joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004610
Capabilities:
Decompress data using quicklz

Disassembly:
endbr64
jmp fcn.180033090

Function at 0x180005066
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x28], rcx
cmp qword [rsp + 0x28], 0
jne 0x180005092
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 1
jmp 0x1800051b8
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x88]
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x20]
add rax, rcx
Function at 0x140003620
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
lea rcx, [rsp + 0x70]
mov r14d, 0x104
xor edx, edx
mov r8d, r14d
call fcn.140093c00
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
lea r15, [0x140142c20]
mov qword [rsp + 0x60], rsi
mov rcx, r15
mov qword [rsp + 0x50], rsi
xor edx, edx
mov dword [rsp + 0x5c], 0x1ff
mov r8d, 0x1ff
call fcn.140093c00
test rdi, rdi
je 0x140003820
mov rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rdi + rbx], sil
jne 0x1400036b2
test rbx, rbx
je 0x1400036cc
cmp byte [rdi + rbx], 0x5c
je 0x140003701
sub rbx, 1
jne 0x1400036c0
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140003773
mov qword [rsp + 0x60], rsi
jmp 0x14000380c
cmp rbx, r14
jae 0x140003820
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x140003710
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140093550
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400037bb
mov qword [rsp + 0x50], rsi
jmp 0x1400037fc
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Alex313031R3dusb
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400037bb
mov qword [rsp + 0x50], rsi
jmp 0x1400037fc
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x1400037f7
test eax, eax
jne 0x1400037fc
cmp dword [rsp + 0x58], 1
jne 0x1400037fc
cmp dword [rsp + 0x5c], esi
jbe 0x1400037fc
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000380c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000381c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140003822
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140092060
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140003910
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x60
cmp qword [0x1401128c8], 0
mov rsi, rdx
mov rbp, rcx
je 0x14000393f
call fcn.140020f90
xor ebx, ebx
test rax, rax
setne bl
mov eax, ebx
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
xor ebx, ebx
mov qword [rsp + 0x80], rdi
test rsi, rsi
jne 0x140003952
mov edi, ebx
jmp 0x140003968
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], bl
jne 0x140003960
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x50], rbx
test rbp, rbp
jne 0x140003998
mov r8d, 0x8a
lea rdx, str.C:_src_r3dusb_src_registry.h
lea rcx, str.key_name___NULL
call fcn.1400a15c4
jmp 0x140003aa2
mov edx, 0x5c
call fcn.140093068
test rax, rax
je 0x1400039c0
mov r8d, 0x91
lea rdx, str.C:_src_r3dusb_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400a15c4
mov edx, 0x5c
mov rcx, rbp
call fcn.140093068
test rax, rax
jne 0x140003aa2
lea rax, [rsp + 0x98]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140003a0c
mov qword [rsp + 0x98], rbx
jmp 0x140003a92
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAlex313031R3dusb
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140003a5a
mov qword [rsp + 0x50], rbx
jmp 0x140003a7f
mov rcx, qword [rsp + 0x50]
mov r9d, 1
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140003a92
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003aa2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x80]
mov eax, ebx
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400045e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebp, ebp
mov esi, r9d
cmp ecx, dword [0x14015b548]
mov r14d, r8d
mov rbx, rdx
mov edi, ecx
sete bpl
test ecx, ecx
js 0x1400047bf
lea eax, [rcx - 0x80]
cmp eax, 0x40
jbe 0x140004647
mov r8d, 0x184
lea rdx, str.C:_src_r3dusb_srcdrive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call fcn.1400a15c4
add edi, 0xffffff80
cmp edi, 0x40
ja 0x1400047bf
test rbx, rbx
jne 0x140004724
xor ecx, ecx
lea eax, [rcx + 1]
mov edx, 0x40
mov dword [rsp + 0x28], eax
lea r9, str.Harddisk_luPartition_lu
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], edi
lea r8, [rdx - 0x41]
call fcn.1400034e0
mov eax, dword [0x1400d6ce8]
lea rdx, [rsp + 0x7e]
movsd xmm0, qword [str._GLOBALROOT]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], eax
mov r8d, 0xf6
movzx eax, word [0x1400d6cec]
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x6f], 0
movsd qword [rsp + 0x70], xmm0
mov byte [rsp + 0x7e], 0
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x140004790
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400046e0
cmp rax, 0x14
jb 0x140004790
test r14d, r14d
je 0x140004715
mov r9, 0xffffffffffffffff
lea r8, [0x1400d72e8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14009b5bc
lea rcx, [rsp + 0x70]
call fcn.1400a1b50
jmp 0x1400047c1
test ebp, ebp
je 0x1400047af
xor ecx, ecx
lea rax, [0x14015b5b0]
cmp rbx, qword [rax]
je 0x14000465e
cmp rbx, qword [rax + 0x58]
je 0x140004770
cmp rbx, qword [rax + 0xb0]
je 0x14000476b
cmp rbx, qword [rax + 0x108]
je 0x140004766
add rax, 0x160
add ecx, 4
cmp ecx, 0x10
jb 0x140004735
jmp 0x14000477b
add ecx, 3
jmp 0x140004772
add ecx, 2
jmp 0x140004772
inc ecx
cmp ecx, 0x10
jb 0x14000465e
test esi, esi
jne 0x1400047bf
mov rdx, rbx
lea rcx, str.Error:_Could_not_find_a_partition_at_offset__lld_on_this_disk
call fcn.140041aa0
jmp 0x1400047bf
test esi, esi
jne 0x1400047bf
call fcn.140041e50
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, str.Could_not_find_a_DOS_volume_name_for__s:__s
call fcn.140041aa0
jmp 0x1400047bf
test esi, esi
jne 0x1400047bf
lea rcx, str.Error:_Searching_for_a_partition_on_a_non_matching_disk
call fcn.140041aa0
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140092060
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140005150
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0
mov edx, 0x560000
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400051e6
cmp dword [rsp + 0x40], 0
jbe 0x1400051e6
mov eax, dword [rsp + 0x60]
cmp eax, 1
jb 0x1400051e6
cmp eax, 2
jb 0x1400051e0
mov rdx, rbx
lea rcx, str.Ignoring_drive__s_as_it_spans_multiple_disks__RAID__
call fcn.140041aa0
jmp 0x140005280
mov eax, dword [rsp + 0x68]
jmp 0x14000522e
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 0xc
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x2d1080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140005253
cmp dword [rsp + 0x40], 0
je 0x140005253
mov eax, dword [rsp + 0x4c]
cmp eax, 0x40
jl 0x140005285
mov r8d, eax
lea rcx, str.Device_Number_for_device__s_is_too_big___d____ignoring_device
mov rdx, rbx
call fcn.140041aa0
lea rcx, str.NOTE:_This_may_be_due_to_an_excess_of_Virtual_Drives__such_as_hidden_ones_created_by_the_XBox_PC_app
call fcn.140041aa0
jmp 0x140005280
cmp dword [0x14015a340], 0
je 0x140005280
test eax, eax
je 0x140005269
lea rax, str._empty_data_
jmp 0x14000526e
call fcn.140041e50
mov r8, rax
lea rcx, str.Could_not_get_device_number_for_device__s__s
mov rdx, rbx
call fcn.140041aa0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140092060
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x140005990
Capabilities:
Get disk information

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x1400059eb
call fcn.140041e50
mov rdx, rax
lea rcx, str.GetLogicalDriveStrings_failed:__s
call fcn.140041aa0
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140092060
add rsp, 0xa8
ret
cmp eax, 0x69
jbe 0x140005a1e
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
mov edx, eax
call fcn.140041aa0
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140092060
add rsp, 0xa8
ret
movzx eax, byte [rsp + 0x20]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rsi
xor esi, esi
mov qword [rsp + 0xa0], rdi
mov dil, 0x43
lea rbx, [rsp + 0x20]
test al, al
je 0x140005a9d
nop dword [rax]
movsx ecx, al
call fcn.1400a1bd0
test eax, eax
je 0x140005a69
movsx ecx, byte [rbx]
call fcn.1400a1974
cmp dil, al
je 0x140005a98
test rbx, rbx
jne 0x140005a73
mov rax, rsi
jmp 0x140005a89
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x140005a80
inc rbx
add rbx, rax
movzx eax, byte [rbx]
test al, al
jne 0x140005a50
jmp 0x140005aab
movzx eax, byte [rsp + 0x20]
cmp byte [rbx], sil
je 0x140005aab
inc dil
cmp dil, 0x5a
jle 0x140005a40
mov rbx, qword [rsp + 0xb0]
cmp dil, 0x5a
movzx ecx, dil
mov rdi, qword [rsp + 0xa0]
cmovle esi, ecx
movzx eax, sil
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140092060
add rsp, 0xa8
ret
Function at 0x1400060a0
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.140092620
sub rsp, rax
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov esi, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x1000
xor edi, edi
call fcn.140093c00
mov ecx, esi
call fcn.140003f00
mov r9d, 1
xor edx, edx
mov r8d, r9d
mov rcx, rax
mov rbx, rax
call fcn.140003b60
mov rcx, rbx
mov rbp, rax
call fcn.14009b5a0
cmp rbp, 0xffffffffffffffff
jne 0x14000611a
xor eax, eax
jmp 0x1400061ff
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400061d8
cmp dword [rsp + 0x40], edi
jbe 0x1400061d8
mov r10, qword [rsp + 0x54]
mov edx, edi
test r10d, r10d
je 0x1400061ee
mov r9d, dword [rsp + 0x50]
mov r11, qword [0x1400d8938]
mov rbx, qword [0x1400d8930]
mov eax, edx
test r9d, r9d
jne 0x140006198
lea rcx, [rax + rax*8]
add rcx, rcx
cmp byte [rsp + rcx*8 + 0xa0], 0xef
jmp 0x1400061bc
cmp r9d, 1
jne 0x1400061be
lea rcx, [rax + rax*8]
shl rcx, 4
lea r8, [rsp + 0xa0]
add r8, rcx
je 0x1400061be
cmp qword [r8], rbx
jne 0x1400061be
cmp qword [r8 + 8], r11
je 0x1400061c7
inc edx
cmp edx, r10d
jb 0x140006180
jmp 0x1400061ee
lea rcx, [rax + rax*8]
add rcx, rcx
mov rdi, qword [rsp + rcx*8 + 0x88]
jmp 0x1400061ee
call fcn.140041e50
mov r8, rax
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov edx, esi
call fcn.140041aa0
test rbp, rbp
je 0x1400061fc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140092060
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007ce0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx eax, word [0x1400d80d4]
mov rdi, rdx
mov word [rsp + 0x20], ax
mov rbx, rcx
movzx eax, byte [0x1400d80d6]
mov byte [rsp + 0x22], al
test rcx, rcx
je 0x140007edc
test rdx, rdx
je 0x140007edc
cmp byte [rcx], 0x3f
je 0x140007edc
mov r8d, 0xe
lea rdx, str._GLOBALROOT
mov rcx, rdi
call fcn.1400a1ed4
test eax, eax
jne 0x140007da9
movzx eax, byte [rbx]
lea r8, [rdi + 0xe]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], al
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
movsx ecx, byte [rbx]
test eax, eax
jne 0x140007d88
call fcn.1400a1974
mov r8d, eax
lea rcx, str.Could_not_mount__s_as__c:
mov rdx, rdi
call fcn.140041aa0
jmp 0x140007ee7
call fcn.1400a1974
mov r8d, eax
lea rcx, str._s_was_successfully_mounted_as__c:
mov rdx, rdi
call fcn.140041aa0
mov eax, 1
jmp 0x140007ee9
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
jne 0x140007d9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
jne 0x140007ee7
lea r8d, [rax - 0x5d]
mov rcx, rbx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x140007df9
call fcn.140041e50
mov r8, rax
lea rcx, str._s_is_already_mounted__but_volume_GUID_could_not_be_checked:__s
mov rdx, rbx
call fcn.140041aa0
jmp 0x140007e32
lea r8, [rsp + 0x28]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140007e17
inc rax
test ecx, ecx
jne 0x140007e04
test edx, edx
je 0x140007d9f
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
lea rcx, str._s_is_mounted__but_volume_GUID_doesnt_match:_r_n__expected__s__got__s
call fcn.140041aa0
lea rcx, str.Retrying_after_dismount...
call fcn.140041aa0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
test eax, eax
jne 0x140007e62
call fcn.140041e50
mov r8, rax
lea rcx, str.Warning:_Could_not_delete_volume_mountpoint__s:__s
mov rdx, rbx
call fcn.140041aa0
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
jne 0x140007d9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
jne 0x140007ee7
lea r8d, [rax - 0x5d]
mov rcx, rbx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x140007ee7
lea r8, [rsp + 0x28]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140007eb7
inc rax
test ecx, ecx
jne 0x140007ea4
test edx, edx
jne 0x140007ee7
movsx ecx, byte [rbx]
call fcn.1400a1974
mov r8d, eax
lea rcx, str._s_was_remounted_as__c:__second_time_lucky__
mov rdx, rdi
call fcn.140041aa0
mov eax, 1
jmp 0x140007ee9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140092060
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140008080
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov eax, dword [str..:]
xor r9d, r9d
mov dword [rsp + 0x40], eax
mov ebp, edx
movzx eax, word [0x1400d776c]
mov rdi, rcx
mov word [rsp + 0x44], ax
mov edx, 0xc0000000
movzx eax, byte [0x1400d776e]
lea r8d, [r9 + 3]
mov qword [r11 - 0x78], 0
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r14
movsx r14d, byte [rcx]
lea rcx, [r11 - 0x68]
mov byte [rsp + 0x46], al
mov dword [rsp + 0x28], 0x80
mov byte [r11 - 0x64], r14b
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000812f
call fcn.140041e50
mov ecx, r14d
mov rbx, rax
call fcn.1400a1974
mov edx, eax
lea rcx, str.Failed_to_open__c:_for_flushing:__s
mov r8, rbx
call fcn.140041aa0
jmp 0x14000816b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14000815d
call fcn.140041e50
mov ecx, r14d
mov rbx, rax
call fcn.1400a1974
mov edx, eax
lea rcx, str.Failed_to_flush__c:__s
mov r8, rbx
call fcn.140041aa0
test rsi, rsi
je 0x14000816b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x33
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
test eax, eax
je 0x1400081c4
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140007ce0
test eax, eax
je 0x1400081e4
test ebp, ebp
jne 0x1400081c4
movsx ecx, byte [rdi]
call fcn.1400a1974
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, str.Successfully_remounted__s_as__c:
call fcn.140041aa0
mov eax, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140092060
add rsp, 0x90
pop rdi
pop rbp
pop rbx
ret
test ebp, ebp
jne 0x14000820f
call fcn.140041e50
movsx ecx, byte [rdi]
mov rbx, rax
call fcn.1400a1974
mov r8d, eax
lea rdx, [rsp + 0x48]
mov r9, rbx
lea rcx, str.Could_not_remount__s_as__c:__s
call fcn.140041aa0
mov dword [0x140111620], 0xe0031209
xor eax, eax
jmp 0x1400081c9
Function at 0x140009510
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.140003550
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140009547
mov rcx, rbx
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009570
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
lea rcx, [rsp + 0x70]
mov r14d, 0x104
xor edx, edx
mov r8d, r14d
mov r15, r9
call fcn.140093c00
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
xor eax, eax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x5c], 4
mov dword [r15], eax
test rdi, rdi
je 0x140009760
mov rax, 0xffffffffffffffff
mov rbx, rax
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], sil
jne 0x1400095f0
test rbx, rbx
je 0x14000960c
nop
cmp byte [rdi + rbx], 0x5c
je 0x140009641
sub rbx, 1
jne 0x140009600
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400096b3
mov qword [rsp + 0x60], rsi
jmp 0x14000974c
cmp rbx, r14
jae 0x140009760
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x140009650
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140093550
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400096fb
mov qword [rsp + 0x50], rsi
jmp 0x14000973c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Alex313031R3dusb
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400096fb
mov qword [rsp + 0x50], rsi
jmp 0x14000973c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140009737
test eax, eax
jne 0x14000973c
cmp dword [rsp + 0x58], 4
jne 0x14000973c
cmp dword [rsp + 0x5c], esi
jbe 0x14000973c
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000974c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000975c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140009762
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140092060
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010bc0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
test rdx, rdx
jne 0x140010bd0
xor eax, eax
add rsp, 0x58
ret
movaps xmmword [rsp + 0x40], xmm6
xor eax, eax
movaps xmmword [rsp + 0x30], xmm7
xorps xmm6, xmm6
xorps xmm7, xmm7
cvtsi2ss xmm7, rdx
cvtsi2ss xmm6, rcx
movaps xmm1, xmm7
mulss xmm1, dword [0x14014304c]
movaps xmm0, xmm6
mulss xmm0, dword [0x14010a740]
addss xmm1, xmm0
movss xmm0, dword [0x1400f6514]
comiss xmm1, xmm0
jb 0x140010c29
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x140010c29
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttss2si r8, xmm1
mov r9, rdx
mov dword [rsp + 0x20], 0
mov edx, 0xc91
mov ecx, 4
add r8, rax
call fcn.1400527d0
movss xmm0, dword [0x1400f64f4]
divss xmm6, xmm7
minss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
mulss xmm6, xmm0
cvttss2si rax, xmm6
movaps xmm6, xmmword [rsp + 0x40]
cmp rax, qword [0x14010a738]
je 0x140010d19
lea rcx, [0x1400d9b90]
mov qword [rsp + 0x50], rbx
mov qword [0x14010a738], rax
call fcn.140003550
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x140111ab0]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140010d0c
mov r9d, 0x7ffffffe
mov edx, 0xb1
mov r8d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140111ab0]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140111ab0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xba
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x140111ab0]
xor r8d, r8d
movsxd r9, eax
mov edx, 0xb6
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.14009b5a0
mov rbx, qword [rsp + 0x50]
mov eax, dword [0x140111620]
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x7f2bb751
add rsp, 0x58
ret