{"type": "func", "start": 6443714332, "end": 6443714578, "name": "_getdrive", "pseudocode": "// \n// _getdrive from 0x18013471c to 0x180134812 (246 bytes)\n// \n// 3 xrefs:\n// > get_drive_number_from_path @ 0x180129692\n// > common_getdcwd @ 0x18013bf46\n// > @ 0x180203278\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nint __cdecl getdrive()\n{\n DWORD CurrentDirectoryW; // eax\n int v1; // edi\n int v2; // edi\n DWORD v3; // esi\n WCHAR *v4; // rax\n WCHAR *v5; // rbx\n int v6; // ecx\n int v7; // edi\n WCHAR Buffer[264]; // [rsp+20h] [rbp-228h] BYREF\n\n memset(Buffer, 0, 0x20Au);\n CurrentDirectoryW = GetCurrentDirectoryW(0x105u, Buffer);\n if ( CurrentDirectoryW > 0x104 )\n {\n v3 = CurrentDirectoryW + 1;\n v4 = (WCHAR *)calloc_base(CurrentDirectoryW + 1, 2u);\n v1 = 0;\n v5 = v4;\n if ( v4 && GetCurrentDirectoryW(v3, v4) )\n {\n if ( *v5 && v5[1] == 58 )\n {\n v6 = *v5;\n v7 = v6 - 32;\n if ( (unsigned int)(v6 - 97) > 0x19 )\n v7 = *v5;\n v1 = v7 - 64;\n }\n }\n else\n {\n *errno() = 12;\n }\n free_base(v5);\n }\n else\n {\n v1 = 0;\n if ( Buffer[0] && Buffer[1] == 58 )\n {\n v2 = Buffer[0] - 32;\n if ( (unsigned int)Buffer[0] - 97 > 0x19 )\n v2 = Buffer[0];\n return v2 - 64;\n }\n }\n return v1;\n}", "assembly": "; \n; _getdrive from 0x18013471c to 0x180134812 (246 bytes)\n; \n; 3 xrefs:\n; > get_drive_number_from_path @ 0x180129692\n; > common_getdcwd @ 0x18013bf46\n; > @ 0x180203278\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov [rsp+arg_0], rbx ; +0x0, 0x18013471c\nmov [rsp+arg_8], rsi ; +0x5, 0x180134721\npush rdi ; +0xa, 0x180134726\nsub rsp, 240h ; +0xb, 0x180134727\nmov rax, cs:__security_cookie ; +0x12, 0x18013472e\nxor rax, rsp ; +0x19, 0x180134735\nmov [rsp+248h+var_18], rax ; +0x1c, 0x180134738\nxor edx, edx; Val ; +0x24, 0x180134740\nlea rcx, [rsp+248h+Buffer]; void * ; +0x26, 0x180134742\nmov r8d, 20Ah; Size ; +0x2b, 0x180134747\ncall memset ; +0x31, 0x18013474d\nlea rdx, [rsp+248h+Buffer]; lpBuffer ; +0x36, 0x180134752\nmov ecx, 105h; nBufferLength ; +0x3b, 0x180134757\ncall cs:GetCurrentDirectoryW ; +0x40, 0x18013475c\ncmp eax, 104h ; +0x46, 0x180134762\nja short loc_180134790 ; +0x4b, 0x180134767\nxor edi, edi ; +0x4d, 0x180134769\ncmp [rsp+248h+Buffer], di ; +0x4f, 0x18013476b\njz short loc_1801347EB ; +0x54, 0x180134770\ncmp [rsp+248h+var_226], 3Ah ; ':' ; +0x56, 0x180134772\njnz short loc_1801347EB ; +0x5c, 0x180134778\nmovzx ecx, [rsp+248h+Buffer] ; +0x5e, 0x18013477a\nlea eax, [rcx-61h] ; +0x63, 0x18013477f\ncmp eax, 19h ; +0x66, 0x180134782\nlea edi, [rcx-20h] ; +0x69, 0x180134785\ncmova edi, ecx ; +0x6c, 0x180134788\nsub edi, 40h ; '@' ; +0x6f, 0x18013478b\njmp short loc_1801347EB ; +0x72, 0x18013478e\nlea esi, [rax+1] ; +0x74, 0x180134790\nmov edx, 2; Size ; +0x77, 0x180134793\nmov ecx, esi; Count ; +0x7c, 0x180134798\ncall _calloc_base ; +0x7e, 0x18013479a\nxor edi, edi ; +0x83, 0x18013479f\nmov rbx, rax ; +0x85, 0x1801347a1\ntest rax, rax ; +0x88, 0x1801347a4\njz short loc_1801347B8 ; +0x8b, 0x1801347a7\nmov rdx, rax; lpBuffer ; +0x8d, 0x1801347a9\nmov ecx, esi; nBufferLength ; +0x90, 0x1801347ac\ncall cs:GetCurrentDirectoryW ; +0x92, 0x1801347ae\ntest eax, eax ; +0x98, 0x1801347b4\njnz short loc_1801347C5 ; +0x9a, 0x1801347b6\ncall _errno ; +0x9c, 0x1801347b8\nmov dword ptr [rax], 0Ch ; +0xa1, 0x1801347bd\njmp short loc_1801347E3 ; +0xa7, 0x1801347c3\ncmp [rbx], di ; +0xa9, 0x1801347c5\njz short loc_1801347E3 ; +0xac, 0x1801347c8\ncmp word ptr [rbx+2], 3Ah ; ':' ; +0xae, 0x1801347ca\njnz short loc_1801347E3 ; +0xb3, 0x1801347cf\nmovzx ecx, word ptr [rbx] ; +0xb5, 0x1801347d1\nlea eax, [rcx-61h] ; +0xb8, 0x1801347d4\ncmp eax, 19h ; +0xbb, 0x1801347d7\nlea edi, [rcx-20h] ; +0xbe, 0x1801347da\ncmova edi, ecx ; +0xc1, 0x1801347dd\nsub edi, 40h ; '@' ; +0xc4, 0x1801347e0\nmov rcx, rbx; Block ; +0xc7, 0x1801347e3\ncall _free_base ; +0xca, 0x1801347e6\nmov eax, edi ; +0xcf, 0x1801347eb\nmov rcx, [rsp+248h+var_18] ; +0xd1, 0x1801347ed\nxor rcx, rsp; StackCookie ; +0xd9, 0x1801347f5\ncall __security_check_cookie ; +0xdc, 0x1801347f8\nlea r11, [rsp+248h+var_8] ; +0xe1, 0x1801347fd\nmov rbx, [r11+10h] ; +0xe9, 0x180134805\nmov rsi, [r11+18h] ; +0xed, 0x180134809\nmov rsp, r11 ; +0xf1, 0x18013480d\npop rdi ; +0xf4, 0x180134810\nretn ; +0xf5, 0x180134811", "xrefs": ["get_drive_number_from_path @ 0x180129692", "common_getdcwd @ 0x18013bf46", " @ 0x180203278"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}