joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400239f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140023ba7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140023a86
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.140023360
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140022970
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140023a77
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140018730
mov dword [rbx + 0x80], 0
jmp 0x140023b93
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.140021860
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400403a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400403ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400403ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400403ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400403ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400403ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400403ec
xor al, al
add rsp, 0x28
ret
Function at 0x14000f890
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14000f9a2
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov r14, rcx
and qword [rax - 0x38], 0
mov dword [rax - 0x40], 0x80
mov dword [rax - 0x48], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
jne 0x14000f917
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov rdx, rsi
call fcn.14000f544
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x20]
call qword [0x14001bf80]
mov rdi, rax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
mov rcx, r14
call qword [0x14001bf80]
mov rdx, rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000f981
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov rdx, rsi
call fcn.14000f544
nop
test rbx, rbx
je 0x14000f995
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x1400171a4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140027290], eax
call fcn.140016ef0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140027290], 0
jne case.default.0x1400171fa
mov ecx, 1
call fcn.140016ef0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
jbe 0x1400408fb
mov ebx, 0x728af30f
neg byte [rax]
sar dword [rbp + 0x6a], 0xbc
sub eax, 0xeb820778
invalid
cmc
lahf
js 0x140040975
mov dh, byte [rax]
in eax, dx
invalid
invalid
Function at 0x140004d40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
lea rcx, [rsp + 0x70]
mov r14d, 0x104
xor edx, edx
mov r8d, r14d
call fcn.140136960
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
lea r15, [0x1401d06b0]
mov qword [rsp + 0x60], rsi
mov rcx, r15
mov qword [rsp + 0x50], rsi
xor edx, edx
mov dword [rsp + 0x5c], 0x1ff
mov r8d, 0x1ff
call fcn.140136960
test rdi, rdi
je 0x140004f40
mov rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140004dd2
test rbx, rbx
je 0x140004dec
cmp byte [rdi + rbx], 0x5c
je 0x140004e21
sub rbx, 1
jne 0x140004de0
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004e93
mov qword [rsp + 0x60], rsi
jmp 0x140004f2c
cmp rbx, r14
jae 0x140004f40
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x140004e30
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.1401362c0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004edb
mov qword [rsp + 0x50], rsi
jmp 0x140004f1c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140004edb
mov qword [rsp + 0x50], rsi
jmp 0x140004f1c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140004f17
test eax, eax
jne 0x140004f1c
cmp dword [rsp + 0x58], 1
jne 0x140004f1c
cmp dword [rsp + 0x5c], esi
jbe 0x140004f1c
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004f2c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140004f3c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140004f42
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140005270
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x60
cmp qword [0x14019f500], 0
mov rsi, rdx
mov rbp, rcx
je 0x14000529f
call fcn.140026ef0
xor ebx, ebx
test rax, rax
setne bl
mov eax, ebx
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
xor ebx, ebx
mov qword [rsp + 0x80], rdi
test rsi, rsi
jne 0x1400052b2
mov edi, ebx
jmp 0x1400052c8
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], bl
jne 0x1400052c0
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x50], rbx
test rbp, rbp
jne 0x1400052f8
mov r8d, 0x8a
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.key_name___NULL
call fcn.1400fc264
jmp 0x140005402
mov edx, 0x5c
call fcn.1400b35d4
test rax, rax
je 0x140005320
mov r8d, 0x91
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400fc264
mov edx, 0x5c
mov rcx, rbp
call fcn.1400b35d4
test rax, rax
jne 0x140005402
lea rax, [rsp + 0x98]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000536c
mov qword [rsp + 0x98], rbx
jmp 0x1400053f2
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAkeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400053ba
mov qword [rsp + 0x50], rbx
jmp 0x1400053df
mov rcx, qword [rsp + 0x50]
mov r9d, 1
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400053f2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140005402
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x80]
mov eax, ebx
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006060
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebp, ebp
mov esi, r9d
cmp ecx, dword [0x1401e9108]
mov r14d, r8d
mov rbx, rdx
mov edi, ecx
sete bpl
test ecx, ecx
js 0x14000623f
lea eax, [rcx - 0x80]
cmp eax, 0x40
jbe 0x1400060c7
mov r8d, 0x182
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call fcn.1400fc264
add edi, 0xffffff80
cmp edi, 0x40
ja 0x14000623f
test rbx, rbx
jne 0x1400061a4
xor ecx, ecx
lea eax, [rcx + 1]
mov edx, 0x40
mov dword [rsp + 0x28], eax
lea r9, str.Harddisk_luPartition_lu
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], edi
lea r8, [rdx - 0x41]
call fcn.140004960
mov eax, dword [0x140155a58]
lea rdx, [rsp + 0x7e]
movsd xmm0, qword [str._GLOBALROOT]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], eax
mov r8d, 0xf6
movzx eax, word [0x140155a5c]
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x6f], 0
movsd qword [rsp + 0x70], xmm0
mov byte [rsp + 0x7e], 0
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x140006210
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140006160
cmp rax, 0x14
jb 0x140006210
test r14d, r14d
je 0x140006195
mov r9, 0xffffffffffffffff
lea r8, [0x140156078]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.1400e917c
lea rcx, [rsp + 0x70]
call fcn.1400fcc44
jmp 0x140006241
test ebp, ebp
je 0x14000622f
xor ecx, ecx
lea rax, [0x1401e9170]
cmp rbx, qword [rax]
je 0x1400060de
cmp rbx, qword [rax + 0x58]
je 0x1400061f0
cmp rbx, qword [rax + 0xb0]
je 0x1400061eb
cmp rbx, qword [rax + 0x108]
je 0x1400061e6
add rax, 0x160
add ecx, 4
cmp ecx, 0x10
jb 0x1400061b5
jmp 0x1400061fb
add ecx, 3
jmp 0x1400061f2
add ecx, 2
jmp 0x1400061f2
inc ecx
cmp ecx, 0x10
jb 0x1400060de
test esi, esi
jne 0x14000623f
mov rdx, rbx
lea rcx, str.Error:_Could_not_find_a_partition_at_offset__lld_on_this_disk
call fcn.14004f910
jmp 0x14000623f
test esi, esi
jne 0x14000623f
call fcn.140050120
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, str.Could_not_find_a_DOS_volume_name_for__s:__s
call fcn.14004f910
jmp 0x14000623f
test esi, esi
jne 0x14000623f
lea rcx, str.Error:_Searching_for_a_partition_on_a_non_matching_disk
call fcn.14004f910
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140006f40
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0
mov edx, 0x560000
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140006fd6
cmp dword [rsp + 0x40], 0
jbe 0x140006fd6
mov eax, dword [rsp + 0x60]
cmp eax, 1
jb 0x140006fd6
cmp eax, 2
jb 0x140006fd0
mov rdx, rbx
lea rcx, str.Ignoring_drive__s_as_it_spans_multiple_disks__RAID__
call fcn.14004f910
jmp 0x140007070
mov eax, dword [rsp + 0x68]
jmp 0x14000701e
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 0xc
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x2d1080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140007043
cmp dword [rsp + 0x40], 0
je 0x140007043
mov eax, dword [rsp + 0x4c]
cmp eax, 0x40
jl 0x140007075
mov r8d, eax
lea rcx, str.Device_Number_for_device__s_is_too_big___d____ignoring_device
mov rdx, rbx
call fcn.14004f910
lea rcx, str.NOTE:_This_may_be_due_to_an_excess_of_Virtual_Drives__such_as_hidden_ones_created_by_the_XBox_PC_app
call fcn.14004f910
jmp 0x140007070
cmp dword [0x1401e8840], 0
je 0x140007070
test eax, eax
je 0x140007059
lea rax, str._empty_data_
jmp 0x14000705e
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_get_device_number_for_device__s__s
mov rdx, rbx
call fcn.14004f910
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400b1f80
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x140007790
Capabilities:
Get disk information

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x1400077eb
call fcn.140050120
mov rdx, rax
lea rcx, str.GetLogicalDriveStrings_failed:__s
call fcn.14004f910
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0xa8
ret
cmp eax, 0x69
jbe 0x14000781e
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
mov edx, eax
call fcn.14004f910
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0xa8
ret
movzx eax, byte [rsp + 0x20]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rsi
xor esi, esi
mov qword [rsp + 0xa0], rdi
mov dil, 0x43
lea rbx, [rsp + 0x20]
test al, al
je 0x14000789d
nop dword [rax]
movsx ecx, al
call fcn.1400fde80
test eax, eax
je 0x140007869
movsx ecx, byte [rbx]
call fcn.1400fc9f0
cmp dil, al
je 0x140007898
test rbx, rbx
jne 0x140007873
mov rax, rsi
jmp 0x140007889
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x140007880
inc rbx
add rbx, rax
movzx eax, byte [rbx]
test al, al
jne 0x140007850
jmp 0x1400078ab
movzx eax, byte [rsp + 0x20]
cmp byte [rbx], sil
je 0x1400078ab
inc dil
cmp dil, 0x5a
jle 0x140007840
mov rbx, qword [rsp + 0xb0]
cmp dil, 0x5a
movzx ecx, dil
mov rdi, qword [rsp + 0xa0]
cmovle esi, ecx
movzx eax, sil
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0xa8
ret
Function at 0x140008060
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.1400b2940
sub rsp, rax
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov esi, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x1000
xor edi, edi
call fcn.140136960
mov ecx, esi
call fcn.140005900
mov r9d, 1
xor edx, edx
mov r8d, r9d
mov rcx, rax
mov rbx, rax
call fcn.140005570
mov rcx, rbx
mov rbp, rax
call fcn.1400e9080
cmp rbp, 0xffffffffffffffff
jne 0x1400080da
xor eax, eax
jmp 0x1400081d0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400081a9
cmp dword [rsp + 0x40], edi
jbe 0x1400081a9
mov r10d, dword [rsp + 0x54]
mov r8d, edi
test r10d, r10d
je 0x1400081bf
mov r9d, dword [rsp + 0x50]
mov r11, qword [0x1401579e8]
mov rbx, qword [0x1401579e0]
mov ecx, r8d
test r9d, r9d
jne 0x14000815f
lea rax, [rcx + rcx*8]
shl rax, 4
cmp byte [rsp + rax + 0xa0], 0xef
je 0x14000819f
cmp r9d, 1
jne 0x140008195
lea rax, [rcx + rcx*8]
shl rax, 4
lea rcx, [rsp + 0xa0]
add rcx, rax
je 0x140008195
mov rdx, qword [rcx]
sub rdx, rbx
jne 0x140008189
mov rdx, qword [rcx + 8]
sub rdx, r11
test rdx, rdx
mov ecx, edi
sete cl
test ecx, ecx
jne 0x14000819f
inc r8d
cmp r8d, r10d
jb 0x140008145
jmp 0x1400081bf
mov rdi, qword [rsp + rax + 0x88]
jmp 0x1400081bf
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov edx, esi
call fcn.14004f910
test rbp, rbp
je 0x1400081cd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000a390
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx eax, word [0x140157174]
mov rdi, rdx
mov word [rsp + 0x20], ax
mov rbx, rcx
movzx eax, byte [0x140157176]
mov byte [rsp + 0x22], al
test rcx, rcx
je 0x14000a58c
test rdx, rdx
je 0x14000a58c
cmp byte [rcx], 0x3f
je 0x14000a58c
mov r8d, 0xe
lea rdx, str._GLOBALROOT
mov rcx, rdi
call fcn.1400fe668
test eax, eax
jne 0x14000a459
movzx eax, byte [rbx]
lea r8, [rdi + 0xe]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], al
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
movsx ecx, byte [rbx]
test eax, eax
jne 0x14000a438
call fcn.1400fc9f0
mov r8d, eax
lea rcx, str.Could_not_mount__s_as__c:
mov rdx, rdi
call fcn.14004f910
jmp 0x14000a597
call fcn.1400fc9f0
mov r8d, eax
lea rcx, str._s_was_successfully_mounted_as__c:
mov rdx, rdi
call fcn.14004f910
mov eax, 1
jmp 0x14000a599
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
jne 0x14000a44f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
jne 0x14000a597
lea r8d, [rax - 0x5d]
mov rcx, rbx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x14000a4a9
call fcn.140050120
mov r8, rax
lea rcx, str._s_is_already_mounted__but_volume_GUID_could_not_be_checked:__s
mov rdx, rbx
call fcn.14004f910
jmp 0x14000a4e2
lea r8, [rsp + 0x28]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000a4c7
inc rax
test ecx, ecx
jne 0x14000a4b4
test edx, edx
je 0x14000a44f
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
lea rcx, str._s_is_mounted__but_volume_GUID_doesnt_match:_r_n__expected__s__got__s
call fcn.14004f910
lea rcx, str.Retrying_after_dismount...
call fcn.14004f910
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
test eax, eax
jne 0x14000a512
call fcn.140050120
mov r8, rax
lea rcx, str.Warning:_Could_not_delete_volume_mountpoint__s:__s
mov rdx, rbx
call fcn.14004f910
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
jne 0x14000a44f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
jne 0x14000a597
lea r8d, [rax - 0x5d]
mov rcx, rbx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x14000a597
lea r8, [rsp + 0x28]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000a567
inc rax
test ecx, ecx
jne 0x14000a554
test edx, edx
jne 0x14000a597
movsx ecx, byte [rbx]
call fcn.1400fc9f0
mov r8d, eax
lea rcx, str._s_was_remounted_as__c:__second_time_lucky__
mov rdx, rdi
call fcn.14004f910
mov eax, 1
jmp 0x14000a599
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400b1f80
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14000a730
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov eax, dword [str..:]
xor r9d, r9d
mov dword [rsp + 0x40], eax
mov ebp, edx
movzx eax, word [0x14015676c]
mov rdi, rcx
mov word [rsp + 0x44], ax
mov edx, 0xc0000000
movzx eax, byte [0x14015676e]
lea r8d, [r9 + 3]
mov qword [r11 - 0x78], 0
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r14
movsx r14d, byte [rcx]
lea rcx, [r11 - 0x68]
mov byte [rsp + 0x46], al
mov dword [rsp + 0x28], 0x80
mov byte [r11 - 0x64], r14b
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a7df
call fcn.140050120
mov ecx, r14d
mov rbx, rax
call fcn.1400fc9f0
mov edx, eax
lea rcx, str.Failed_to_open__c:_for_flushing:__s
mov r8, rbx
call fcn.14004f910
jmp 0x14000a81b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14000a80d
call fcn.140050120
mov ecx, r14d
mov rbx, rax
call fcn.1400fc9f0
mov edx, eax
lea rcx, str.Failed_to_flush__c:__s
mov r8, rbx
call fcn.14004f910
test rsi, rsi
je 0x14000a81b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x33
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
test eax, eax
je 0x14000a874
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14000a390
test eax, eax
je 0x14000a894
test ebp, ebp
jne 0x14000a874
movsx ecx, byte [rdi]
call fcn.1400fc9f0
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, str.Successfully_remounted__s_as__c:
call fcn.14004f910
mov eax, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0x90
pop rdi
pop rbp
pop rbx
ret
test ebp, ebp
jne 0x14000a8bf
call fcn.140050120
movsx ecx, byte [rdi]
mov rbx, rax
call fcn.1400fc9f0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov r9, rbx
lea rcx, str.Could_not_remount__s_as__c:__s
call fcn.14004f910
mov dword [0x14019f0a0], 0xe0031209
xor eax, eax
jmp 0x14000a879
Function at 0x14000c480
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.14000c110
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14000c4b7
mov rcx, rbx
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret