joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58f3f0
Capabilities:
Start service

Disassembly:
push ebx
call fcn.00662480
test eax, eax
jne 0x58f3fc
pop ebx
ret
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x58f412
mov dword [0x9cf798], 0x57
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
xor esi, esi
push 0xf003f
push esi
push esi
xor ebp, ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x58f44f
push 0x10
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x58f44f
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test ebp, ebp
mov dword [0x9cf798], 0
jne 0x58f48d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x9dce80]
mov dword [0x9cf798], eax
test ecx, ecx
je 0x58f48d
push eax
push eax
push str.CTSDEncryptDrv:_StartService___failed__error_ld_0x_08x__n
push str.TSDEncryptDrv
push 4
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x58f49a
push esi
call ebx
test edi, edi
je 0x58f4a1
push edi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x59a510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x87a608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esi + 0xc]
lea ecx, [esi + 4]
push 0
push eax
mov dword [eax], ecx
push 2
push 2
lea ecx, [esp + 0x1c]
mov dword [esi + 8], esi
mov dword [esi + 0x10], 0x4139e0
call fcn.005794a0
lea edx, [esp + 4]
mov ecx, 0x9cf1a8
push edx
mov dword [esp + 0x50], 0
call fcn.0057a890
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x34], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x3c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x40], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x4c], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x60], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.00579500
mov ecx, dword [esp + 0x44]
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret

Function at 0x59a6a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x87a648
push eax
mov eax, dword [0x9d066c]
mov dword fs:[0], esp
sub esp, 0x28
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x59a6db
call esi
sub eax, dword [0x9d0668]
cmp eax, 0xea60
jbe 0x59a764
mov dword [0x9d066c], 1
call esi
lea ecx, [esp + 8]
mov dword [0x9d0668], eax
mov dword [0x9d0664], 0
call fcn.00581a80
push 0
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.TSDED_Plain_Bak_Notify_Interval
mov dword [esp + 0x40], 0
call fcn.00617650
lea ecx, [esp + 0x10]
call fcn.00581c70
cmp dword [esp + 0x28], 0xf0000001
je 0x59a739
mov dword [0x9d0664], 0
jmp 0x59a753
lea ecx, [esp + 8]
call fcn.00582130
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [0x9d0664], eax
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0xffffffff
call fcn.00581bd0
mov ecx, dword [esp + 0x2c]
mov eax, dword [0x9d0664]
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret
Function at 0x59a780
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x87a668
push eax
mov eax, dword [0x9d0674]
mov dword fs:[0], esp
sub esp, 0x28
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x59a7bb
call esi
sub eax, dword [0x9d0670]
cmp eax, 0xea60
jbe 0x59a83e
mov dword [0x9d0674], 1
call esi
lea ecx, [esp + 8]
mov dword [0x9d0670], eax
mov dword [0x9d0678], 0
call fcn.00581a80
push 0
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push 0x89fe64
mov dword [esp + 0x40], 0
call fcn.00617650
lea ecx, [esp + 0x10]
call fcn.00581c70
cmp dword [esp + 0x28], 0xf0000001
je 0x59a819
mov dword [0x9d0678], 0
jmp 0x59a82d
lea ecx, [esp + 8]
call fcn.00582130
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [0x9d0678], eax
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0xffffffff
call fcn.00581bd0
mov ecx, dword [esp + 0x2c]
mov eax, dword [0x9d0678]
mov dword fs:[0], ecx
pop esi
add esp, 0x34
ret
Function at 0x59bf70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87a918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, 0x893fcc
xor ebx, ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov eax, dword [0x8ab26c]
mov dword [esp + 0x48], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 8], eax
lea eax, [esp + 8]
lea edx, [esp + 0x18]
push eax
push edx
lea eax, [esp + 0x5c]
lea edx, [esp + 0x14]
push eax
push edx
lea eax, [esp + 0x3c]
lea edx, [esp + 0x60]
push eax
mov eax, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x68]
push eax
push edx
mov byte [esp + 0x68], 3
call fcn.0059bda0
push ecx
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00617440
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x5c], 4
call fcn.00617440
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x3c]
push ecx
push edx
mov ecx, 0x9ce188
mov byte [esp + 0x60], 3
call fcn.005074b0
cmp dword [0x9dce80], ebx
je 0x59c07b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x54]
push ecx
push edx
push eax
push str.CTSDPolicySDHelper::RefreshDlgMgrOSConfig.bSpecifyObjApply__d___strwOSConfigApply__s___bSpecifyObjOutSend__d___strwOSConfigOutSend__s_
push str.AdvancedOutSend
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x20
lea ecx, [esp + 8]
mov byte [esp + 0x48], 2
call fcn.00617ec0
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x48], 5
cmp eax, ebx
je 0x59c0a3
push eax
call fcn.008325dd
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], bl
call fcn.00617ec0
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x48], 6
cmp eax, ebx
je 0x59c0cd
push eax
call fcn.008325dd
add esp, 4
mov ecx, dword [esp + 0x40]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x44
ret 8
Function at 0x59c150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x87a971
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x8ab268]
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x14]
mov dword [edi], eax
xor ebp, ebp
lea ecx, [esi + 0x18]
push ebp
push ebp
mov dword [esp + 0x20], ebp
call fcn.0059c920
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0x34]
mov byte [esp + 0x30], 1
mov dword [esi + 0x28], 0x89ff00
call fcn.00579760
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0x4c]
call fcn.005794a0
push 0x9bec2c
mov ecx, edi
mov byte [esp + 0x1c], 2
mov dword [esi], 0x89feec
mov dword [esi + 4], ebp
call fcn.006129f0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x30], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], ebp
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x59c280
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x87a9a8
push eax
mov eax, dword [0x9dce80]
mov dword fs:[0], esp
sub esp, 0x40
test eax, eax
push esi
mov esi, ecx
je 0x59c2bd
push str.CTSDPolicyUpdateHelper::Initialize
push str.TSDPolicy
push 1
push 0x9dc5ec
call fcn.006600d0
add esp, 0x10
mov eax, dword [esi + 0x14]
lea ecx, [esi + 0x1c]
push eax
mov dword [esi + 0x2c], esi
mov dword [esi + 0x24], esi
call fcn.0063e7e0
call fcn.0064f790
push eax
lea ecx, [esi + 0x18]
call fcn.0064f650
push 0xffffffffffffffff
lea eax, [esi + 0x34]
push 0x4e20
lea ecx, [esi + 0x28]
push 0
push eax
mov dword [eax], ecx
push 0
push 2
lea ecx, [esp + 0x1c]
mov dword [esi + 0x38], 0x4139e0
call fcn.005794a0
lea edx, [esp + 4]
mov ecx, 0x9cf1a8
push edx
mov dword [esp + 0x50], 0
call fcn.0057a890
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x5c], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x68], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x74], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x88], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.00579500
mov ecx, dword [esp + 0x44]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x59c408
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87a9c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
call fcn.00569300
push eax
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0xc]
call fcn.005688e0
mov ecx, dword [esi + 8]
mov dword [esp + 0x30], 0
push ecx
lea ecx, [esp + 8]
call fcn.00569270
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00569110
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x59e8b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87ad98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], 0x893ff0
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x28], 0x893fe4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x11
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0xa
lea eax, [esp + 0x14]
lea edx, [esp + 0x28]
push eax
push edx
mov byte [esp + 0x54], 1
call fcn.0059ea90
mov ebx, dword [esp + 0x54]
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 8]
cmp eax, esi
jle 0x59ea03
push ebp
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov eax, dword [0x8ab26c]
mov dword [esp + 0x58], eax
mov eax, dword [ebx + 4]
mov edx, ebp
lea ecx, [esp + 0x58]
add edx, eax
push ecx
push edx
mov ecx, 0x9ce3b8
mov byte [esp + 0x58], 2
call fcn.005270c0
test eax, eax
jne 0x59e9c3
add ebp, dword [ebx + 4]
push ebp
call fcn.004b5de0
xor edx, edx
div dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cmp eax, esi
je 0x59e9c3
mov eax, dword [eax + edx*4]
cmp eax, esi
je 0x59e9c3
mov ecx, 4
mov edi, ebp
lea esi, [eax + 8]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x59e99e
mov eax, dword [eax]
test eax, eax
jne 0x59e986
jmp 0x59e9c1
test eax, eax
je 0x59e9c1
mov eax, dword [eax + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
shl ecx, 5
add ecx, eax
shl ecx, 5
lea eax, [ecx + edx + 0x10]
lea ecx, [esp + 0x58]
push eax
call fcn.006181a0
xor esi, esi
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x58]
push edx
mov eax, dword [ecx + 4]
push eax
call fcn.0061f330
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], 1
call fcn.00617ec0
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx + 8]
inc eax
add ebp, 0x10
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebp
jl 0x59e93f
pop ebp
mov dword [esp + 0x28], method.CCommandLineInfo.virtual_0
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x4c], 3
cmp edi, esi
je 0x59ea36
mov eax, dword [esp + 0x30]
cmp eax, esi
jbe 0x59ea36
mov ecx, edi
mov edx, eax
mov eax, dword [ecx]
cmp eax, esi
je 0x59ea30
mov eax, dword [eax]
cmp eax, esi
jne 0x59ea2a
add ecx, 4
dec edx
jne 0x59ea24
push edi
call fcn.008325dd
mov ecx, dword [esp + 0x40]
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.0082b415
mov dword [esp + 0x3c], esi
mov dword [esp + 0x14], 0x893ff0
mov eax, dword [esp + 0x18]
pop edi
cmp eax, esi
pop esi
mov dword [esp + 0x44], 4
pop ebx
je 0x59ea7c
push eax
call fcn.008325dd
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret 8
Function at 0x5aaeb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87c270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
lea eax, [esp + 4]
push edi
push eax
xor edi, edi
call fcn.005ab000
mov ecx, dword [esp + 8]
mov dword [esp + 0x30], edi
mov esi, dword [ecx - 8]
cmp esi, edi
je 0x5aafcf
cmp esi, 0x1f
jle 0x5aaef3
mov esi, 0x1f
lea edx, [esp + 0xc]
push esi
push edx
lea ecx, [esp + 0x10]
call fcn.00614e90
mov byte [esp + 0x30], 1
call fcn.00637540
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.00638540
mov eax, dword [esp + 0xc]
push esi
push eax
push 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 3
call fcn.006385d0
cmp dword [esp + 0x38], edi
je 0x5aaf5f
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.00636d30
push eax
mov ecx, esi
call fcn.00637460
push eax
lea ecx, [esp + 0x1c]
call fcn.006387c0
mov esi, 1
jmp 0x5aaf83
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
push edx
mov ecx, esi
call fcn.00636d30
push eax
mov ecx, esi
call fcn.00637460
push eax
lea ecx, [esp + 0x1c]
call fcn.00638a20
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.00638580
mov byte [esp + 0x30], 1
call fcn.00637740
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00612730
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00612730
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00612730
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x5b1340
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.005b12e0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
pop esi
jne 0x5b1372
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00835145
ret 8

Function at 0x5b1344
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.005b12e0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
pop esi
jne 0x5b1372
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00835145
ret 8

Function at 0x5b1380
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 8]
push edi
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x5b13bb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x5b13b7
mov esi, dword [esi + 0xc]
push esi
call edi
push eax
call fcn.00835145
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret

Function at 0x5b1383
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 8]
push edi
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x5b13bb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x5b13b7
mov esi, dword [esi + 0xc]
push esi
call edi
push eax
call fcn.00835145
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret
Function at 0x5be5b0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x1c4
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x132]
mov word [esp + 0x130], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x32]
mov word [esp + 0x30], si
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x1d4]
mov ecx, 0x37
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x54]
mov dword [esp + 0x50], esi
push ebp
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x5be746
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x130]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x10
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x148]
push 0x50
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push ebp
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, dword [esp + 0x1c]
mov ecx, 0x38
xor eax, eax
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, edi
or edx, ebx
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
je 0x5be6e3
mov edx, edi
push esi
sub edx, eax
mov eax, ebx
sbb eax, ecx
push 0x3e8
push eax
push edx
call fcn.005fd650
push ebx
push edi
push edx
push eax
call fcn.005fd690
mov dword [esp + 0x64], eax
lea ecx, [esp + 0x68]
push 4
push ecx
push 0xffffffffffffffff
push ebp
call fcn.005814c0
lea edx, [esp + 0x80]
push 0x50
push edx
lea eax, [esp + 0x14c]
push 0xffffffffffffffff
push eax
call fcn.005814c0
lea ecx, [esp + 0x130]
push 0x10
push ecx
lea edx, [esp + 0x5c]
push 0xffffffffffffffff
push edx
call fcn.005814c0
mov edi, dword [esp + 0x20c]
add esp, 0x30
mov ecx, 0x38
lea esi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c4
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x1c4
ret

Function at 0x5be760
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
xor eax, eax
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
lea edx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x5be79f
add esp, 0x18
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov ecx, 0x14
call fcn.005fd550
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, 1
add esp, 0x18
ret
Function at 0x5c0635
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x9dce80]
sub esp, 0x214
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov ebp, ecx
je 0x5c0644
mov eax, dword [ebp + 4]
push eax
push str.CVolumeMountPointMgr::GetVolumeSubstAssociateW__________d_
push str.VolumeMountPoint
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
mov eax, dword [esp + 0x228]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x5c07d6
mov cx, word [eax]
xor eax, eax
mov word [esp + 0x14], cx
mov ecx, 0x81
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x1c]
push 0x104
lea eax, [esp + 0x18]
push edx
mov dword [esp + 0x1e], ebx
push eax
mov word [esp + 0x22], 0x3a
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov edi, eax
mov eax, dword [0x9dce80]
cmp eax, ebx
je 0x5c06c3
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push ecx
push edx
push str.CVolumeMountPointMgr::GetVolumeSubstAssociateW_1___s____s_
push str.VolumeMountPoint
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
cmp edi, ebx
je 0x5c07e0
lea eax, [esp + 0x1c]
push eax
call fcn.005fc40b
add esp, 4
test eax, eax
je 0x5c07e0
mov ebx, dword [esp + 0x22c]
mov ecx, ebp
push ebx
call fcn.005c0830
mov esi, dword [ebx + 8]
dec esi
js 0x5c07c6
mov ecx, esi
shl ecx, 6
add ecx, esi
lea edi, [esi + ecx*2]
shl edi, 3
mov eax, dword [0x9dce80]
test eax, eax
je 0x5c0740
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x1c]
push ecx
lea eax, [edi + edx]
lea edx, [eax + 0x210]
lea ecx, [eax + 8]
push edx
push ecx
push eax
push esi
push str.CVolumeMountPointMgr::GetVolumeSubstAssociateW_Match__n___d__3___s____s____s____s_
push str.VolumeMountPoint
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x24
mov eax, dword [ebx + 4]
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + eax + 0x210]
push ecx
call fcn.005fd3f1
add esp, 8
test eax, eax
je 0x5c07b7
mov eax, dword [0x9dce80]
test eax, eax
je 0x5c0787
mov ecx, dword [ebx + 4]
mov edx, edi
add edx, ecx
push edx
push esi
push str.CVolumeMountPointMgr::GetVolumeSubstAssociateW_Match__n___d__3___s________
push str.VolumeMountPoint
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
mov eax, dword [ebx + 8]
sub eax, esi
dec eax
je 0x5c07b4
mov ecx, dword [ebx + 4]
mov edx, eax
shl edx, 6
add edx, eax
lea eax, [eax + edx*2]
lea edx, [edi + ecx + 0x418]
shl eax, 3
push eax
lea eax, [edi + ecx]
push edx
push eax
call fcn.005fcc10
add esp, 0xc
dec dword [ebx + 8]
dec esi
sub edi, 0x418
test esi, esi
jge 0x5c0706
mov eax, dword [ebx + 8]
xor ecx, ecx
test eax, eax
setg cl
mov esi, ecx
xor ebx, ebx
jmp 0x5c07e8
mov dword [esp + 0x10], 1
jmp 0x5c07e8
mov dword [esp + 0x10], 2
cmp dword [0x9dce80], ebx
je 0x5c0813
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 4]
push edx
push esi
push eax
push str.CVolumeMountPointMgr::GetVolumeSubstAssociateW______d___ret___d___myerror___d_
push str.VolumeMountPoint
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8