joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436170
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
call fcn.0046ea46
push 0x6a09e667
lea eax, [esi + 0x74]
push 0x4bb638
push eax
call fcn.00402d80
push 0xbb67ae85
lea ecx, [esi + 0x78]
push 0x4bb638
push ecx
call fcn.00402d80
push 0x3c6ef372
lea edx, [esi + 0x7c]
push 0x4bb638
push edx
call fcn.00402d80
push 0xa54ff53a
lea eax, [esi + 0x80]
push 0x4bb638
push eax
call fcn.00402d80
push 0x510e527f
lea ecx, [esi + 0x84]
push 0x4bb638
push ecx
call fcn.00402d80
push 0x9b05688c
lea edx, [esi + 0x88]
push 0x4bb638
push edx
call fcn.00402d80
add esp, 0x48
push 0x1f83d9ab
lea eax, [esi + 0x8c]
push 0x4bb638
push eax
call fcn.00402d80
push 0x5be0cd19
lea ecx, [esi + 0x90]
push 0x4bb638
push ecx
call fcn.00402d80
add esp, 0x18
push 0x43
push 0
push 0
push 0
push 0
push 0x4f7a28
mov ecx, esi
call fcn.00470733
push 0x43
push 0
push 0
push 0
push 0
push 0x4f79d0
mov ecx, esi
call fcn.00470733
cmp byte [esi + 0x94], 0
push 0
je 0x436277
mov edx, dword [esi + 0x358]
push 1
push 0xf1
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
pop esi
ret
mov eax, dword [esi + 0x358]
push 0
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
pop esi
ret

Function at 0x439040
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x14
mov eax, dword [0x4ecba0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push ebx
push 0
lea edx, [esp + 8]
push edx
mov edx, dword [eax + 4]
push edx
push eax
push 0xc
lea eax, [esp + 0x1c]
push eax
push 0x2d1400
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test ebx, ebx
jne 0x4390b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 4]
push eax
push ecx
push 0x2424
push str.CAsmtUSBDev::GetDisksProperty
push str._s:_d:_GetDisksProperty_Failed__dwOutBytes:__d____dwErrorCode:__d
call fcn.0044b7f0
add esp, 0x14
mov al, bl
mov ecx, dword [esp + 0x14]
pop ebx
xor ecx, esp
call fcn.0048f35c
add esp, 0x14
ret 8
Function at 0x43bed0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4ecba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
call fcn.0046d74a
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x43bf19
push 0x80004005
call fcn.00402240
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
call fcn.004024f0
movsx ecx, byte [ebp + 8]
push ecx
lea edx, [ebp - 0x14]
push 0x4bba98
push edx
call fcn.00402d80
mov edi, dword [ebp - 0x14]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
push edi
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43bf8d
mov esi, dword [ebp - 0x18]
shr esi, 0xa
imul esi, dword [ebp - 0x1c]
imul esi, dword [ebp - 0x20]
shr esi, 0xa
jmp 0x43bff7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ed
jne 0x43bfa6
mov ecx, dword [ebx + 0x408]
mov esi, dword [ecx + 0x260]
push eax
push edi
push 0x2579
push str.CAsmtUSBDev::vGetDiskFreeSpace
push str._s:_d:_vGetDiskFreeSpace:_GetDiskFreeSpace_Fail___strLogicalAddress_:__s___dwErrorCode__d
call fcn.0044b7f0
add esp, 0x14
jmp 0x43bff7
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c01a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c030
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad308
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4ecba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], SysReAllocString
call fcn.0046d74a
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x43c07e
push 0x80004005
call fcn.00402240
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
movsx ecx, byte [ebp + 8]
push ecx
lea edx, [ebp - 0x24]
push str..PhysicalDrive_d
mov dword [ebp - 4], esi
xor edi, edi
push edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
call fcn.00402d80
mov eax, dword [ebp - 0x24]
add esp, 0xc
push esi
push 0x20000000
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x43c1b7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43c0e7
xor esi, esi
cmp edi, esi
je 0x43c0f7
push edi
call fcn.0046a8b0
add esp, 4
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x1c]
lea esi, [esi + esi*8]
shl esi, 4
add esi, 0xc0
push esi
call fcn.0046a8bb
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
test edi, edi
je 0x43c13d
call ebx
mov edx, dword [ebp - 0x18]
push 0
lea ecx, [ebp - 0x28]
push ecx
push esi
push edi
push 0
push 0
push 0x70050
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call ebx
inc dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x43c14a
cmp dword [ebp - 0x14], 0x7a
je 0x43c0e5
cmp dword [ebp - 0x14], 0xea
je 0x43c0e5
mov ecx, dword [ebp - 0x14]
push ecx
push eax
push 0x2653
push str.CAsmtUSBDev::vGetPartitionCount
push str._s:_d:_vGetPartitionCount33:_Send_IOCTL_DISK_GET_DRIVE_LAYOUT_EX__dwbytes_d__dwErrorCode:_d
call fcn.0044b650
mov edx, dword [edi + 4]
add esp, 0x14
push edx
push 0x2654
push str.CAsmtUSBDev::vGetPartitionCount
push str._s:_d:_vGetPartitionCount44:_pDli__PartitionCount:_d
call fcn.0044b650
add esp, 0x10
xor eax, eax
lea esp, [esp]
cmp eax, dword [edi + 4]
jae 0x43c1a9
lea ecx, [eax + eax*8]
shl ecx, 4
mov ecx, dword [ecx + edi + 0x48]
test ecx, ecx
je 0x43c1a6
mov dword [ebp - 0x2c], ecx
inc eax
jmp 0x43c190
push edi
call fcn.0046a8b0
mov eax, dword [ebp - 0x18]
add esp, 4
xor esi, esi
cmp eax, esi
je 0x43c1c2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43c1e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44b650
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1004
call fcn.0048f460
mov eax, dword [0x4ecba0]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp dword [0x4f4ac0], 3
jl 0x44b705
push 0x4f4aa8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [str._r_nMSG::]
mov ecx, dword [0x4c9454]
push 0xff8
lea edx, [esp + 0xc]
push 0
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0048f850
push 0x1000
push 0
push 0x4f4ac8
call fcn.0048f850
mov ecx, dword [esp + 0x1020]
lea eax, [esp + 0x1024]
push eax
push ecx
push 0x1000
push 0x1000
push 0x4f4ac8
call fcn.0048ee95
push 0x4f4ac8
lea edx, [esp + 0x30]
push 0x1000
push edx
call fcn.00491e35
add esp, 0x38
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4f4aa8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0048f35c
add esp, 0x1004
ret

Function at 0x44b720
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1004
call fcn.0048f460
mov eax, dword [0x4ecba0]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp dword [0x4f4ac0], 2
jl 0x44b7d5
push 0x4f4aa8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [str._r_nWRN::]
mov ecx, dword [0x4c945c]
push 0xff8
lea edx, [esp + 0xc]
push 0
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0048f850
push 0x1000
push 0
push 0x4f4ac8
call fcn.0048f850
mov ecx, dword [esp + 0x1020]
lea eax, [esp + 0x1024]
push eax
push ecx
push 0x1000
push 0x1000
push 0x4f4ac8
call fcn.0048ee95
push 0x4f4ac8
lea edx, [esp + 0x30]
push 0x1000
push edx
call fcn.00491e35
add esp, 0x38
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4f4aa8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0048f35c
add esp, 0x1004
ret

Function at 0x44b7f0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1004
call fcn.0048f460
mov eax, dword [0x4ecba0]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp dword [0x4f4ac0], 1
jl 0x44b8a5
push 0x4f4aa8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [str._r_nERR::]
mov ecx, dword [0x4c9464]
push 0xff8
lea edx, [esp + 0xc]
push 0
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0048f850
push 0x1000
push 0
push 0x4f4ac8
call fcn.0048f850
mov ecx, dword [esp + 0x1020]
lea eax, [esp + 0x1024]
push eax
push ecx
push 0x1000
push 0x1000
push 0x4f4ac8
call fcn.0048ee95
push 0x4f4ac8
lea edx, [esp + 0x30]
push 0x1000
push edx
call fcn.00491e35
add esp, 0x38
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4f4aa8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0048f35c
add esp, 0x1004
ret
Function at 0x44bc50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae240
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ecba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push eax
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call fcn.0044bc20
imul esi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push ebx
lea ecx, [ebp - 0x14]
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp al, bl
jne 0x44bcc5
push ebx
push 0x13c
push str.CFat32Format::vWriteSect
push str._s:_d:_vWriteSect:_WriteFile_Fail___dwErrorCode__d
call fcn.0044b7f0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44bd00
Capabilities:
Check for time delay via queryperformancecounter
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae260
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4ecba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0x10]
mov esi, edi
imul esi, dword [ebp + 0x14]
push 4
xor eax, eax
push 0x3000
mov ecx, edi
shl ecx, 7
push ecx
mov ebx, 0x80
push eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.0044bc20
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea esp, [esp]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x44bde1
cmp eax, ebx
ja 0x44bd9d
mov ebx, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov esi, ebx
imul esi, edi
push 0
lea eax, [ebp - 0x24]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test al, al
jne 0x44bdd6
xor eax, eax
push eax
push esi
push 0x177
push str.CFat32Format::vZeroSectors
push str._s:_d:_vZeroSectors:_WriteFile_Fail___dwNumberOfBytesToWrite__d___dwErrorCode__d
call fcn.0044b7f0
add esp, 0x14
sub dword [ebp + 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
jmp 0x44bd90
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
sbb edx, dword [ebp - 0x38]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
fild qword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
fild qword [ebp - 0x44]
sub esp, 0x10
fdivp st(1)
fild qword [ebp - 0x2c]
fld st(1)
fld qword [0x4c5680]
fmul st(1), st(0)
fmulp st(1)
fdivp st(1)
fstp qword [esp + 8]
fstp qword [esp]
push eax
push esi
push 0x17f
push str.CFat32Format::vZeroSectors
push str._s:_d:_vZeroSectors:_Wrote__I64d_bytes_in__.2f_seconds___.2f_Megabytes_sec
call fcn.0044b650
mov eax, dword [ebp - 0x14]
add esp, 0x24
test eax, eax
je 0x44be53
imul ebx, edi
push 0x4000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x456700
Capabilities:
Hash data using sha256

Disassembly:
mov eax, ecx
xor ecx, ecx
mov edx, 0x5be0cd19
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x6c], 0x6a09e667
mov dword [eax + 0x70], 0xbb67ae85
mov dword [eax + 0x74], 0x3c6ef372
mov dword [eax + 0x78], 0xa54ff53a
mov dword [eax + 0x7c], 0x510e527f
mov dword [eax + 0x80], 0x9b05688c
mov dword [eax + 0x84], 0x1f83d9ab
mov dword [eax + 0x88], edx
ret

Function at 0x4567c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afa10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ecba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
push edi
push 0
push 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [ebp + 0xc]
test esi, esi
jne 0x456869
push esi
push eax
push edi
push esi
push 0x15f
push str.CUSBUtility::KillProcess
push str._s:_d:_KillProcess:_hProcess__NULL___pId:_x___exitCode:_x___dwErrorCode:_d
call fcn.0044b650
add esp, 0x1c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test edi, edi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x456db0
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0xa0
push 0xffffffffffffffff
push 0x4afa90
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4ecba0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x9c
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp]
push eax
call fcn.0048f850
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx esi, word [ebp - 0x38]
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp + 4]
push eax
push 0x236
push str.CUSBUtility::wGetProcessorType
push str._s:_d:_wGetProcessorType:_dwMajorVersion__d
call fcn.0044b650
mov ecx, dword [ebp + 8]
add esp, 0x10
push ecx
push 0x237
push str.CUSBUtility::wGetProcessorType
push str._s:_d:_wGetProcessorType:_dwMinorVersion__d
call fcn.0044b650
movzx edx, byte [ebp + 0x9a]
add esp, 0x10
push edx
push 0x238
push str.CUSBUtility::wGetProcessorType
push str._s:_d:_wGetProcessorType:_wProductType__d
call fcn.0044b650
movzx eax, word [ebp - 0x38]
add esp, 0x10
push eax
push 0x239
push str.CUSBUtility::wGetProcessorType
push str._s:_d:_wGetProcessorType:_wProcessorArchitecture__d
call fcn.0044b650
add esp, 0x10
jmp 0x456ed7
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0048f35c
add ebp, 0xa0
mov esp, ebp
pop ebp
ret

Function at 0x457040
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4ecba0]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x45710a
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x45709b
mov eax, dword [esp + 8]
dec eax
neg eax
sbb eax, eax
add eax, 2
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0048f35c
add esp, 0x98
ret
cmp eax, 6
jne 0x45710a
mov eax, dword [esp + 8]
test eax, eax
jne 0x4570c2
mov eax, 4
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0048f35c
add esp, 0x98
ret
cmp eax, 1
jne 0x4570e1
mov eax, 8
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0048f35c
add esp, 0x98
ret
cmp eax, 2
jne 0x457100
mov eax, 0x10
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0048f35c
add esp, 0x98
ret
cmp eax, 3
mov eax, 0x20
je 0x45710f
mov eax, 0xff
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0048f35c
add esp, 0x98
ret
Function at 0x457c90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afb88
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ecba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0046d74a
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x457cda
push 0x80004005
call fcn.00402240
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x54], esi
mov byte [ebp - 4], 1
mov byte [ebp - 0x49], 0x7f
xor cl, cl
lea esp, [esp]
cmp cl, 0x1a
jae 0x457d1c
movzx eax, cl
mov dl, cl
add eax, eax
add dl, 0x41
mov byte [ebp + eax - 0x48], dl
mov byte [ebp + eax - 0x47], 1
inc cl
jmp 0x457d00
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor bl, bl
cmp bl, 0x1a
jae 0x457d89
movzx esi, bl
add esi, esi
movsx eax, byte [ebp + esi - 0x48]
push eax
lea ecx, [ebp - 0x50]
push 0x4bba98
push ecx
call fcn.00402d80
mov edx, dword [ebp - 0x50]
add esp, 0xc
push edx
call edi
cmp eax, 6
ja case.0x457d50.0
jmp dword [eax*4 + 0x457df4]
mov byte [ebp + esi - 0x47], 0
inc bl
jmp 0x457d24
mov byte [ebp + esi - 0x47], 1
inc bl
jmp 0x457d24
mov cl, 4
jmp 0x457d90
cmp cl, 0x1a
jae 0x457dac
movzx eax, cl
add eax, eax
cmp byte [ebp + eax - 0x47], 1
je 0x457da5
inc cl
jmp 0x457d90
mov al, byte [ebp + eax - 0x48]
mov byte [ebp - 0x49], al
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x457dd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp - 0x49]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048f35c
mov esp, ebp
pop ebp
ret
Function at 0x458ae0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afd28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ecba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov byte [ebp - 0x11], 1
call fcn.0046d74a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x458b2b
push 0x80004005
call fcn.00402240
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004024f0
movsx ecx, byte [ebp + 8]
push 0x4c52c4
push ecx
push str.DiskPartTarget
lea edx, [ebp - 0x18]
push str._s_d._s
push edx
call fcn.00402d80
mov edi, dword [ebp - 0x18]
add esp, 0x14
push 0
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x1c], esp
mov esi, esp
push eax
call fcn.00409450
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.004583c0
cmp al, 1
jne 0x458be9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x458be9
push edi
push 0x497
push str.CUSBUtility::vDelDiskPartSetupInfo
push str._s:_d:_vSetDiskPartSetupInfo:_No_strDiskPartFileName__s__to_Delete
call fcn.0044b650
add esp, 0x10
jmp 0x458be9
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x458c0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4