joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409070
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, str.EFI_PART
mov dword [ebp - 0xc], edi
mov esi, 0x10
mov edx, edi
sub ebx, edi
nop dword [eax]
movzx eax, byte [ebx + edx]
lea edx, [edx + 1]
movzx ecx, byte [edx - 1]
sub ecx, eax
sub esi, 1
je 0x4090af
test ecx, ecx
je 0x409090
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x4090a6
mov ecx, 0xfffffff0
mov dword [ebp - 4], 0x5c
or eax, 0xffffffff
mov esi, edi
sub ecx, edi
mov edi, ecx
lea ecx, [edi + esi]
cmp ecx, 4
jae 0x4090d4
xor bh, bh
jmp 0x4090d6
mov bh, byte [esi]
mov bl, 1
nop dword [eax + eax]
test bl, bh
mov ecx, 0
setne cl
xor eax, ecx
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
add bl, bl
jne 0x4090e0
inc esi
sub dword [ebp - 4], 1
jne 0x4090c8
mov edi, dword [ebp - 0xc]
not eax
movzx edx, byte [edi + 0x13]
movzx ecx, byte [edi + 0x12]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 0x11]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 0x10]
shl edx, 8
or edx, ecx
cmp eax, edx
jne 0x4090a6
movzx ecx, byte [edi + 0x57]
movzx eax, byte [edi + 0x56]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 0x55]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 0x54]
shl ecx, 8
or ecx, eax
cmp ecx, 0x80
jne 0x4090a6
movzx ecx, byte [edi + 0x53]
movzx eax, byte [edi + 0x52]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 0x51]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 0x50]
shl ecx, 8
or ecx, eax
cmp ecx, 0x80
ja 0x4090a6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4091a0
Capabilities:
Encode data using xor

Disassembly:
push esi
test ecx, ecx
mov eax, 1
push edi
mov esi, edx
mov edi, 0x10
cmovne eax, ecx
mov ecx, eax
lea esi, [esi + 1]
shr ecx, 1
mov edx, ecx
xor edx, 0xa3000000
and al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xa3000000
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xa3000000
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xa3000000
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xa3000000
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xa3000000
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xa3000000
and cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xa3000000
and dl, 1
cmove eax, ecx
mov byte [esi - 1], al
sub edi, 1
jne 0x4091b3
pop edi
pop esi
ret
Function at 0x40c000
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x448004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x419
push ecx
mov dword [ebp - 0x54], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
push 0
push 0
push 0x146
push ebx
call edi
mov esi, eax
sub esi, 1
js 0x40c050
nop dword [eax]
push 0
push esi
push 0x144
push ebx
call edi
sub esi, 1
jns 0x40c040
xor edi, edi
xor esi, esi
mov dword [ebp - 0x50], edi
test esi, esi
jne 0x40c077
lea ecx, [esi + 0x35]
call fcn.0040be70
push eax
push esi
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
mov dword [ebp - 0x50], edi
jmp 0x40c0ed
mov edi, dword [esi*4 + 0x43bc90]
mov eax, edi
cdq
and edx, 0xfffff
lea ecx, [edx + eax]
mov eax, edi
cdq
and edx, 0x3ff
sar ecx, 0x14
add eax, edx
sar eax, 0xa
cmp edi, 0x100000
cmovge eax, ecx
mov ecx, str._d_KB
push eax
mov eax, str._d_MB
cmovl eax, ecx
push eax
lea eax, [ebp - 0x4c]
push 0x40
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp - 0x50]
inc edi
cmp dword [ebp - 0x54], 0
mov dword [ebp - 0x50], edi
jne 0x40c0ed
cmp dword [esi*4 + 0x43bc90], 0x10000
je 0x40c0f7
inc esi
cmp esi, 0x10
jb 0x40c057
mov eax, dword [ebp + 8]
cmp eax, edi
jge 0x40c102
test eax, eax
jns 0x40c112
push eax
push str.Change_invalid_default_index__d_to_0
call fcn.00414ac0
add esp, 8
xor eax, eax
push 0
push eax
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret

Function at 0x40c9a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0
push eax
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xc], edx
push ebx
mov dword [ebp - 8], 0
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40ca29
cmp dword [ebp - 0x14], edi
jne 0x40ca29
cmp dword [ebp - 0x10], esi
jne 0x40ca29
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push 0
push eax
push esi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ca09
cmp dword [ebp - 8], esi
jne 0x40ca09
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 8]
push str.Write_file_error__u__u
call fcn.00414ac0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetFilePointerEx_Failed__u
call fcn.00414ac0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ca50
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x448004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
mov dword [ebp - 0x144], edx
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x138], esi
call fcn.00420f90
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov ebx, eax
shld ebx, edx, 9
push ebx
shl edx, 9
push edx
push eax
push ecx
push esi
push str.GetVentoyVolumeName_PhyDrive__d_SectorStart:_llu_PartOffset:_llu
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], edx
call fcn.00414ac0
add esp, 0x18
lea eax, [ebp - 0x110]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov dword [ebp - 0x134], eax
cmp eax, 0xffffffff
jne 0x40caf0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0x110]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x40cb00
lea eax, [ebp - 0x110]
sub esi, ecx
push eax
push str.Find_volume:_s
call fcn.00414ac0
lea eax, [esi - 1]
add esp, 8
cmp eax, 0x104
jae 0x40cca3
push 0
push 0x80
push 3
push 0
push 3
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40cc0c
push 0
lea eax, [ebp - 0x148]
push eax
push 0x20
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push 0x560000
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS_bRet:_u_code:_u
call fcn.00414ac0
add esp, 0xc
push dword [ebp - 0x128]
push dword [ebp - 0x130]
push str.NumberOfDiskExtents:_u_DiskNumber:_u
call fcn.00414ac0
add esp, 0xc
test edi, edi
je 0x40cc05
cmp dword [ebp - 0x130], 1
jne 0x40cc05
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x128]
push str.This_volume_DiskNumber:_u_offset:_llu
call fcn.00414ac0
mov eax, dword [ebp - 0x138]
add esp, 0x10
cmp dword [ebp - 0x128], eax
jne 0x40cc05
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x120], eax
jne 0x40cc05
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x11c], eax
je 0x40cc5e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x40caf0
mov esi, 0x490
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push esi
push str.GetVentoyVolumeName_return__u
call fcn.00414ac0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
push str.This_volume_match
call fcn.00414ac0
add esp, 4
cmp dword [ebp + 0x14], 0
jne 0x40cc79
mov byte [ebp + esi - 0x111], 0x5c
lea eax, [ebp - 0x110]
push eax
push 0x43be74
push 0x104
push dword [ebp - 0x144]
call fcn.00401010
add esp, 0x10
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cc31
call fcn.0041fb8e
int3
Function at 0x40ccb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edx
push edi
push edi
mov dword [ebp - 0xc], ecx
call ebx
mov dword [ebp - 8], eax
lea esi, [eax + 1]
push esi
call fcn.0042442e
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
jne 0x40cced
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 8]
call ebx
mov eax, esi
cmp byte [eax], 0
je 0x40cd48
mov ebx, dword [ebp + 8]
nop dword [eax]
cmp edi, ebx
jge 0x40cd30
movsx ecx, byte [esi]
xor edx, edx
call fcn.0040d050
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jne 0x40cd30
movsx eax, byte [esi]
push ecx
push eax
push str._C:_is_belong_to_phydrive_d
call fcn.00414ac0
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov al, byte [esi]
mov byte [edi + ecx], al
inc edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cd35
sub eax, edx
inc esi
add esi, eax
cmp byte [esi], cl
jne 0x40cd00
mov eax, dword [ebp - 4]
push eax
call fcn.0042422d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0
mov edi, ecx
lea ecx, [ebp - 8]
shld eax, edx, 9
push ecx
shl edx, 9
push eax
push edx
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0x4000
call fcn.0042442e
add esp, 4
mov esi, eax
lea eax, [ebp + 0xc]
push 0
push eax
push 0x4000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call fcn.0042422d
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push edi
push str.Try_write_part2_bRet:_u_dwSize:_u_code:_u
call fcn.00414ac0
add esp, 0x10
test edi, edi
je 0x40eb39
cmp dword [ebp + 0xc], 0x4000
jne 0x40eb39
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40eff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push str.WriteGrubStage1ToPhyDrive_...
mov dword [ebp - 0x14], edx
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
call fcn.00414ac0
add esp, 4
push 0x100000
call fcn.0042442e
mov esi, eax
add esp, 4
test esi, esi
je 0x40f063
lea eax, [ebp - 8]
xor edx, edx
push eax
lea eax, [ebp - 4]
mov ecx, str.bootcore.img.xz
push eax
call fcn.00414d10
add esp, 8
test eax, eax
je 0x40f06e
push str.Failed_to_read_stage1_img
call fcn.00414ac0
add esp, 4
push esi
call fcn.0042422d
add esp, 4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push ecx
push eax
push esi
push 0
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041ee40
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x40f0bc
push str.Write_GPT_stage1_...
call fcn.00414ac0
add esp, 4
mov byte [esi + 0x1f4], 0x23
push 0
push 0
push 0x4400
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xc]
push eax
push 0xfbc00
jmp 0x40f0e4
push str.Write_MBR_stage1_...
call fcn.00414ac0
add esp, 4
push 0
push 0
push 0x200
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffe00
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xc]
push edi
push str.WriteFile_Ret:_u_dwSize:_u_ErrCode:_u
call fcn.00414ac0
push esi
call fcn.0042422d
add esp, 0x14
push dword [ebp - 4]
call fcn.0042422d
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411eb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x448004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0
push 0xfee00
xorps xmm0, xmm0
push esi
movlpd qword [ebp - 0x218], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x412046
cmp dword [ebp - 0x218], 0xfee00
jne 0x412046
cmp dword [ebp - 0x214], 0
jne 0x412046
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0
push eax
push 0x200
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x412019
cmp dword [ebp - 0x20c], 0x200
jne 0x412019
push 0
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
push eax
push 0
push 0xfee00
push esi
movlpd qword [ebp - 0x218], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x41200b
cmp dword [ebp - 0x218], 0xfee00
jne 0x41200b
cmp dword [ebp - 0x214], 0
jne 0x41200b
push 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0
push eax
push 0x200
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
je 0x411fde
cmp dword [ebp - 0x20c], 0x200
jne 0x411fde
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x20c]
push esi
push str.Failed_to_write__d__u__u
call fcn.00414ac0
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetFilePointer2_Failed__u
jmp 0x412052
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x20c]
push edi
push str.Failed_to_read__d__u_0x_x
call fcn.00414ac0
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetFilePointer1_Failed__u
call fcn.00414ac0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x412070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
push edi
push str.BackupDataBeforeCleanDisk__d
mov dword [ebp - 0x10], edi
xor ebx, ebx
xor esi, esi
call fcn.00414ac0
add esp, 4
mov dl, 1
mov ecx, edi
push 1
call fcn.0040cd60
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x4120be
push str.Failed_to_GetPhysicalHandle_for_write.
call fcn.00414ac0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00411eb0
test eax, eax
je 0x412258
push str.DiskCheckWriteAccess_success
call fcn.00414ac0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400000
call fcn.0042442e
mov esi, eax
add esp, 4
test esi, esi
je 0x412279
push ecx
mov ecx, dword [ebp - 0x10]
xor dl, dl
push 0
call fcn.0040cd60
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x412270
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x412265
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x200000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41223c
cmp dword [ebp - 4], 0x200000
jne 0x41223c
mov ecx, dword [esi + 0x220]
mov eax, dword [esi + 0x224]
mov edx, dword [ebp + 0xc]
shld eax, ecx, 9
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
shl ecx, 9
add eax, 0xffe00000
mov dword [ebp - 0xc], eax
adc edx, 0xffffffff
mov dword [ebp - 0x10], edx
cmp dword [ebp - 8], edx
jb 0x412221
ja 0x412192
cmp ecx, eax
jb 0x412221
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
ja 0x412221
jb 0x4121a5
cmp ecx, dword [ebp + 8]
jae 0x412221
push str.EFI_partition_table_check_success
call fcn.00414ac0
add esp, 4
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
push 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x412265
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x20], eax
jne 0x412265
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], eax
jne 0x412265
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0x200000
lea eax, [esi + 0x200000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41223c
cmp dword [ebp - 4], 0x200000
jne 0x41223c
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
xor esi, esi
lea ebx, [esi + 1]
jmp 0x412265
push dword [esi + 0x224]
push dword [esi + 0x220]
push str.Backup_EFI_LBA_not_in_last_2MB_range:__llu
call fcn.00414ac0
add esp, 0xc
jmp 0x412265
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push str.Failed_to_read__d__u_0x_x
call fcn.00414ac0
add esp, 0x10
jmp 0x412265
push str.DiskCheckWriteAccess_failed
call fcn.00414ac0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x412279
push esi
call fcn.0042422d
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
push eax
push ebx
push edi
push str.WriteBackupDataToDisk__llu__p__u
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
call fcn.00414ac0
add esp, 0x14
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
push 0
push eax
push ebx
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x412340
cmp dword [ebp - 0x1c], edi
jne 0x412340
cmp dword [ebp - 0x18], ebx
jne 0x412340
push 0
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x412328
cmp dword [ebp - 8], esi
jne 0x412328
push esi
push dword [ebp - 0x10]
push ebx
push dword [ebp + 8]
push str.WriteBackupDataToDisk__llu__p__u_success
call fcn.00414ac0
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 8]
push edi
push str.Failed_to_write__d__u__u
call fcn.00414ac0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x448004]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x20]
push eax
movzx eax, word [esp + 0x22]
push eax
movzx eax, word [esp + 0x24]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push eax
push str.__4d__02d__02d__02d:_02d:_02d._03d_
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.00401010
add esp, 0x28
mov edi, eax
lea eax, [ebp + 0xc]
mov ecx, 0x3ff
sub ecx, edi
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0x2c]
push ecx
push ecx
add eax, edi
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00424164
or ecx, 0xffffffff
add esp, 0x20
test eax, eax
cmovs eax, ecx
add edi, eax
cmp dword [0x44af04], 0
je 0x414be8
push 0x408
call fcn.0042442e
mov esi, eax
add esp, 4
test esi, esi
je 0x414c43
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 4]
push ecx
call fcn.00421640
mov eax, dword [0x44af00]
add esp, 0xc
mov dword [esi + 0x404], 0
mov dword [esi], edi
mov dword [0x44af00], esi
test eax, eax
je 0x414bce
mov dword [eax + 0x404], esi
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
mov dword [0x44aefc], esi
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
cmp dword [0x449410], 0
mov ecx, str.log.txt
mov eax, str.cli_log.txt
cmove eax, ecx
push 0x442c24
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0042528c
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x414c43
push eax
push edi
lea eax, [esp + 0x28]
push 1
push eax
call fcn.004246d7
push dword [esp + 0x1c]
push 1
push 1
push 0x442c3c
call fcn.004246d7
push dword [esp + 0x2c]
call fcn.00425151
add esp, 0x24
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret

Function at 0x414c60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x448004]
xor eax, esp
mov dword [esp + 0x10c], eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [esp + 0xc]
push 0x104
push 0x104
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00424164
add esp, 0x20
lea eax, [esp]
push 0
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x414cdd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
cmp dword [ebp + 8], 0
je 0x414cf1
test eax, eax
jne 0x414cf5
xor eax, eax
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x414cdd
mov ecx, dword [esp + 0x10c]
mov eax, 1
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
Function at 0x414d10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0
push 0x440774
lea eax, [ebp - 4]
mov edi, edx
push esi
push eax
call fcn.0042528c
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x414d55
push esi
push str.Failed_to_open_file__s
call fcn.00414ac0
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push 0
push eax
call fcn.00425d5f
add esp, 0xc
push dword [ebp - 4]
call fcn.00425963
mov esi, eax
add esp, 4
lea ecx, [esi + edi]
push ecx
call fcn.0042442e
mov edi, eax
add esp, 4
test edi, edi
jne 0x414d95
push dword [ebp - 4]
call fcn.00425151
add esp, 4
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push dword [ebp - 4]
call fcn.00425d5f
add esp, 0xc
push dword [ebp - 4]
push esi
push 1
push edi
call fcn.00426096
push dword [ebp - 4]
call fcn.00425151
mov eax, dword [ebp + 8]
add esp, 0x14
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret