 0x210], edi
mov dword [esi + 0x214], edi
mov dword [esi + 0x218], edi
mov dword [esi + 0x21c], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x446c73
push edi
mov dword [esi + 0x224], ebx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x446ea2
push esi
call fcn.00449e73
pop ecx
jmp 0x446f95
push ebx
push dword [ebp - 4]
push str.thread_GetDiskFreeSpaceEx_ThreadProc_created_ThreadId_04u_wait_i
push 3
call fcn.0044fe2e
add esp, 0x10
call fcn.0042c2d3
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
call fcn.0042c2d3
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
push edx
push eax
push ebx
push str.waitres_u_after__I64u_ms
push 3
call fcn.0044fe2e
add esp, 0x14
mov dword [ebp + 0x18], 0xffff
cmp ebx, edi
jne 0x446f80
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp + 0x18], edi
jne 0x446f63
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x446f22
mov ecx, dword [esi + 0x208]
mov dword [eax], ecx
mov ecx, dword [esi + 0x20c]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x446f3a
mov ecx, dword [esi + 0x210]
mov dword [eax], ecx
mov ecx, dword [esi + 0x214]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x446f52
mov ecx, dword [esi + 0x218]
mov dword [eax], ecx
mov ecx, dword [esi + 0x21c]
mov dword [eax + 4], ecx
push dword [esi + 0x220]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
inc edi
jmp 0x446f6c
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.00449e73
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x446f97
push edi
push esi
push dword [ebp + 8]
call fcn.00446989
push 0x5b4
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4470e6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
mov dword [ebp - 0xc], ecx
call fcn.00449c78
add esp, 0xc
push 0x23
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], eax
test eax, eax
je 0x447246
mov esi, 0x455dbc
lea edi, [ebp - 0xa24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3f6
xor esi, esi
lea eax, [ebp - 0xa1a]
push esi
push eax
call fcn.00449c78
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xa1c]
push eax
call ebx
lea eax, [ebp - 0xa24]
push eax
mov eax, dword [ebp - 4]
add eax, 2
push eax
push str.SystemCurrentControlSetControlDeviceClasses
lea eax, [ebp - 0xe24]
push 0x455538
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xe24]
push eax
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x447246
cmp dword [ebp - 8], esi
je 0x447246
and dword [ebp - 4], esi
mov edi, 0x104
push edi
lea eax, [ebp - 0x624]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x447229
cmp word [ebp - 0x624], 0x23
jne 0x44721b
push 0x455db8
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x447234
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push 0x5c
pop eax
mov word [ebp - 0x214], ax
inc dword [ebp - 4]
push edi
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4471d4
jmp 0x44723d
xor eax, eax
mov word [ebp - 0x214], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x458414
lea edi, [ebp - 0x41c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fe
lea eax, [ebp - 0x412]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00449c78
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
lea eax, [ebp - 0x41c]
push eax
call fcn.0042c04c
mov esi, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov dword [esi], eax
call fcn.0042bff0
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x44822c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
test byte [0x51a380], 1
jne 0x448255
or dword [0x51a380], 1
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x51a37c], eax
test byte [0x51a380], 2
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x44827f
or dword [0x51a380], 2
push str.GetModuleFileNameExW
push dword [0x51a37c]
call esi
mov dword [0x51a378], eax
test byte [0x51a380], 4
jne 0x4482a1
or dword [0x51a380], 4
push str.GetProcessImageFileNameW
push dword [0x51a37c]
call esi
mov dword [0x51a374], eax
test byte [0x51a380], 8
jne 0x4482c9
or dword [0x51a380], 8
cmp dword [0x50e048], 6
sbb eax, eax
and eax, 0xfffff400
add eax, 0x1000
mov dword [0x51a370], eax
xor ebx, ebx
cmp dword [0x51a374], ebx
jne 0x4482da
xor eax, eax
jmp 0x448475
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4482d3
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00449c78
xor eax, eax
push 0x246
mov word [ebp - 0x684], ax
lea eax, [ebp - 0x682]
push ebx
push eax
call fcn.00449c78
push 0x228
lea eax, [ebp - 0x438]
push ebx
push eax
mov dword [ebp - 0x43c], 0x22c
call fcn.00449c78
add esp, 0x24
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x448469
push edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x434], 4
je 0x448434
push dword [ebp - 0x434]
mov eax, dword [0x51a370]
push ebx
or eax, 0x50
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x448434
xor eax, eax
mov word [ebp - 0x210], ax
mov word [ebp - 0x684], ax
push 0x124
lea eax, [ebp - 0x684]
push eax
push esi
call dword [0x51a374]
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call dword [0x51a378]
test eax, eax
jne 0x4483dd
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x684]
push eax
call fcn.0042c4bd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x210]
push 0x455338
mov eax, esi
push eax
call fcn.0042958c
test eax, eax
je 0x448401
lea esi, [ebp - 0x208]
push dword [ebp + 8]
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x448434
push esi
call fcn.0042bff0
inc dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x434]
mov dword [edi], eax
mov eax, dword [ebp - 4]
add edi, 0x10
cmp eax, dword [ebp + 0x10]
jge 0x44844d
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x44835d
jmp 0x448468
cmp dword [0x51adac], 5
jl 0x448468
push dword [ebp - 4]
push str.max_number_of_processes_reached___i_____abort
push 5
call fcn.0044fe2e
add esp, 0xc
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x448481
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x44847b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4484d9
push 0x32
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4484cb
and dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
jmp 0x4484db
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x100
jmp 0x4484db
xor eax, eax
pop esi
leave
ret 4

Function at 0x448506
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x810
mov dword [ebp - 4], 0x102
call fcn.00449e38
mov esi, eax
mov eax, dword [ebp + 8]
or dword [esi + 0x80c], 0xffffffff
pop ecx
mov dword [esi], eax
lea eax, [esi + 0xc]
mov dword [esi + 8], eax
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [esi + 4], ax
mov eax, 0x800
mov word [esi + 6], ax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push esi
push 0x4484e0
push 0x10000
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0x448578
push esi
call fcn.00449e73
pop ecx
xor eax, eax
jmp 0x44860f
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4485f6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x80c]
mov dword [ebp - 4], eax
movzx eax, word [esi + 4]
cmp ax, di
je 0x44860c
mov ecx, dword [esi + 8]
cmp word [ecx], di
je 0x44860c
mov ebx, dword [ebp + 0x10]
movzx eax, ax
dec ebx
cmp eax, ebx
jge 0x4485b4
mov ebx, eax
mov edi, dword [ebp + 0xc]
push ebx
push ecx
push edi
call fcn.00449ce2
push esi
call fcn.00449e73
mov eax, ebx
xor ecx, ecx
shr eax, 1
add esp, 0x10
mov word [edi + eax*2], cx
cmp dword [ebp - 4], ecx
je 0x44860c
cmp dword [ebp - 4], 0xc000026e
jne 0x448571
add ebx, 0xe
cmp ebx, dword [ebp + 0x10]
jge 0x44860c
push str.dismounted
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44860c
push str.__timeout_
push 3
call fcn.0044fe2e
pop ecx
pop ecx
push 0x79
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x44964b
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x44965d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x44963d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
pop ecx
ret
Function at 0x449bd0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
and dword [ebp - 0x40], 0
push 0x3c
mov dword [0x50e618], eax
lea eax, [ebp - 0x3c]
push 0
push eax
mov dword [ebp - 0x44], 0x44
call fcn.00449c78
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
je 0x449c12
movzx eax, word [ebp - 0x14]
jmp 0x449c15
push 0xa
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x44d18f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x9c40
call fcn.00449e38
mov dword [esp], 0x482e6c
push 1
push 1
xor esi, esi
push esi
mov dword [0x51a980], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51a98c], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x44d0e8
push 0x1000
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x51a988], eax
pop esi
leave
ret

Function at 0x44d27f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44d343
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jb 0x44d343
cmp word [esi], 0x5c
mov eax, esi
jne 0x44d2b6
cmp word [esi + 6], 0x5c
jne 0x44d2b6
lea eax, [esi + 8]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x410]
push ecx
push eax
call edi
test eax, eax
je 0x44d2e0
push dword [ebp + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x44d341
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x5c
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
lea eax, [ebp - 0x1b8]
cmp esi, eax
jbe 0x44d341
xor eax, eax
mov word [esi], ax
push ebx
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x200]
push eax
call edi
test eax, eax
je 0x44d341
add esi, 2
push esi
lea eax, [ebp - 0x410]
push eax
push 0x455344
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x44edcc
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor ebx, ebx
push 0x1ff
lea eax, [ebp - 0x213]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00449c78
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
add esp, 0xc
push ebx
lea ecx, [ebp - 4]
push ecx
mov eax, 0x200
push eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
mov edi, 0x2d1400
push edi
push dword [ebp + 8]
mov dword [ebp - 0x214], 0x28
call esi
mov dword [ebp - 8], 1
cmp eax, ebx
jne 0x44ee92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
jne 0x44eea7
call fcn.0044cf52
push eax
push str._spq_err_s
push 2
call fcn.0044fe2e
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 8]
call esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x44ee38
cmp eax, ebx
je 0x44eea7
cmp dword [ebp - 4], ebx
je 0x44eea7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1f8]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x44eebe
call fcn.0044cf52
push eax
push str.IOCTL_STORAGE_QUERY_PROPERTY_err_s
push 1
call fcn.0044fe2e
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44f0b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.GetVolumesBusTypeThruDriveDev__s_...
push 4
pop edi
push edi
call fcn.0044fe2e
add esp, 0xc
cmp dword [ebp + 0xc], 0xffffffff
jne 0x44f0f8
push esi
call fcn.0042f5de
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x44f0f8
push str._DevNum_is__1____return_BusTypeUnknown
push edi
call fcn.0044fe2e
pop ecx
pop ecx
xor eax, eax
jmp 0x44f25f
push ebx
xor eax, eax
push 0x7e
mov word [ebp - 0x100], ax
xor ebx, ebx
lea eax, [ebp - 0xfe]
push ebx
push eax
call fcn.00449c78
add esp, 0xc
push 0x40
lea eax, [ebp - 0x100]
push eax
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x44f247
cmp word [ebp - 0x100], bx
je 0x44f247
lea eax, [ebp - 0x100]
push eax
push str._kn_s
push edi
call fcn.0044fe2e
xor eax, eax
push 0x7e
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push ebx
push eax
call fcn.00449c78
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrW]
add esp, 0x18
mov edi, str.Harddisk
push edi
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
je 0x44f188
push dword [ebp + 0xc]
push str..PhysicalDrive_i
jmp 0x44f1ba
push edi
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
je 0x44f1a0
push dword [ebp + 0xc]
push str..CdRom_i
jmp 0x44f1ba
push str.Floppy
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
je 0x44f1c7
push dword [ebp + 0xc]
push str..Floppy_i
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp word [ebp - 0x80], bx
je 0x44f25c
lea eax, [ebp - 0x80]
push eax
push str._CreateFile__s_...
push 4
call fcn.0044fe2e
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44f210
call fcn.0044cf52
push eax
lea eax, [ebp - 0x80]
push eax
push str._CreateFile__s___err_s_____return_BusTypeUnknown
push 4
jmp 0x44f254
lea eax, [ebp + 0xc]
push eax
push esi
mov dword [ebp + 0xc], ebx
call fcn.0044edcc
push esi
test eax, eax
jne 0x44f22a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44f25c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push str._BusType_i
push 4
call fcn.0044fe2e
mov eax, dword [ebp + 0xc]
add esp, 0xc
jmp 0x44f25e
call fcn.0044cf52
push eax
push esi
push str.QueryDosDevice__s___err_s_____return_BusTypeUnknown
push edi
call fcn.0044fe2e
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x44fd16
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [0x51afc4], ebx
je 0x44fe27
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x24]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
add ebp, ebp
mov dword [esp + 0x10], ebx
mov edi, 0x40000000
mov eax, dword [0x4a7014]
cmp eax, 0xffffffff
jne 0x44fdc9
push ebx
push ebx
push 4
push dword [0x51ad4c]
push 1
push edi
push dword [esp + 0x38]
call esi
mov dword [0x4a7014], eax
cmp eax, 0xffffffff
jne 0x44fdc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x44fd97
push ebx
push ebx
push 4
push ebx
push 1
push edi
push dword [esp + 0x38]
call esi
mov dword [0x4a7014], eax
mov eax, dword [0x4a7014]
cmp eax, 0xffffffff
jne 0x44fdc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x44fdbf
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xa
jl 0x44fd52
mov eax, dword [0x4a7014]
cmp eax, 0xffffffff
je 0x44fe24
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [esp + 0x1c]
push eax
push ebp
push dword [esp + 0x30]
push dword [0x4a7014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x51afc0], ebx
je 0x44fe0e
push dword [0x4a7014]
mov esi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call esi
mov eax, dword [0x4a7018]
cmp eax, 0xffffffff
je 0x44fe0e
push eax
call esi
push dword [0x51ad70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8