joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180022810
Capabilities:
Get thread local storage value
Query or enumerate registry value
Set thread local storage value

Disassembly:
push rbx
push rsi
sub rsp, 0x58
mov rbx, rcx
lea r8, [rsp + 0x88]
lea rdx, str.SYSTEMCurrentControlSetServicesdcryptconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test eax, eax
jne 0x1800229c1
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x50], rdi
lea rdi, [rbx + 4]
lea rdx, str.Flags
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x78], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebp, ebp
test eax, eax
je 0x180022888
mov dword [rdi], ebp
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
lea rdx, str.sysBuild
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x78], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1800228c0
mov dword [rbx], ebp
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
lea rdi, [rbx + 0xc]
mov qword [rsp + 0x28], rax
lea rdx, str.Hotkeys
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x78], 0x10
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180022903
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x180022955
mov qword [rsp + 0x30], rbp
lea rcx, str..dcrypt
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002299b
mov ecx, dword [0x18003cd00]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x220058
mov rcx, rdi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1800229a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1800229a0
mov dword [rbx + 8], ebp
jmp 0x1800229a7
mov eax, dword [rsp + 0x44]
mov dword [rbx + 8], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
mov eax, esi
add rsp, 0x58
pop rsi
pop rbx
ret
Function at 0x1800229d0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub rsp, 0x468
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180022a62
cmp eax, 0x104
jae 0x180022a62
lea rax, str.acrypt.sys
lea r9, [rsp + 0x30]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x240]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
js 0x180022a62
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x468
ret
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x468
ret

Function at 0x180022a90
Capabilities:
Check os version
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180022ae8
lea r8, [rsp + 0x30]
lea rdx, str.dcrypt
lea rcx, str.UpperFilters
call fcn.1800223d0
test eax, eax
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
mov rcx, 0xffffffff80000002
cmovne ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180022b22
lea r8, [rsp + 0x30]
lea rdx, str.dcrypt
lea rcx, str.LowerFilters
call fcn.1800223d0
test eax, eax
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rdi, str.acrypt.sys
cmp al, 6
jb 0x180022b6c
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180022b69
lea r8, [rsp + 0x30]
lea rcx, str.DumpFilters
mov rdx, rdi
call fcn.1800223d0
test eax, eax
cmovne ebx, eax
call fcn.180022190
lea rcx, [rsp + 0x40]
mov edx, 0x104
test eax, eax
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180022bdd
cmp eax, 0x104
jae 0x180022bdd
lea r9, [rsp + 0x40]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x250]
mov edx, 0x104
mov qword [rsp + 0x20], rdi
call fcn.180001090
test eax, eax
jns 0x180022bbf
mov eax, 0x7a
jmp 0x180022be2
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180022bd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180022be2
mov eax, ebx
jmp 0x180022be2
mov eax, 0x7b
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18000eda0
mov rbx, qword [rsp + 0x480]
add rsp, 0x470
pop rdi
ret
Function at 0x180022c10
Capabilities:
Create service
Get common file path

Disassembly:
sub rsp, 0x4a8
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x490], rax
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180022d7c
cmp eax, 0x104
jae 0x180022d7c
lea rax, str.acrypt.sys
lea r9, [rsp + 0x70]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x280]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
jns 0x180022c97
mov eax, 0x7a
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x4a8
ret
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x4b0], rbx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x180022cdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x4a8
ret
lea rax, str.FltMgr
mov qword [rsp + 0x4a0], rdi
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
lea rax, str.Filter
lea r8, str.DiskCryptor_driver
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x280]
lea rdx, str.dcrypt
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
mov r9d, 0xf01ff
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x180022d5c
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180022d64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rdi, qword [rsp + 0x4a0]
jmp 0x180022cbd
mov eax, 0x7b
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x4a8
ret
Function at 0x180022da0
Capabilities:
Copy file
Get common file path

Disassembly:
sub rsp, 0x678
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rcx, qword [0x18003ccf8]
test rcx, rcx
je 0x180022eda
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180022eda
mov qword [rsp + 0x670], rbx
mov ebx, 0x103
cmp eax, ebx
jae 0x180022ed0
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.18000f7e4
test rax, rax
je 0x180022ed0
lea rdx, [rsp + 0x30]
mov rcx, rax
sub rcx, rdx
sar rcx, 1
sub rbx, rcx
lea rcx, [rax + 2]
mov rdx, rbx
call section..text
test eax, eax
jns 0x180022e55
mov eax, 0x7a
mov rbx, qword [rsp + 0x670]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x678
ret
lea rcx, [rsp + 0x240]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180022ed0
cmp eax, 0x104
jae 0x180022ed0
lea rax, str.acrypt.sys
lea r9, [rsp + 0x240]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x450]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
js 0x180022e30
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180022ec9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180022e35
xor eax, eax
jmp 0x180022e35
mov eax, 0x7b
jmp 0x180022e35
mov eax, 0x7b
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x678
ret
Function at 0x180022f00
Capabilities:
Check os version
Delete file
Get common file path

Disassembly:
push rbx
sub rsp, 0x490
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x480], rax
call fcn.180022da0
mov ebx, eax
test eax, eax
jne 0x1800230c5
lea rcx, [rsp + 0x38]
call sym.dcapi.dll_dc_load_config
mov ebx, eax
test eax, eax
jne 0x1800230c5
mov eax, dword [rsp + 0x38]
cmp eax, 0x2b4
jae 0x180022fc5
lea rcx, [rsp + 0x270]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180023021
cmp eax, 0x104
jae 0x180023021
lea rax, str.dc_fsf.sys
lea r9, [rsp + 0x270]
lea r8, str._sdrivers_s
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.180001090
test eax, eax
jns 0x180022fa7
mov ebx, 0x7a
jmp 0x1800230c5
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.180022040
mov ebx, eax
test eax, eax
jne 0x1800230c5
mov eax, dword [rsp + 0x38]
cmp eax, 0x16e
jae 0x18002302b
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x180023005
lea r8, [rsp + 0x30]
lea rdx, str.dcrypt
lea rcx, str.UpperFilters
call fcn.180022230
mov ebx, eax
test ebx, ebx
jne 0x1800230c5
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x38]
or ecx, 0x180
mov dword [rsp + 0x3c], ecx
jmp 0x18002302f
mov ebx, 0x7b
jmp 0x1800230c5
mov ecx, dword [rsp + 0x3c]
cmp eax, 0x282
jae 0x18002303e
bts ecx, 0xa
mov dword [rsp + 0x3c], ecx
cmp eax, 0x332
jae 0x18002308c
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x18002308c
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x180023088
lea r8, [rsp + 0x30]
lea rdx, str.acrypt.sys
lea rcx, str.DumpFilters
call fcn.180022230
mov ebx, eax
test ebx, ebx
jne 0x1800230c5
lea rcx, [rsp + 0x38]
call sym.dcapi.dll_dc_save_config
mov ebx, eax
test eax, eax
jne 0x1800230c5
call sym.dcapi.dll_dc_get_version
lea r8, str.DC_UPD__d
lea rcx, [rsp + 0x60]
mov r9d, eax
mov edx, 0x104
call fcn.180001090
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x490
pop rbx
ret
Function at 0x180023150
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x28], 0x34e
mov dword [rsp + 0x2c], 0x580
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
call fcn.180022da0
mov ebx, eax
test eax, eax
jne 0x180023287
call fcn.180022c10
mov ebx, eax
test eax, eax
jne 0x180023287
call fcn.180022040
mov ebx, eax
test eax, eax
jne 0x180023287
lea r8, [rsp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlClass71A27CDD_812A_11D0_BEC7_08002BE2092F
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x1800231eb
lea r8, [rsp + 0x20]
lea rdx, str.dcrypt
lea rcx, str.LowerFilters
call fcn.180022230
mov ebx, eax
test ebx, ebx
jne 0x180023287
lea r8, [rsp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x18002322c
lea r8, [rsp + 0x20]
lea rdx, str.dcrypt
lea rcx, str.UpperFilters
call fcn.180022230
mov ebx, eax
test ebx, ebx
jne 0x180023287
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x180023277
lea r8, [rsp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test eax, eax
jne 0x180023273
lea r8, [rsp + 0x20]
lea rdx, str.acrypt.sys
lea rcx, str.DumpFilters
call fcn.180022230
mov ebx, eax
test ebx, ebx
jne 0x180023287
lea rcx, [rsp + 0x28]
call sym.dcapi.dll_dc_save_config
mov ebx, eax
test eax, eax
je 0x18002328e
call sym.dcapi.dll_dc_remove_driver
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x50
pop rbx
ret

Function at 0x1800232b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x38], rdx
mov rcx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, 0x220054
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rsp, 0x48
ret

Function at 0x180023300
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x258]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180023330
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220070
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov ecx, 1
cmovne ecx, dword [rsp + 0x2de]
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x308
ret
Function at 0x1800233c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x40
mov ecx, dword [0x18003cd00]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rdi
mov rcx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 4]
mov edx, 0x220050
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rsp + 0x58]
test eax, eax
sete dil
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x180023430
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x300
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rdi, rdx
lea rdx, [rsp + 0x258]
mov rbx, rcx
sub rdx, rcx
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180023460
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
mov edx, 0x22001c
mov dword [rsp + 0x28], 0x22c
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1800234c1
mov eax, 1
jmp 0x1800234e8
cmp word [rdi + 0x24], 0
jne 0x1800234e1
sub rdi, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rdi + rbx + 0x22], ax
test ax, ax
jne 0x1800234d0
mov eax, dword [rsp + 0x2de]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
mov rbx, qword [rsp + 0x310]
add rsp, 0x300
pop rdi
ret

Function at 0x180023510
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x258]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x180023540
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x22003c
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x308
ret
Function at 0x1800235d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea r8, [rsp + 0x258]
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x180023600
mov ecx, dword [0x18003cd00]
mov byte [rsp + 0x2e7], dl
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x22006c
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x308
ret

Function at 0x1800236a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x258]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1800236d0
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220038
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x308
ret

Function at 0x180023760
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x308
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea r8, [rsp + 0x258]
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [r8 + rcx - 2], ax
test ax, ax
jne 0x180023790
mov ecx, dword [0x18003cd00]
mov byte [rsp + 0x2e7], dl
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220034
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x2de]
test eax, eax
mov edx, 1
cmove ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x308
ret
Function at 0x180023830
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x740
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbx, rcx
mov ecx, dword [0x18003cd00]
mov edi, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rsp + 0x258]
mov rsi, rax
sub rcx, rbx
nop word [rax + rax]
movzx edx, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], dx
test dx, dx
jne 0x180023880
lea rax, [rsp + 0x40]
xor ebx, ebx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2f0]
mov r9d, 0x298
mov edx, 0x22001c
mov rcx, rsi
mov dword [rsp + 0x28], 0x22c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18002398b
test byte [rsp + 0x300], 0x14
jne 0x18002398b
cmp dword [rsp + 0x30c], ebx
jne 0x18002398b
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov r9d, 0x298
mov edx, 0x220014
mov rcx, rsi
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x2da], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x18002393d
lea eax, [rbx + 1]
jmp 0x180023990
mov ebx, dword [rsp + 0x2de]
test ebx, ebx
jne 0x180023987
test dil, 8
jne 0x180023958
test byte [rsp + 0x304], 8
je 0x180023987
lea r9, [rsp + 0x314]
lea r8, [0x18002d080]
lea rcx, [rsp + 0x520]
mov edx, 0x104
call fcn.18000f09c
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov eax, ebx
jmp 0x180023990
mov eax, 8
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.18000eda0
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800239c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x300
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbx, rcx
xor edx, edx
lea rcx, str.ArcNamemulti_0_disk_0_rdisk_0_partition_1_
nop word [rax + rax]
movzx eax, word [rdx + rcx]
add rdx, 2
mov word [rsp + rdx + 0x256], ax
test ax, ax
jne 0x1800239f0
mov ecx, dword [0x18003cd00]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x40]
mov r9d, 0x298
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov edx, 0x220040
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180023a84
mov eax, dword [rsp + 0x2de]
test eax, eax
jne 0x180023a89
lea rcx, [rsp + 0x258]
lea rdx, [rsp + 0x258]
sub rbx, rcx
movzx ecx, word [rdx]
add rdx, 2
mov word [rbx + rdx - 2], cx
test cx, cx
jne 0x180023a71
jmp 0x180023a89
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
add rsp, 0x300
pop rbx
ret
Function at 0x180023ab0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x300
mov rax, qword [0x180039000]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rsi, rcx
mov ecx, dword [0x18003cd00]
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, 0x7d
mov rcx, rsi
mov rbp, rax
call fcn.18000f474
xor r12d, r12d
mov r8, rdi
mov rdx, rsi
lea rbx, [rdi + 0x210]
mov word [rax + 2], r12w
sub r8, rsi
nop word [rax + rax]
movzx eax, word [rdx]
add rdx, 2
mov word [r8 + rdx + 0x20e], ax
test ax, ax
jne 0x180023b20
mov edx, 0x7b
mov rcx, rsi
call fcn.18000f474
lea r8, str.__Volume_s
lea rcx, [rsp + 0x258]
mov r9, rax
mov edx, 0x41
call fcn.18000f09c
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x50]
mov r9d, 0x298
mov edx, 0x220040
mov rcx, rbp
mov dword [rsp + 0x28], 0x298
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180023c47
cmp dword [rsp + 0x2de], r12d
jne 0x180023c47
lea rax, [rsp + 0x258]
mov rdx, rdi
lea rcx, [rsp + 0x258]
sub rdx, rax
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx + 6], ax
test ax, ax
jne 0x180023bd0
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x40]
lea rax, [rdi + 0x418]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x50]
mov r9d, 0x298
mov rcx, rbp
mov edx, 0x22001c
mov dword [rsp + 0x28], 0x22c
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180023c47
lea rdx, [rdi + 0x43c]
cmp word [rdx], r12w
jne 0x180023c42
sub rdx, rbx
movzx ecx, word [rbx]
add rbx, 2
mov word [rdx + rbx - 2], cx
test cx, cx
jne 0x180023c31
mov eax, r12d
jmp 0x180023c4c
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000eda0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret