joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006700
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebp, ebp
mov esi, r9d
cmp ecx, dword [0x1401e9088]
mov r14d, r8d
mov rbx, rdx
mov edi, ecx
sete bpl
test ecx, ecx
js 0x1400068df
lea eax, [rcx - 0x80]
cmp eax, 0x40
jbe 0x140006767
mov r8d, 0x182
lea rdx, str.D:_a_rufus_rufus_srcdrive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call fcn.1400fbe54
add edi, 0xffffff80
cmp edi, 0x40
ja 0x1400068df
test rbx, rbx
jne 0x140006844
xor ecx, ecx
lea eax, [rcx + 1]
mov edx, 0x40
mov dword [rsp + 0x28], eax
lea r9, str.Harddisk_luPartition_lu
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x30]
call fcn.140004fd0
mov eax, dword [0x140155ad8]
lea rdx, [rsp + 0x7e]
movsd xmm0, qword [str._GLOBALROOT]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x78], eax
mov r8d, 0xf6
movzx eax, word [0x140155adc]
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x6f], 0
movsd qword [rsp + 0x70], xmm0
mov byte [rsp + 0x7e], 0
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1400068b0
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140006800
cmp rax, 0x14
jb 0x1400068b0
test r14d, r14d
je 0x140006835
mov r9, 0xffffffffffffffff
lea r8, [0x1401560f8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.1400e8d6c
lea rcx, [rsp + 0x70]
call fcn.1400fc834
jmp 0x1400068e1
test ebp, ebp
je 0x1400068cf
xor ecx, ecx
lea rax, [0x1401e90f0]
cmp rbx, qword [rax]
je 0x14000677e
cmp rbx, qword [rax + 0x58]
je 0x140006890
cmp rbx, qword [rax + 0xb0]
je 0x14000688b
cmp rbx, qword [rax + 0x108]
je 0x140006886
add rax, 0x160
add ecx, 4
cmp ecx, 0x10
jb 0x140006855
jmp 0x14000689b
add ecx, 3
jmp 0x140006892
add ecx, 2
jmp 0x140006892
inc ecx
cmp ecx, 0x10
jb 0x14000677e
test esi, esi
jne 0x1400068df
mov rdx, rbx
lea rcx, str.Error:_Could_not_find_a_partition_at_offset__lld_on_this_disk
call fcn.14004f2f0
jmp 0x1400068df
test esi, esi
jne 0x1400068df
call fcn.14004fba0
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, str.Could_not_find_a_DOS_volume_name_for__s:__s
call fcn.14004f2f0
jmp 0x1400068df
test esi, esi
jne 0x1400068df
lea rcx, str.Error:_Searching_for_a_partition_on_a_non_matching_disk
call fcn.14004f2f0
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400075f0
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rbx, rdx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0
mov edx, 0x560000
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140007686
cmp dword [rsp + 0x40], 0
jbe 0x140007686
mov eax, dword [rsp + 0x60]
cmp eax, 1
jb 0x140007686
cmp eax, 2
jb 0x140007680
mov rdx, rbx
lea rcx, str.Ignoring_drive__s_as_it_spans_multiple_disks__RAID__
call fcn.14004f2f0
jmp 0x140007720
mov eax, dword [rsp + 0x68]
jmp 0x1400076ce
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 0xc
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x2d1080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400076f3
cmp dword [rsp + 0x40], 0
je 0x1400076f3
mov eax, dword [rsp + 0x4c]
cmp eax, 0x40
jl 0x140007725
mov r8d, eax
lea rcx, str.Device_Number_for_device__s_is_too_big___d____ignoring_device
mov rdx, rbx
call fcn.14004f2f0
lea rcx, str.NOTE:_This_may_be_due_to_an_excess_of_Virtual_Drives__such_as_hidden_ones_created_by_the_XBox_PC_app
call fcn.14004f2f0
jmp 0x140007720
cmp dword [0x1401e87c0], 0
je 0x140007720
test eax, eax
je 0x140007709
lea rax, str._empty_data_
jmp 0x14000770e
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_get_device_number_for_device__s__s
mov rdx, rbx
call fcn.14004f2f0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x140007e50
Capabilities:
Get disk information

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x69
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x140007eab
call fcn.14004fba0
mov rdx, rax
lea rcx, str.GetLogicalDriveStrings_failed:__s
call fcn.14004f2f0
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0xa8
ret
cmp eax, 0x69
jbe 0x140007ede
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
mov edx, eax
call fcn.14004f2f0
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0xa8
ret
movzx eax, byte [rsp + 0x20]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rsi
xor esi, esi
mov qword [rsp + 0xa0], rdi
mov dil, 0x43
lea rbx, [rsp + 0x20]
test al, al
je 0x140007f5d
nop dword [rax]
movsx ecx, al
call fcn.1400fda70
test eax, eax
je 0x140007f29
movsx ecx, byte [rbx]
call fcn.1400fc5e0
cmp dil, al
je 0x140007f58
test rbx, rbx
jne 0x140007f33
mov rax, rsi
jmp 0x140007f49
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x140007f40
inc rbx
add rbx, rax
movzx eax, byte [rbx]
test al, al
jne 0x140007f10
jmp 0x140007f6b
movzx eax, byte [rsp + 0x20]
cmp byte [rbx], sil
je 0x140007f6b
inc dil
cmp dil, 0x5a
jle 0x140007f00
mov rbx, qword [rsp + 0xb0]
cmp dil, 0x5a
movzx ecx, dil
mov rdi, qword [rsp + 0xa0]
cmovle esi, ecx
movzx eax, sil
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0xa8
ret
Function at 0x140008720
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.1400b3400
sub rsp, rax
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov esi, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x1000
xor edi, edi
call fcn.140136540
mov ecx, esi
call fcn.140005f90
mov r9d, 1
xor edx, edx
mov r8d, r9d
mov rcx, rax
mov rbx, rax
call fcn.140005bf0
mov rcx, rbx
mov rbp, rax
call fcn.1400e8c70
cmp rbp, 0xffffffffffffffff
jne 0x14000879a
xor eax, eax
jmp 0x140008890
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140008869
cmp dword [rsp + 0x40], edi
jbe 0x140008869
mov r10d, dword [rsp + 0x54]
mov r8d, edi
test r10d, r10d
je 0x14000887f
mov r9d, dword [rsp + 0x50]
mov r11, qword [0x140157a68]
mov rbx, qword [0x140157a60]
mov ecx, r8d
test r9d, r9d
jne 0x14000881f
lea rax, [rcx + rcx*8]
shl rax, 4
cmp byte [rsp + rax + 0xa0], 0xef
je 0x14000885f
cmp r9d, 1
jne 0x140008855
lea rax, [rcx + rcx*8]
shl rax, 4
lea rcx, [rsp + 0xa0]
add rcx, rax
je 0x140008855
mov rdx, qword [rcx]
sub rdx, rbx
jne 0x140008849
mov rdx, qword [rcx + 8]
sub rdx, r11
test rdx, rdx
mov ecx, edi
sete cl
test ecx, ecx
jne 0x14000885f
inc r8d
cmp r8d, r10d
jb 0x140008805
jmp 0x14000887f
mov rdi, qword [rsp + rax + 0x88]
jmp 0x14000887f
call fcn.14004fba0
mov r8, rax
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov edx, esi
call fcn.14004f2f0
test rbp, rbp
je 0x14000888d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000aad0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx eax, word [0x1401571f4]
mov rdi, rdx
mov word [rsp + 0x20], ax
mov rbx, rcx
movzx eax, byte [0x1401571f6]
mov byte [rsp + 0x22], al
test rcx, rcx
je 0x14000ace8
test rdx, rdx
je 0x14000ace8
cmp byte [rcx], 0x3f
je 0x14000ace8
mov r8d, 0xe
lea rdx, str._GLOBALROOT
mov rcx, rdi
call fcn.1400fe258
test eax, eax
jne 0x14000ab99
movzx eax, byte [rbx]
lea r8, [rdi + 0xe]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], al
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
movsx ecx, byte [rbx]
test eax, eax
jne 0x14000ab78
call fcn.1400fc5e0
mov r8d, eax
lea rcx, str.Could_not_mount__s_as__c:
mov rdx, rdi
call fcn.14004f2f0
jmp 0x14000acf3
call fcn.1400fc5e0
mov r8d, eax
lea rcx, str._s_was_successfully_mounted_as__c:
mov rdx, rdi
call fcn.14004f2f0
mov eax, 1
jmp 0x14000acf5
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
jne 0x14000ab8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
jne 0x14000acf3
mov r8d, 0x34
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x14000abeb
call fcn.14004fba0
mov r8, rax
lea rcx, str._s_is_already_mounted__but_volume_GUID_could_not_be_checked:__s
mov rdx, rbx
call fcn.14004f2f0
jmp 0x14000ac32
lea r8, [rsp + 0x28]
mov rax, rdi
sub r8, rdi
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000ac13
inc rax
test ecx, ecx
jne 0x14000ac00
test edx, edx
je 0x14000ab8f
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
lea rcx, str._s_is_mounted__but_volume_GUID_doesnt_match:_r_n__expected__s__got__s
call fcn.14004f2f0
lea rcx, str.Retrying_after_dismount...
call fcn.14004f2f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
test eax, eax
jne 0x14000ac62
call fcn.14004fba0
mov r8, rax
lea rcx, str.Warning:_Could_not_delete_volume_mountpoint__s:__s
mov rdx, rbx
call fcn.14004f2f0
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
jne 0x14000ab8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
jne 0x14000acf3
mov r8d, 0x34
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x14000acf3
lea r8, [rsp + 0x28]
mov rax, rdi
sub r8, rdi
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000acc3
inc rax
test ecx, ecx
jne 0x14000acb0
test edx, edx
jne 0x14000acf3
movsx ecx, byte [rbx]
call fcn.1400fc5e0
mov r8d, eax
lea rcx, str._s_was_remounted_as__c:__second_time_lucky__
mov rdx, rdi
call fcn.14004f2f0
mov eax, 1
jmp 0x14000acf5
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14000ae80
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov eax, dword [str..:]
mov ebp, edx
mov dword [rsp + 0x40], eax
mov rdi, rcx
movzx eax, word [0x1401567ec]
xor r9d, r9d
mov word [rsp + 0x44], ax
mov edx, 0xc0000000
movzx eax, byte [0x1401567ee]
mov r8d, 3
mov qword [r11 - 0x78], 0
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r14
movsx r14d, byte [rcx]
lea rcx, [r11 - 0x68]
mov byte [rsp + 0x46], al
mov dword [rsp + 0x28], 0x80
mov byte [r11 - 0x64], r14b
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000af31
call fcn.14004fba0
mov ecx, r14d
mov rbx, rax
call fcn.1400fc5e0
mov edx, eax
lea rcx, str.Failed_to_open__c:_for_flushing:__s
mov r8, rbx
call fcn.14004f2f0
jmp 0x14000af6d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14000af5f
call fcn.14004fba0
mov ecx, r14d
mov rbx, rax
call fcn.1400fc5e0
mov edx, eax
lea rcx, str.Failed_to_flush__c:__s
mov r8, rbx
call fcn.14004f2f0
test rsi, rsi
je 0x14000af6d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x33
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
test eax, eax
je 0x14000afc6
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14000aad0
test eax, eax
je 0x14000afe6
test ebp, ebp
jne 0x14000afc6
movsx ecx, byte [rdi]
call fcn.1400fc5e0
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, str.Successfully_remounted__s_as__c:
call fcn.14004f2f0
mov eax, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x90
pop rdi
pop rbp
pop rbx
ret
test ebp, ebp
jne 0x14000b011
call fcn.14004fba0
movsx ecx, byte [rdi]
mov rbx, rax
call fcn.1400fc5e0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov r9, rbx
lea rcx, str.Could_not_remount__s_as__c:__s
call fcn.14004f2f0
mov dword [0x14019f120], 0xe0031209
xor eax, eax
jmp 0x14000afcb
Function at 0x14000cc20
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.14000c8a0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14000cc57
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000cf80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
lea rcx, [rsp + 0x70]
mov r14d, 0x104
xor edx, edx
mov r8d, r14d
mov r15, r9
call fcn.140136540
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
xor eax, eax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x5c], 4
mov dword [r15], eax
test rdi, rdi
je 0x14000d170
mov rax, 0xffffffffffffffff
mov rbx, rax
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14000d000
test rbx, rbx
je 0x14000d01c
nop
cmp byte [rdi + rbx], 0x5c
je 0x14000d051
sub rbx, 1
jne 0x14000d010
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000d0c3
mov qword [rsp + 0x60], rsi
jmp 0x14000d15c
cmp rbx, r14
jae 0x14000d170
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x14000d060
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140135ea0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000d10b
mov qword [rsp + 0x50], rsi
jmp 0x14000d14c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000d10b
mov qword [rsp + 0x50], rsi
jmp 0x14000d14c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14000d147
test eax, eax
jne 0x14000d14c
cmp dword [rsp + 0x58], 4
jne 0x14000d14c
cmp dword [rsp + 0x5c], esi
jbe 0x14000d14c
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d15c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000d16c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14000d172
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015250
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
test rdx, rdx
jne 0x140015260
xor eax, eax
add rsp, 0x58
ret
mov qword [rsp + 0x60], rbx
xor eax, eax
movaps xmmword [rsp + 0x40], xmm6
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm7
xorps xmm7, xmm7
cvtsi2ss xmm7, rdx
cvtsi2ss xmm6, rcx
movaps xmm1, xmm7
mulss xmm1, dword [0x1401d0b84]
movaps xmm0, xmm6
mulss xmm0, dword [0x1401977c0]
addss xmm1, xmm0
movss xmm0, dword [0x14017703c]
comiss xmm1, xmm0
jb 0x1400152be
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400152be
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttss2si r8, xmm1
mov r9, rdx
xor ebx, ebx
mov edx, 0xc91
mov dword [rsp + 0x20], ebx
mov ecx, 4
add r8, rax
call fcn.140066570
movss xmm0, dword [0x14017701c]
divss xmm6, xmm7
minss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
mulss xmm6, xmm0
cvttss2si rax, xmm6
movaps xmm6, xmmword [rsp + 0x40]
cmp rax, qword [0x1401977b8]
je 0x14001541b
mov dword [rsp + 0x28], ebx
lea r8, [0x140158df0]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
xor edx, edx
mov qword [rsp + 0x68], rsi
mov ecx, 0xfde9
mov qword [0x1401977b8], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
cmp esi, 1
jle 0x140015398
mov rcx, rsi
mov qword [rsp + 0x50], rdi
mov edx, 2
call fcn.1400c4f6c
mov rdi, rax
test rax, rax
je 0x140015393
mov dword [rsp + 0x28], esi
lea r8, [0x140158df0]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x140015390
mov rcx, rdi
call fcn.1400e8c70
jmp 0x140015393
mov rbx, rdi
mov rdi, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x14019f648]
mov rsi, qword [rsp + 0x68]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140015413
mov r9d, 0x7ffffffe
mov edx, 0xb1
mov r8d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f648]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f648]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xba
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f648]
xor r8d, r8d
movsxd r9, eax
mov edx, 0xb6
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.1400e8c70
mov eax, dword [0x14019f120]
mov rbx, qword [rsp + 0x60]
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x7f2bb751
add rsp, 0x58
ret
Function at 0x1400179a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x20], rcx
lea r9, str._sautorun.inf
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 0x40
call fcn.140004fd0
lea rdx, [0x14015b0f0]
mov byte [rsp + 0x6f], 0
lea rcx, [rsp + 0x30]
call fcn.1400e9100
mov rdi, rax
test rax, rax
je 0x140017a22
lea rdx, [rsp + 0x30]
lea rcx, str._s_already_exists___keeping_it
call fcn.14004f2f0
mov rcx, rdi
call fcn.1400e9320
xor eax, eax
jmp 0x140017b46
lea rdx, [0x14015b118]
lea rcx, [rsp + 0x30]
call fcn.1400e9100
mov rdi, rax
test rax, rax
jne 0x140017a5f
lea rdx, [rsp + 0x30]
lea rcx, str.Unable_to_create__s
call fcn.14004f2f0
lea rcx, str.NOTE:_This_may_be_caused_by_a_poorly_designed_security_solution._See_https:__goo.gl_QTobxX.
call fcn.14004f2f0
xor eax, eax
jmp 0x140017b46
mov rcx, qword [0x1401e8688]
lea rdx, [rsp + 0xb0]
mov r8d, 0x80
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x1401e89e8]
lea rdx, [rsp + 0x70]
mov r8d, 0x20
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x70]
mov rcx, rdi
lea rdx, str.__Created_by__s_n__https:__rufus.ie_n
call fcn.140017390
lea r8, [rsp + 0xb0]
mov rcx, rdi
lea rdx, str._autorun__nicon___autorun.ico_nlabel___s_n
call fcn.140017390
mov rcx, rdi
call fcn.1400e9320
lea rdx, [rsp + 0x30]
lea rcx, str.Created:__s
call fcn.14004f2f0
lea rcx, [rsp + 0x30]
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140017ae0
cmp rax, 2
jae 0x140017b08
mov r8d, 0xc0
lea rdx, str.D:_a_rufus_rufus_srcicon.c
lea rcx, str.strlen_filename____2
call fcn.1400fbe54
lea rcx, [rsp + 0x30]
mov rax, rbx
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140017b10
mov byte [rsp + rax + 0x2f], 0x6f
lea rax, [rsp + 0x30]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140017b25
lea rax, [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x30]
mov byte [rbx + rax - 2], 0x63
call fcn.1400175c0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1c0
pop rdi
ret
Function at 0x140021f00
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.140021d00
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140021f37
mov rcx, rbx
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140021fa0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call fcn.140021d00
mov rdi, rax
cmp word [rax], 0x22
jne 0x140021ffd
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140021fd0
cmp word [rdi + rax*2 - 2], 0x22
jne 0x140021ffd
cmp word [rdi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140021fe4
xor eax, eax
mov word [rdi + rcx*2 - 2], ax
lea rcx, [rdi + 2]
jmp 0x140022000
mov rcx, rdi
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400e8c70
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret