joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005f8e0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x18005f914
lea ecx, [rbx + 0x57]
mov dword [0x180094c78], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18005f93a
test al, 0x10
jne 0x18005f97a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18005f97a
mov rcx, rbx
call fcn.18005f510
test eax, eax
jne 0x18005f97a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180094c78], eax
test eax, eax
je 0x18005f96d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x18005f989
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18005f9a0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x18005f9d4
lea ecx, [rbx + 0x57]
mov dword [0x180094c78], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18005f9fa
test al, 0x10
jne 0x18005fa3a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18005fa3a
mov rcx, rbx
call fcn.18005f6e0
test eax, eax
jne 0x18005fa3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180094c78], eax
test eax, eax
je 0x18005fa2d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x18005fa49
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180061160
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180061189
lea ecx, [rbx + 0x57]
mov dword [0x180094c78], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180060fe0]
lea edx, [r9 + 0x20]
call fcn.18005ff60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x1800611da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180094c78], eax
test eax, eax
je 0x1800611da
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800611f0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180061219
lea ecx, [rbx + 0x57]
mov dword [0x180094c78], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800610a0]
lea edx, [r9 + 0x20]
call fcn.1800600d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x18006126a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180094c78], eax
test eax, eax
je 0x18006126a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180062980
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x18005ca74
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005c740
jmp 0x18005ca7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005ca8e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005ca10
Function at 0x180062cd0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.180028fe0
test eax, eax
je 0x18005cf3d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005cdb0
jmp 0x18005cfb4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005cf93
lea rdx, [0x18006fd00]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.180068950
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005c740
jmp 0x18005cf99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x18005cfad
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005cf00

Function at 0x180062f50
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x180063066
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x180062fd6
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18005c500
test eax, eax
je 0x180063052
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18002a9c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800624d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180063052
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18002b560
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18005c740
jmp 0x18006306c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x180063082
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x180062f50
Function at 0x180063e40
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
lea rcx, [0x18007a0c8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x180063f4c
lea rcx, [rsp + 0x20]
call fcn.18005c500
test eax, eax
je 0x180063f33
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800624d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180063f2b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18002b560
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005c740
mov eax, 1
jmp 0x180063f4e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180063e40

Function at 0x1800640b0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
lea rcx, [0x18007a0f8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800641bc
lea rcx, [rsp + 0x20]
call fcn.18005c500
test eax, eax
je 0x1800641a3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800624d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006419b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18002b560
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005c740
mov eax, 1
jmp 0x1800641be
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800640b0
Function at 0x180065cc0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x180063066
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x180062fd6
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18005c500
test eax, eax
je 0x180063052
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18002a9c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800624d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180063052
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18002b560
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18005c740
jmp 0x18006306c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180094c78], eax
test eax, eax
je 0x180063082
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x180062f50

Function at 0x180066140
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
lea rcx, [0x18007a0c8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x180063f4c
lea rcx, [rsp + 0x20]
call fcn.18005c500
test eax, eax
je 0x180063f33
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800624d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180063f2b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18002b560
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005c740
mov eax, 1
jmp 0x180063f4e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180063e40
Function at 0x180066200
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
lea rcx, [0x18007a0f8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800641bc
lea rcx, [rsp + 0x20]
call fcn.18005c500
test eax, eax
je 0x1800641a3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800624d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006419b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18002b560
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005c740
mov eax, 1
jmp 0x1800641be
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800640b0
Function at 0x180066610
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp eax, 1
jne 0x180066775
test rbx, rbx
je 0x180066775
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x280], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, 2
jle 0x18006676d
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x1800666a2
movabs rax, 0x5c003a0041
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movzx eax, word [rbx]
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
jmp 0x18006676d
cmp word [rbx], 0x5c
jne 0x18006676d
cmp ax, 0x5c
jne 0x18006676d
mov qword [rsp + 0x278], rbp
mov qword [rsp + 0x250], r12
mov r12d, 0x5c
lea rcx, [rbx + 4]
mov edx, r12d
call fcn.18002ba1c
mov rbp, rax
test rax, rax
je 0x18006675d
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.18002a9c0
lea rcx, [rbp + 2]
mov edx, r12d
call fcn.18002ba1c
test rax, rax
je 0x18006672d
sub rax, rbx
sar rax, 1
lea ecx, [rax + 1]
cmp ecx, 0x104
jge 0x18006675d
movsxd r8, ecx
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18002a92c
jmp 0x180066750
lea eax, [rdi + 1]
cmp eax, 0x104
jge 0x18006675d
movsxd rdi, edi
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
call fcn.18002a92c
mov word [rsp + rdi*2 + 0x30], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov rbp, qword [rsp + 0x278]
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x280]
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002a990
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x180066850
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x18006687e
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov r9, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x180066af0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.180018880
test rbx, rbx
je 0x180066b81
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.18002a9c0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.180015040
mov eax, ebx
jmp 0x180066b83
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x180066bb0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x180066bde
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x180066c10
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.180018880
xor esi, esi
test rbx, rbx
je 0x180066c9d
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
call fcn.18002a9c0
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.180015040
mov eax, ebx
jmp 0x180066c9f
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18002a990
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180066d70
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x430
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.180018880
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
dec eax
cmp eax, 0x3fe
ja 0x180066de5
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180015040
mov eax, 1
jmp 0x180066de7
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x450]
add rsp, 0x430
pop rdi
ret

Function at 0x180066ee0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.180019f60
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x180066f70
movzx eax, word [0x18007a488]
mov word [rsp + 0x50], ax
movzx eax, byte [0x18007a48a]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180018610
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18001a1b0
nop
lea rcx, [rsp + 0x60]
call fcn.180014ec0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180066f20
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180066f90
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.180019f60
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x180067020
movzx eax, word [0x18007a488]
mov word [rsp + 0x50], ax
movzx eax, byte [0x18007a48a]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180018610
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18001a1b0
nop
lea rcx, [rsp + 0x60]
call fcn.180014ec0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180066fd0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x180067040
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.18001a470
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
test dword [rsi], edi
je 0x1800670d9
mov eax, dword [0x18007a4e0]
mov dword [rsp + 0x30], eax
movzx eax, word [0x18007a4e4]
mov word [rsp + 0x34], ax
xor eax, eax
mov word [rsp + 0x36], ax
add word [rsp + 0x30], bx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1800191c0
nop
lea r8, [rsp + 0x20]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18001a6c0
nop
lea rcx, [rsp + 0x20]
call fcn.180016820
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180067088
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180067110
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.180019f60
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.180019f60
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor ebx, ebx
nop
test esi, edi
je 0x180067231
movzx eax, word [0x18007a488]
mov word [rsp + 0x20], ax
movzx eax, byte [0x18007a48a]
mov byte [rsp + 0x22], al
xor eax, eax
mov byte [rsp + 0x23], al
add byte [rsp + 0x20], bl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180018610
nop
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18001a1b0
mov r11, qword [0x1800723a8]
mov qword [rsp + 0x28], r11
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.18002a9c0
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov byte [rsp + 0x143], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.180015040
lea r8, [rsp + 0x28]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.18001a1b0
nop
lea rcx, [rsp + 0x28]
call fcn.180014ec0
nop
lea rcx, [rsp + 0x30]
call fcn.180014ec0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x180067170
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18002a990
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret