joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aba88
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x31c], 0
push 0x104
lea eax, [ebp - 0x420]
push eax
call fcn.004b7127
add esp, 8
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4abada
push 0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 8]
add eax, 0xeb2
push eax
push str._s_All.txt
lea ecx, [ebp - 0x304]
push ecx
call fcn.004e894d
add esp, 0xc
lea edx, [ebp - 0x304]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.004e86b0
add esp, 8
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x563a0c
lea edx, [ebp - 0x420]
push edx
call fcn.004e87f4
add esp, 8
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x4abb42
jmp 0x4abc0f
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.004e8440
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x4ff
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc10]
push eax
mov ecx, dword [ebp - 0x31c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc60]
push eax
mov ecx, dword [ebp - 0x30c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x30e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x310]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x312]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x316]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x318]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xeb2
push ecx
push str._s____.4d__.2d__.2d____.2d:_.2d:_.2d____d____d____x____s_n
lea edx, [ebp - 0x200]
push edx
call fcn.004e894d
add esp, 0x34
mov eax, dword [ebp - 0x308]
push eax
lea ecx, [ebp - 0x200]
push ecx
call fcn.004e9200
add esp, 4
push eax
push 1
lea edx, [ebp - 0x200]
push edx
call fcn.004e8654
add esp, 0x10
cmp dword [ebp - 0x308], 0
je 0x4abc27
mov eax, dword [ebp - 0x308]
push eax
call fcn.004e84ec
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b150a
Capabilities:
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52516d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
lea ecx, [ebp - 0x360]
call fcn.004046f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004046f0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x258]
push ecx
push 0x564e28
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xffffffff
jne 0x4b15a4
mov dword [ebp - 0x368], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0050ce61
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.0050ce61
mov eax, dword [ebp - 0x368]
jmp 0x4b16ca
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jne 0x4b1664
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x564e2c
lea ecx, [ebp - 0x360]
push ecx
call fcn.00502a32
add esp, 0x10
lea ecx, [ebp - 0x360]
call fcn.00404710
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x4b1623
movsx edx, byte [ebp - 0x22c]
cmp edx, 0x2e
je 0x4b1621
mov eax, dword [ebp - 0x360]
push eax
push 0x564e34
lea ecx, [ebp - 0x35c]
push ecx
call fcn.004e894d
add esp, 0xc
lea edx, [ebp - 0x35c]
push edx
call fcn.004b150a
add esp, 4
jmp 0x4b1635
lea ecx, [ebp - 0x360]
call fcn.00404710
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b165f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4b165f
mov dword [ebp - 0x10], 1
jmp 0x4b15ab
mov edx, dword [ebp - 0x364]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [ebp - 0x118]
push eax
call fcn.004b7127
add esp, 8
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x36c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0050ce61
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.0050ce61
mov eax, dword [ebp - 0x36c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b1ec4
Capabilities:
Delete file
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e86a0
add esp, 8
push 0x2e
lea edx, [ebp - 0x20c]
push edx
call fcn.004eb1c0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b1f01
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0x70
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4b1f1c
jmp 0x4b1ff3
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4b1f37
jmp 0x4b1ff3
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.004e86a0
add esp, 8
push str.inf
lea edx, [ebp - 0x314]
push edx
call fcn.004e86b0
add esp, 8
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4b1f74
jmp 0x4b1ff3
push 0x20
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
push str.other
lea ecx, [ebp - 0x314]
push ecx
call fcn.004e86b0
add esp, 8
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4b1fca
jmp 0x4b1ff3
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x210], al
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x4b61d6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004e8440
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004e8440
add esp, 0xc
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4b6238
xor eax, eax
jmp 0x4b6260
push 0x927c0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b6264
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
mov dword [ebp - 0x430], 0
push 0xc
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.004e8440
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc68]
mov eax, dword [edx*4 + 0x672f84]
mov dword [ebp - 0x210], eax
cmp dword [0x56c110], 0
je 0x4b62ab
jmp 0x4b62d5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc68]
movsx eax, byte [edx + 0x673000]
cmp eax, 0x43
jl 0x4b62d5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc68]
mov al, byte [edx + 0x673000]
mov byte [ebp - 0x434], al
movsx ecx, byte [ebp - 0x434]
push ecx
push 0x5657c4
lea edx, [ebp - 0x428]
push edx
call fcn.004e894d
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004e8440
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push 3
lea edx, [ebp - 0x428]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [ebp - 0x418], 0x5c
mov word [ebp - 0x416], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004e8440
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x63c]
push ecx
call fcn.004e8440
add esp, 0xc
push 0x104
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4b6456
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x63c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x744], eax
push 0
push 0
mov eax, dword [ebp - 0x744]
push eax
lea ecx, [ebp - 0x740]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x63c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
mov dword [ebp - 0x748], ecx
cmp dword [ebp - 0x748], 0
je 0x4b640c
cmp dword [ebp - 0x748], 1
je 0x4b6432
jmp 0x4b6456
push 4
push str.NTFS
lea edx, [ebp - 0x740]
push edx
call fcn.004e89e0
add esp, 0xc
test eax, eax
jne 0x4b6430
mov dword [ebp - 0x430], 1
jmp 0x4b6456
push 5
push str.exFAT
lea eax, [ebp - 0x740]
push eax
call fcn.004e89e0
add esp, 0xc
test eax, eax
jne 0x4b6456
mov dword [ebp - 0x430], 1
mov eax, dword [ebp - 0x430]
mov esp, ebp
pop ebp
ret
Function at 0x4b676d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x11c], 0x15
mov dword [ebp - 0x118], 0x15
mov dword [ebp - 0x114], 8
mov dword [ebp - 0x110], 0x54
mov dword [ebp - 0x10c], 0x54
mov dword [ebp - 0x108], 0x58
mov dword [ebp - 0x120], 0
jmp 0x4b67cd
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x4b68a7
push 0x104
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e8440
add esp, 0xc
mov edx, dword [ebp - 0x120]
add edx, 1
push edx
push str.TX_PREEPS_GEN_d
lea eax, [ebp - 0x104]
push eax
call fcn.004e894d
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp + edx*4 - 0x11c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x5657e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4], eax
push 0x104
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.004e8440
add esp, 0xc
mov eax, dword [ebp - 0x120]
add eax, 1
push eax
push str.TX_AMP_GEN_d
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e894d
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + eax*4 - 0x110]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x5657fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp + 0xc]
mov dword [edx + ecx*4], eax
jmp 0x4b67be
mov esp, ebp
pop ebp
ret

Function at 0x4b700d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
shl eax, 3
push eax
call fcn.004e8f2e
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
shl ecx, 3
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004e8440
add esp, 0xc
mov dword [ebp - 0x18], 0
jmp 0x4b704c
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0xc]
jge 0x4b7082
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x18]
xor eax, eax
mov al, byte [edx]
push eax
push str.0x_.2X
lea ecx, [ebp - 0x14]
push ecx
call fcn.004e894d
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004e86b0
add esp, 8
jmp 0x4b7043
push 0x565874
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e86b0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x4b70ae
push 0
push 0x673018
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4b70b8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004e8e1d
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4b8836
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov dword [ebp - 0x220], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4b8861
push str._Send_Genesys_ScanDevice_:_CreateHandle_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x4b894d
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.004e8440
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.004e8440
add esp, 0xc
mov byte [ebp - 0x210], 0xf8
mov byte [ebp - 0x20f], 0xff
mov byte [ebp - 0x205], 1
mov edx, dword [ebp + 8]
push edx
push 0x1e
lea eax, [ebp - 0x200]
push eax
push 0x200
push 0x10
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x21c]
push edx
call fcn.004be293
add esp, 0x1c
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4b894b
mov eax, dword [ebp - 0x180]
and eax, 0xff
cmp eax, 0x53
jne 0x4b894b
mov ecx, dword [ebp - 0x17f]
and ecx, 0xff
cmp ecx, 0x4d
jne 0x4b894b
mov edx, dword [ebp - 0x17e]
and edx, 0xff
cmp edx, 0x49
jne 0x4b894b
cmp dword [ebp + 0x10], 0x200
ja 0x4b892c
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x200]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004e8ae0
add esp, 0xc
jmp 0x4b8944
push 0x200
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e8ae0
add esp, 0xc
mov eax, 1
jmp 0x4b894d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4b8c80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
push str.GetHandleID
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x104
push 0
lea eax, [ebp - 0x308]
push eax
call fcn.004e8440
add esp, 0xc
movsx ecx, byte [ebp + 8]
cmp ecx, 0x43
jl 0x4b8cce
movsx edx, byte [ebp + 8]
push edx
push 0x565a08
lea eax, [ebp - 0x308]
push eax
call fcn.004e894d
add esp, 0xc
jmp 0x4b8ce7
movsx ecx, byte [ebp + 8]
push ecx
push 0x565a10
lea edx, [ebp - 0x308]
push edx
call fcn.004e894d
add esp, 0xc
lea eax, [ebp - 0x308]
push eax
push str.Drive__s_handle
lea ecx, [ebp - 0x204]
push ecx
call fcn.004e894d
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b9063
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004e8440
add esp, 0xc
cmp dword [0x56c110], 0
je 0x4b90d2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x672f84]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.004b9500
add esp, 8
test eax, eax
jne 0x4b90d0
mov ecx, dword [ebp + 8]
sub ecx, 1
imul ecx, ecx, 0xff
add ecx, 0x673438
push ecx
push 0x565a50
lea edx, [ebp - 0x108]
push edx
call fcn.004e894d
add esp, 0xc
jmp 0x4b9121
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x673000]
cmp ecx, 0x43
jl 0x4b9102
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x673000]
push eax
push 0x565a54
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e894d
add esp, 0xc
jmp 0x4b9121
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x673000]
push eax
push 0x565a5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e894d
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x4b9157
xor eax, eax
jmp 0x4b91b7
cmp dword [ebp + 0x10], 0
jne 0x4b9164
mov eax, 1
jmp 0x4b91b7
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x90018
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x672fc8]
cmp ecx, 1
jne 0x4b91b2
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0
push 0x90020
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4b93eb
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4b9461
push 0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0x2d1080
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b9457
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b9468
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004e8440
add esp, 0xc
movsx ecx, byte [ebp + 8]
push ecx
push 0x565a74
lea edx, [ebp - 0x108]
push edx
call fcn.004e894d
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jne 0x4b94ba
xor eax, eax
jmp 0x4b94fc
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e8440
add esp, 0xc
movsx edx, byte [ebp + 8]
push edx
push 0x565a78
lea eax, [ebp - 0x108]
push eax
call fcn.004e894d
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004b93eb
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4b95ab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov dword [0x6732f4], 0xff
mov dword [0x6732f0], 0xff
mov dword [ebp - 0x11c], 0
jmp 0x4b95e3
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x18
jge 0x4b963b
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x11c]
mov dword [ecx*8 + 0x672ec8], edx
mov dword [ebp - 0x124], 0
jmp 0x4b961a
mov eax, dword [ebp - 0x124]
add eax, 1
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x4b9639
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x124]
mov byte [edx + ecx*8 + 0x672ecc], 0xff
jmp 0x4b960b
jmp 0x4b95d4
mov byte [ebp - 0x128], 0
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.004e8440
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4b967a
mov dl, byte [ebp - 0x118]
mov byte [ebp - 0x128], dl
mov byte [ebp - 0x10], 0
push 0x104
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.004e8440
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
call fcn.004b7127
add esp, 8
mov dl, byte [ebp - 0x22c]
mov byte [ebp - 0x10], dl
mov dword [ebp - 0x11c], 0
jmp 0x4b96cc
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x18
jge 0x4b9777
mov ecx, dword [ebp - 0x11c]
add ecx, 0x43
mov byte [ebp - 0x120], cl
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.004e8440
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov cl, byte [ebp - 0x120]
push ecx
call fcn.004b9468
add esp, 8
test eax, eax
je 0x4b9772
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jl 0x4b9726
jmp 0x4b96bd
cmp dword [ebp - 0x14], 0
jge 0x4b972e
jmp 0x4b96bd
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov al, byte [ebp - 0x120]
mov byte [edx + ecx*8 + 0x672ecc], al
movsx ecx, byte [ebp - 0x120]
movsx edx, byte [ebp - 0x128]
cmp ecx, edx
jne 0x4b975b
mov eax, dword [ebp - 0xc]
mov dword [0x6732f4], eax
movsx ecx, byte [ebp - 0x120]
movsx edx, byte [ebp - 0x10]
cmp ecx, edx
jne 0x4b9772
mov eax, dword [ebp - 0xc]
mov dword [0x6732f0], eax
jmp 0x4b96bd
mov esp, ebp
pop ebp
ret
Function at 0x4ba6f1
Capabilities:
Print debug messages
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 0x410], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4ba71c
push str._Inquiry_And_ReadFlashID_:_Device_handle_is_not_valid_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x4ba80a
push 0
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0
push 0
push 0x90018
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea edx, [ebp - 0x414]
push edx
push 0
push 0
push 0
push 0
push 0x90020
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x400
lea ecx, [ebp - 0x400]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x40c]
push eax
call fcn.004ba80e
add esp, 0x10
mov dword [ebp - 0x410], eax
push 0
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0
push 0
push 0
push 0x9001c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0
push 0
push 0x90028
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x410], 0
je 0x4ba804
cmp dword [ebp + 0x10], 0x400
ja 0x4ba7ec
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x400]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e8ae0
add esp, 0xc
jmp 0x4ba804
push 0x400
lea edx, [ebp - 0x400]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004e8ae0
add esp, 0xc
mov eax, dword [ebp - 0x410]
mov esp, ebp
pop ebp
ret

Function at 0x4bab80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x4babe2
cmp dword [ebp - 0x8c], 0x5a
je 0x4babe0
mov dword [ebp - 0xa4], 1
jmp 0x4bac11
cmp dword [ebp - 0x90], 5
jne 0x4bac11
cmp dword [ebp - 0x8c], 0
jne 0x4babfe
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x4bac11
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0xa4]
mov esp, ebp
pop ebp
ret

Function at 0x4bac1b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x4bac7d
cmp dword [ebp - 0x8c], 0x5a
je 0x4bac7b
mov dword [ebp - 0xa4], 1
jmp 0x4bacac
cmp dword [ebp - 0x90], 5
jne 0x4bacac
cmp dword [ebp - 0x8c], 0
jne 0x4bac99
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x4bacac
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x9c]
mov esp, ebp
pop ebp
ret