Function at 0x417600
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x324]
push ebx
lea esi, [ebp - 0x220]
sub esp, 0x36c
mov dword [ebp - 0x350], ecx
mov dword [ebp - 0x358], 5
mov dword [ebp - 0x34c], eax
mov ebx, 0x61
jmp 0x4177bf
lea eax, [ebp - 0x324]
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
sub esp, 0xc
test eax, eax
je 0x4177b3
mov dword [esp + 4], str.Harddisk
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
sub esp, 8
test eax, eax
je 0x4177b3
lea edi, [ebp - 0x334]
lea edx, [ebp - 0x324]
mov dword [ebp - 0x33c], edi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x417694
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea eax, [ebp - 0x324]
sbb edx, 3
sub edx, eax
cmp edx, 0xf
ja 0x4179f0
cmp edx, 1
je 0x417a40
test edx, edx
mov eax, edi
jne 0x417a13
mov dword [ebp - 0x338], edx
mov ecx, dword [ebp - 0x350]
mov byte [eax + edx], 0
lea eax, [ebp - 0x33c]
mov dword [esp], eax
call fcn.00417110
mov edx, dword [ebp - 0x33c]
sub esp, 4
cmp edx, edi
je 0x417727
mov dword [esp], edx
mov dword [ebp - 0x354], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x354]
cmp eax, 1
je 0x4178a0
call fcn.0042c430
mov edx, 0x6369
mov dword [ebp - 0x33c], edi
mov dword [edi], 0x646e6553
mov word [edi + 0xc], dx
lea edx, [ebp - 0x11c]
mov dword [edi + 4], 0x54646950
mov dword [edi + 8], 0x7665446f
mov byte [edi + 0xe], 0x65
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x33c]
mov dword [esp + 0x10], str._s_is_not_huawei_sd_card
mov dword [esp + 0xc], 0x1d9
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x325], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x33c]
cmp eax, edi
je 0x4177b3
mov dword [esp], eax
call fcn.004ed8c0
add ebx, 1
cmp ebx, 0x7b
je 0x417a54
mov edi, dword [ebp - 0x34c]
xor eax, eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x11c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x324]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x4fc6b6
mov dword [esp + 4], 0x104
mov dword [ebp - 0x34c], eax
mov dword [esp], eax
call dword [0x4f90b4]
cmp eax, 0xffffffff
jne 0x417640
call fcn.0042c430
lea edx, [ebp - 0x33c]
lea edi, [ebp - 0x334]
mov ecx, 0x6369
mov dword [esp + 0x10], str.SendPidToDevice_call_sprintf_s_failed
mov dword [esp + 0xc], 0x1c3
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x334], 0x646e6553
mov dword [ebp - 0x330], 0x54646950
mov dword [ebp - 0x32c], 0x7665446f
mov word [ebp - 0x328], cx
mov byte [ebp - 0x326], 0x65
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x325], 0
call fcn.0042ce70
jmp 0x4177a1
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.._c:
mov dword [esp + 4], 0x104
mov dword [esp], eax
call dword [0x4f90b4]
cmp eax, 0xffffffff
je 0x417ad4
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x33c], edi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4178d8
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea eax, [ebp - 0x11c]
sbb edx, 3
sub edx, eax
cmp edx, 0xf
ja 0x417a70
cmp edx, 1
je 0x417ac0
test edx, edx
mov eax, edi
jne 0x417a93
mov dword [ebp - 0x338], edx
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x350]
mov dword [esp + 4], eax
lea eax, [ebp - 0x33c]
mov dword [esp], eax
call fcn.00414f90
mov edx, dword [ebp - 0x33c]
sub esp, 8
cmp edx, edi
je 0x417972
mov dword [esp], edx
mov dword [ebp - 0x354], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x4177b3
call fcn.0042c430
lea edx, [ebp - 0x33c]
mov ecx, 0x6369
mov dword [ebp - 0x33c], edi
mov dword [edi], 0x646e6553
mov dword [edi + 4], 0x54646950
mov dword [edi + 8], 0x7665446f
mov word [edi + 0xc], cx
mov byte [edi + 0xe], 0x65
mov dword [esp + 0x10], str.SendPidToDevice_call_ResetDevice_failed
mov dword [esp + 0xc], 0x1d6
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x325], 0
call fcn.0042ce70
jmp 0x4177a1
lea eax, [edx + 1]
mov dword [ebp - 0x354], edx
mov dword [esp], eax
call fcn.004ed900
mov edx, dword [ebp - 0x354]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], edx
mov dword [esp + 8], edx
mov dword [ebp - 0x354], edx
lea edx, [ebp - 0x324]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x33c]
mov edx, dword [ebp - 0x354]
jmp 0x4176e8
movzx eax, byte [ebp - 0x324]
mov byte [ebp - 0x334], al
mov eax, edi
jmp 0x4176e8
sub dword [ebp - 0x358], 1
jne 0x41762e
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [edx + 1]
mov dword [ebp - 0x354], edx
mov dword [esp], eax
call fcn.004ed900
mov edx, dword [ebp - 0x354]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], edx
mov dword [esp + 8], edx
mov dword [ebp - 0x354], edx
lea edx, [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x33c]
mov edx, dword [ebp - 0x354]
jmp 0x41792c
movzx eax, byte [ebp - 0x11c]
mov byte [ebp - 0x334], al
mov eax, edi
jmp 0x41792c
call fcn.0042c430
mov edx, 0x6369
mov dword [ebp - 0x33c], edi
mov dword [edi], 0x646e6553
mov word [edi + 0xc], dx
lea edx, [ebp - 0x33c]
mov dword [edi + 4], 0x54646950
mov dword [edi + 8], 0x7665446f
mov byte [edi + 0xe], 0x65
mov dword [esp + 0x10], str.SendPidToDevice_call_sprintf_s_failed
mov dword [esp + 0xc], 0x1d1
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x325], 0
call fcn.0042ce70
jmp 0x4177a1