joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aadc
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x004430c0], 0
je 0x42ab00
mov r8d, 1
jmp 0x42ac5b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x42ab64
movsxd rdx, dword [rbx + 0x3c]
mov edx, dword [rbx + rdx + 0x88]
test edx, edx
je 0x42ab5c
mov eax, edx
add rax, rbx
mov edx, dword [rax + 0xc]
add rdx, rbx
mov r8d, dword [rdx]
or r8d, 0x20202020
cmp r8d, 0x6c64746e
jne 0x42ab5c
mov edx, dword [rdx + 4]
or edx, 0x20202020
cmp edx, 0x6c642e6c
je 0x42ab73
mov rcx, qword [rcx]
mov rdx, rbx
jmp 0x42ab15
xor r8d, r8d
test rax, rax
je 0x42ac5b
mov rbx, rdx
mov r13d, dword [rax + 0x1c]
mov edx, dword [rax + 0x18]
xor esi, esi
lea r14, [0x004430c8]
mov r12d, dword [rax + 0x24]
mov eax, dword [rax + 0x20]
lea edi, [rdx - 1]
add r13, rbx
add rax, rbx
add r12, rbx
lea r15, [rax + rdi*4]
add rdi, rdi
add rdi, r12
mov ecx, dword [r15]
add rcx, rbx
cmp word [rcx], 0x775a
jne 0x42abdf
call fcn.0042aa20
mov ebp, esi
inc esi
shl rbp, 4
add rbp, r14
mov dword [rbp], eax
movzx eax, word [rdi]
mov ecx, dword [r13 + rax*4]
mov dword [rbp + 4], ecx
add rcx, rbx
call fcn.0042aa48
mov qword [rbp + 8], rax
cmp esi, 0x1f4
je 0x42abf1
sub r15, 4
lea rax, [rdi - 2]
cmp r12, rdi
je 0x42abf1
mov rdi, rax
jmp 0x42aba0
mov dword [0x004430c0], esi
lea r10, [0x004430c8]
dec esi
test esi, esi
je 0x42aaf5
lea rdx, [0x004430c0]
xor ecx, ecx
cmp ecx, esi
jae 0x42ac57
lea eax, [rcx + 1]
mov r8d, dword [rdx + 0xc]
mov rcx, rax
shl rax, 4
add rax, r10
mov r9d, dword [rax + 4]
cmp r8d, r9d
jbe 0x42ac51
mov ebx, dword [rdx + 8]
mov r11, qword [rdx + 0x10]
mov edi, dword [rax]
mov dword [rdx + 0xc], r9d
mov r9, qword [rax + 8]
mov dword [rdx + 8], edi
mov qword [rdx + 0x10], r9
mov dword [rax], ebx
mov dword [rax + 4], r8d
mov qword [rax + 8], r11
add rdx, 0x10
jmp 0x42ac11
dec esi
jmp 0x42ac00
mov eax, r8d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x437fe0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
sub rsp, 0x28
or eax, 0xffffffff
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x438009
mov r10, qword [rcx]
xor edx, edx
lea r8, [0x0046eb00]
cmp rdx, r10
jl 0x4380ba
not eax
mov edx, 8
mov ebx, eax
call fcn.004055ca
mov rcx, rsi
mov rdx, rax
call fcn.004052c8
mov eax, ebx
lea r8, [0x0046eac0]
mov edx, ebx
and eax, 0xf
mov rcx, qword [rsi]
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x17], al
mov rax, rdx
sar rax, 4
and eax, 0xf
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x16], al
mov rax, rdx
sar rax, 8
and eax, 0xf
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x15], al
mov rax, rdx
sar rax, 0xc
and eax, 0xf
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x14], al
mov rax, rdx
sar rax, 0x10
and eax, 0xf
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x13], al
mov rax, rdx
sar rax, 0x14
and eax, 0xf
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x12], al
mov rax, rdx
sar rdx, 0x1c
sar rax, 0x18
and eax, 0xf
mov al, byte [r8 + rax + 0x10]
mov byte [rcx + 0x11], al
mov al, byte [r8 + rdx + 0x10]
mov byte [rcx + 0x10], al
add rsp, 0x28
pop rbx
pop rsi
ret
mov r9d, eax
xor al, byte [rcx + rdx + 0x10]
inc rdx
movzx eax, al
shr r9d, 8
xor r9d, dword [r8 + rax*4]
mov eax, r9d
jmp 0x438000

Function at 0x43c7f1
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x38
lea rax, [0x0043c770]
mov qword [rsp + 0x28], rax
call fcn.004017a5
call fcn.00401c10
call fcn.00402988
call fcn.00408830
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rdx, qword [0x00476780]
mov ecx, eax
mov rax, qword [0x00476760]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rsp + 0x28]
call fcn.0040666f
call fcn.004087c1
call fcn.0040b88b
call fcn.0040c08b
call fcn.0040f2aa
call fcn.0041110f
call fcn.004115fb
call fcn.0041211d
call fcn.00412aa2
call fcn.004138ad
call fcn.00414514
call fcn.00416132
call fcn.00416251
call fcn.004164b1
call fcn.004173a1
call fcn.004180ff
call fcn.00418771
call fcn.00418b79
call fcn.00418c20
call fcn.00418e40
call fcn.00419394
call fcn.0041b99c
call fcn.0041d881
call fcn.0041db89
call fcn.0041e9ef
call fcn.0041fd30
call fcn.00420040
call fcn.004202f0
call fcn.004203e0
call fcn.004205b0
call fcn.004206bc
call fcn.00422b10
call fcn.00422b78
call fcn.00422bc0
call fcn.00422c10
call fcn.00422c90
call fcn.00422ce0
call fcn.00422f36
call fcn.00423bef
call fcn.004279b7
call fcn.00429f2e
call fcn.0042b4f6
call fcn.0042b5a0
call fcn.0042b991
call fcn.0042c1e1
call fcn.0042f0e1
call fcn.00430f8a
call fcn.00431f41
call fcn.00433590
call fcn.00433a60
call fcn.00433c68
call fcn.00434082
call fcn.00434e98
call fcn.00437ecc
mov rax, qword [rsp + 0x28]
call rax
nop
add rsp, 0x38
ret
Function at 0x43ce60
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00442300
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00442300
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x43ced0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00489c14]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x43d078
mov rax, qword [0x00489c18]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x43cf1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x43cfa7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x43cf00
mov rcx, r12
call fcn.0043dc30
mov rbp, rax
test rax, rax
je 0x43d0b2
mov rax, qword [0x00489c18]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.0043dd60
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00489c18]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x43d0c1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x43cfa0
sub eax, 4
and eax, 0xfffffffb
jne 0x43d030
add dword [0x00489c14], 1
cmp ebx, 8
jae 0x43cfd8
test bl, 4
jne 0x43d080
test ebx, ebx
je 0x43cfc9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x43d0a0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x43cfc9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x43d00a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00489c18]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x43cfa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0043ce60
nop dword [rax]
xor edi, edi
jmp 0x43cf27
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x43cfc9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x43cfc9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.0043ce60
mov rax, qword [0x00489c18]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.0043ce60
nop
nop dword [rax]
Function at 0x43d8a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00489f00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00489ee0]
test rbx, rbx
je 0x43d8f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x43d8eb
test r12, r12
je 0x43d8eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x43d8d0
lea rcx, [0x00489f00]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x43dc30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004764e0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x43dca9
mov rcx, r10
call fcn.0043db00
test eax, eax
je 0x43dca9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x43dca6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x43dc9d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x43dca9
add r8, 0x28
cmp r8, r9
jne 0x43dc88
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140007728
Capabilities:
Set registry value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rax, qword [0x1400b4c80]
mov r8, qword [rax]
mov rsi, rcx
mov rbx, rdx
test r8, r8
je 0x140007756
call fcn.1400232db
xor ebx, ebx
test rax, rax
setne bl
jmp 0x140007867
xor edi, edi
test rdx, rdx
je 0x140007767
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov edi, eax
xor r9d, r9d
mov edx, 0x5c
mov rcx, rsi
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r9
call sub.msvcrt.dll_strchr
test rax, rax
je 0x1400077a0
mov r8d, 0x91
lea rdx, [0x1400887d4]
lea rcx, [0x1400887ea]
call qword [sym.imp.msvcrt.dll__wassert]
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400077d0
xor r8d, r8d
mov qword [rsp + 0x60], r8
jmp 0x14000781c
lea rax, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rdx
lea rdx, [0x140088828]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140007820
xor eax, eax
mov qword [rsp + 0x68], rax
xor ebx, ebx
jmp 0x140007847
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov r9d, 1
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140007857
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140007867
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
Function at 0x140007871
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
lea rbp, [0x1400ce3e0]
xor r9d, r9d
mov rbx, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
mov qword [rsp + 0x68], r9
rep stosd dword [rdi], eax
mov ecx, 0x1ff
mov rdi, rbp
mov qword [rsp + 0x70], r9
rep stosb byte [rdi], al
mov rcx, rbx
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x60], 0xffffffff
mov dword [rsp + 0x64], 0x1ff
call sub.msvcrt.dll_strlen
mov rcx, rax
mov r12, rax
test r12, r12
je 0x14000796f
cmp byte [rbx + r12], 0x5c
je 0x1400078e7
dec r12
jmp 0x1400078d2
cmp r12, 0x103
ja 0x140007a33
mov eax, 0x104
inc rcx
mov rdi, r13
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r13
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + r12 + 0x7c], 0
inc r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400079ec
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x140007a12
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x140088847]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400079a3
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x140007a12
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x140088850]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140007962
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rbp
lea rdx, [rbx + r12]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140007a22
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140007a33
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140007cb5
Capabilities:
Get disk information

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
mov r10d, dword [0x1400ce248]
mov ebp, r8d
mov ebx, r9d
test ecx, ecx
js 0x140007d2d
lea r9d, [rcx - 0x80]
cmp r9d, 0x40
jbe 0x140007cfb
mov r8d, 0x185
lea rdx, str.drive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call qword [sym.imp.msvcrt.dll__wassert]
test rdx, rdx
je 0x140007d46
xor eax, eax
lea r8, [0x1400ce268]
cmp r10d, ecx
jne 0x140007d34
cmp qword [r8 + rax*8], rdx
je 0x140007d48
inc rax
cmp rax, 0x10
jne 0x140007d0e
test ebx, ebx
jne 0x140007d2d
lea rcx, str.Error:_Could_not_find_a_partition_at_offset__lld_on_this_disk
call fcn.1400380b9
xor eax, eax
jmp 0x140007e3f
test ebx, ebx
jne 0x140007d2d
lea rcx, str.Error:_Searching_for_a_partition_on_a_non_matching_disk
call fcn.1400380b9
jmp 0x140007d2d
xor eax, eax
inc eax
lea r12, [rsp + 0x3c]
mov edx, 0x40
mov rcx, r12
mov dword [rsp + 0x20], eax
lea r8, str.Harddisk_luPartition_lu
call qword [sym.imp.msvcrt.dll__snprintf]
mov byte [rsp + 0x7b], 0
mov ecx, 1
mov r14, qword [str._GLOBALROOT]
test r14, r14
je 0x140007d96
mov rcx, r14
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x104
cmp rcx, rax
cmova rcx, rax
lea r13, [rsp + 0x7c]
mov ecx, ecx
mov rsi, r14
mov rdi, r13
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
mov esi, 0x103
call sub.msvcrt.dll_strlen
mov r8d, 0xf6
mov rcx, r12
lea rdx, [rax + 1]
cmp rdx, 0x104
lea rdx, [rsp + 0x8a]
cmovae rax, rsi
mov byte [rsp + rax + 0x7c], 0
call qword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
test eax, eax
je 0x140007def
mov rcx, r13
call sub.msvcrt.dll_strlen
cmp rax, 0x13
ja 0x140007e13
test ebx, ebx
jne 0x140007d2d
call fcn.140038579
mov rdx, r12
lea rcx, str.Could_not_find_a_DOS_volume_name_for__s:__s
mov r8, rax
call fcn.1400380b9
jmp 0x140007d2d
test ebp, ebp
je 0x140007e36
sub rsi, rax
mov r8d, 2
lea rdx, [0x14008894d]
mov rcx, r13
cmp rsi, r8
cmovbe r8, rsi
call sub.msvcrt.dll_strncat
mov rcx, r13
call qword [sym.imp.msvcrt.dll__strdup]
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400090f4
Capabilities:
Get disk information via ioctl

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x120
xor r8d, r8d
xor r9d, r9d
mov rdi, qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
lea rax, [rsp + 0x58]
mov rbx, rdx
xor edx, edx
mov qword [rsp + 0x38], r8
lea rbp, [rsp + 0x48]
mov dword [rsp + 0x48], edx
xor r8d, r8d
mov edx, 0x560000
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xc8
mov qword [rsp + 0x20], rax
call rdi
mov rcx, qword [rsp + 0x140]
test eax, eax
je 0x140009162
cmp dword [rsp + 0x48], 0
je 0x140009162
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x1400091c1
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov edx, 0x2d1080
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x1400091a1
cmp dword [rsp + 0x48], 0
jne 0x1400091ba
lea r8, str._empty_data_
jmp 0x1400091a9
call fcn.140038579
mov r8, rax
mov rdx, rbx
lea rcx, str.Could_not_get_device_number_for_device__s__s
call fcn.1400380b9
jmp 0x1400091d9
mov r8d, dword [rsp + 0x50]
jmp 0x1400091df
dec eax
mov r8d, dword [rsp + 0x60]
je 0x1400091df
mov rdx, rbx
lea rcx, str.Ignoring_drive__s_as_it_spans_multiple_disks__RAID__
call fcn.1400380b9
or r8d, 0xffffffff
jmp 0x140009202
cmp r8d, 0x3f
jle 0x140009202
mov rdx, rbx
lea rcx, str.Device_Number_for_device__s_is_too_big___d____ignoring_device
call fcn.1400380b9
lea rcx, str.NOTE:_This_may_be_due_to_an_excess_of_Virtual_Drives__such_as_hidden_ones_created_by_the_XBox_PC_app
call fcn.1400380b9
jmp 0x1400091d9
mov eax, r8d
add rsp, 0x120
pop rbx
pop rdi
pop rbp
ret
Function at 0x14000965d
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov ecx, 0x69
lea rbp, [rsp + 0x27]
mov rdx, rbp
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
mov edx, eax
test eax, eax
jne 0x140009697
call fcn.140038579
lea rcx, str.GetLogicalDriveStrings_failed:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x1400096b0
mov bl, 0x43
cmp eax, 0x69
jbe 0x1400096e8
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.1400380b9
xor ebx, ebx
jmp 0x1400096ed
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rdi, [rdi + rax + 1]
movsx esi, byte [rdi]
test sil, sil
je 0x1400096ed
mov ecx, esi
call qword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
je 0x1400096b4
mov ecx, esi
call qword [sym.imp.msvcrt.dll_toupper]
cmp bl, al
jne 0x1400096b4
inc ebx
cmp bl, 0x5b
je 0x1400096b0
mov rdi, rbp
jmp 0x1400096c1
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000985b
Capabilities:
Get disk information

Disassembly:
push rsi
push rbx
sub rsp, 0x98
lea rbx, [rsp + 0x27]
mov esi, ecx
mov ecx, 0x69
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
mov edx, eax
test eax, eax
jne 0x140009895
call fcn.140038579
lea rcx, str.GetLogicalDriveStrings_failed:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x1400098ac
cmp eax, 0x69
jbe 0x1400098cb
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.1400380b9
mov eax, 1
jmp 0x1400098d4
call qword [sym.imp.msvcrt.dll_toupper]
cmp sil, al
je 0x1400098ac
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
movsx ecx, byte [rbx]
test cl, cl
jne 0x1400098b3
xor eax, eax
add rsp, 0x98
pop rbx
pop rsi
ret
Function at 0x140009f11
Capabilities:
Get disk information via ioctl

Disassembly:
push r12
mov eax, 0x1050
push rbp
push rdi
push rsi
push rbx
call fcn.140076d90
sub rsp, rax
xor eax, eax
xor edx, edx
mov r9d, 1
mov r8d, 1
xor ebx, ebx
mov ebp, ecx
lea rdi, [rsp + 0x50]
mov ecx, 0x400
rep stosd dword [rdi], eax
mov ecx, ebp
lea rdi, [rsp + 0x50]
call fcn.140007c6c
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14000a024
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov edx, 0x70050
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x140009fa1
cmp dword [rsp + 0x4c], 0
lea r12, [0x1400bd2d0]
jne 0x140009fd6
call fcn.140038579
mov edx, ebp
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
call fcn.1400380b9
jmp 0x14000a00f
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x140009fde
mov eax, ebx
imul rax, rax, 0x90
cmp byte [rsp + rax + 0xa0], 0xef
je 0x140009ffc
inc ebx
cmp ebx, dword [rsp + 0x54]
jb 0x140009fb9
jmp 0x14000a00f
dec eax
jne 0x140009fd4
mov eax, ebx
mov rdx, r12
imul rax, rax, 0x90
lea rcx, [rdi + rax + 0x50]
call fcn.140037544
test eax, eax
je 0x140009fd4
mov ebx, ebx
imul rbx, rbx, 0x90
mov rbx, qword [rsp + rbx + 0x88]
jmp 0x14000a011
xor ebx, ebx
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000a024
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, rbx
add rsp, 0x1050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000a458
Capabilities:
Get disk information

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov word [rsp + 0x29], 0x3a3f
mov rbx, rcx
mov rsi, rdx
mov byte [rsp + 0x2b], 0
test rcx, rcx
je 0x14000a485
test rdx, rdx
je 0x14000a485
cmp byte [rcx], 0x3f
jne 0x14000a492
mov ecx, 0x57
call qword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x14000a4e8
mov rdx, qword [str._GLOBALROOT]
mov r8d, 0xe
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x14000a50d
mov al, byte [rbx]
mov ecx, 9
lea rdx, [rsp + 0x29]
lea r8, [rsi + 0xe]
mov byte [rsp + 0x29], al
call qword [sym.imp.KERNEL32.DLL_DefineDosDeviceA]
movsx ecx, byte [rbx]
test eax, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
jne 0x14000a4ef
call rax
mov rdx, rsi
lea rcx, str.Could_not_mount__s_as__c:
mov r8d, eax
call fcn.1400380b9
xor eax, eax
jmp 0x14000a620
call rax
mov rdx, rsi
lea rcx, str._s_was_successfully_mounted_as__c:
mov r8d, eax
call fcn.1400380b9
mov eax, 1
jmp 0x14000a620
mov r13, qword [sym.imp.KERNEL32.DLL_SetVolumeMountPointA]
mov rdx, rsi
mov rcx, rbx
call r13
test eax, eax
jne 0x14000a503
mov r12, qword [sym.imp.KERNEL32.DLL_GetLastError]
call r12
cmp eax, 0x91
jne 0x14000a4e8
lea rdi, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointA]
mov r8d, 0x34
mov rcx, rbx
mov rdx, rdi
call rbp
test eax, eax
jne 0x14000a569
call fcn.140038579
mov rdx, rbx
lea rcx, str._s_is_already_mounted__but_volume_GUID_could_not_be_checked:__s
mov r8, rax
call fcn.1400380b9
jmp 0x14000a58d
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14000a503
mov r9, rdi
mov r8, rsi
lea rcx, str._s_is_mounted__but_volume_GUID_doesnt_match:_r_n__expected__s__got__s
mov rdx, rbx
call fcn.1400380b9
lea rcx, str.Retrying_after_dismount...
call fcn.1400380b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_DeleteVolumeMountPointA]
test eax, eax
jne 0x14000a5bd
call fcn.140038579
mov rdx, rbx
lea rcx, str.Warning:_Could_not_delete_volume_mountpoint__s:__s
mov r8, rax
call fcn.1400380b9
mov rdx, rsi
mov rcx, rbx
call r13
test eax, eax
jne 0x14000a503
call r12
cmp eax, 0x91
jne 0x14000a4e8
mov r8d, 0x34
mov rdx, rdi
mov rcx, rbx
call rbp
test eax, eax
je 0x14000a4e8
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000a4e8
movsx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll_toupper]
mov rdx, rsi
lea rcx, str._s_was_remounted_as__c:__second_time_lucky__
mov r8d, eax
jmp 0x14000a4fe
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret