joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074720
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14012bbd0]
mov dl, 1
call fcn.14005ce60
mov ebx, 1
nop dword [rax + rax]
mov edx, ebx
mov rcx, rdi
call fcn.1400638b0
inc ebx
cmp ebx, 8
jl 0x140074750
mov rcx, qword [0x14012c1d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [0x1401265d0]
xor edx, edx
call fcn.14006a7c0
mov rcx, qword [0x14012c1c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400754e0
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [0x14012bbd0]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], gethostbyaddr
call qword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [rsp + 0x28], 2
mov rcx, qword [0x14012bbd0]
mov edx, 5
mov eax, 9
cmove edx, eax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14012bbd0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x14012bbd0]
call qword [sym.imp.USER32.dll_SetFocus]
mov byte [0x14012bc7f], 1
mov byte [0x14012bc79], 0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x68
ret
Function at 0x140077db0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
lea rcx, [rsp + 0x80]
mov rsi, rdx
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
mov rcx, qword [rsp + 0x80]
mov edx, 0x104
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, rax
test rax, rax
je 0x140077ed5
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x140077ec4
mov rax, qword [rsp + 0x88]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
lea rax, str.Browse_for_Symbols_Directory
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x40], reloc.COMCTL32.dll_InitCommonControls
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov rdi, rax
test rax, rax
je 0x140077eae
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x80]
mov rdx, rdi
mov r8, qword [rcx]
call qword [r8 + 0x28]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
xor al, al
add rsp, 0x60
pop rdi
ret

Function at 0x1400785c0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x30
xor ebp, ebp
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rdx, [0x14012b036]
lea rcx, str.srv
lea r8d, [rbp + 4]
mov dword [rsp + 0x48], ebp
call fcn.1400a9d30
test eax, eax
jne 0x14007867c
lea rdx, [rsp + 0x48]
lea rcx, [0x14012ae2c]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov ebx, eax
call fcn.1400a82f0
lea rcx, [0x14012ae2c]
mov r8d, ebx
mov r9, rax
xor edx, edx
mov rdi, rax
call sub.VERSION.dll_GetFileVersionInfoW
mov rbx, qword [rsp + 0x40]
test eax, eax
je 0x14007866f
cmp dword [rdi + 0x30], 0x60000
jae 0x14007866f
mov rcx, qword [0x140126550]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea r9, [0x140040710]
lea rdx, [0x1400e98e8]
test rsi, rsi
je 0x140078669
lea rdx, [0x1400e9910]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, rdi
call fcn.1400a82b0
mov rdi, qword [rsp + 0x58]
cmp byte [0x14012b034], bpl
mov rsi, qword [rsp + 0x50]
jne 0x1400786d4
cmp qword [0x140130dc8], rbp
je 0x14007869c
cmp word [0x14012b036], bp
jne 0x1400786d4
mov rcx, qword [0x140126550]
lea r9, [0x140040710]
lea rdx, [0x1400e98e8]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [0x14012bbd0]
mov dl, 1
mov byte [0x14012b034], 1
call fcn.14005ce60
add rsp, 0x30
pop rbp
ret
Function at 0x14007aa40
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
sub rsp, 0x458
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rdx, [0x140120a98]
lea rcx, str.PROCEXP152
call fcn.14004d5d0
test eax, eax
jne 0x14007ab92
lea rcx, [rsp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r9, str.PROCEXP152.SYS
lea r8, [rsp + 0x230]
lea rdx, str._sDrivers_s
lea rcx, [rsp + 0x20]
call fcn.14002d7d0
lea rdx, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_DllRegisterServer
call fcn.14004d1d0
test al, al
jne 0x14007ab4b
lea r8, str.PROCEXP152.SYS
lea rdx, str.__TEMP___s
lea rcx, [rsp + 0x230]
call fcn.14002d7d0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_DllRegisterServer
call fcn.14004d1d0
test al, al
jne 0x14007ab4b
lea rdx, [rsp + 0x230]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r9, str.PROCEXP152.SYS
lea r8, [rsp + 0x230]
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call fcn.14002d7d0
lea rdx, [rsp + 0x20]
mov ecx, reloc.OLEAUT32.dll_DllRegisterServer
call fcn.14004d1d0
test al, al
je 0x14007ab72
lea r8, [0x140120a98]
lea rdx, [rsp + 0x20]
lea rcx, str.PROCEXP152
call fcn.14004d290
lea rcx, [rsp + 0x20]
test eax, eax
jne 0x14007ab8c
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x458
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x458
ret
Function at 0x14007cfa0
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x308
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x30], 0
test rcx, rcx
je 0x14007cfff
bts edx, 8
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
mov dword [rsp + 0x20], edx
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x308
ret
xor eax, eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x308
ret
Function at 0x14007f870
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x14007bdb0]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1400ab1f0
mov edx, 0x1388
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
cmp eax, 0x102
jne 0x14007f8e5
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x20
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
add rsp, 0x50
pop rbx
ret
Function at 0x140080c30
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ebfe0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130fd8], rax
test rax, rax
jne 0x140080c64
xor al, al
add rsp, 0x28
ret
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ec000]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140131000], rax
test rax, rax
je 0x140080c5d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ec010]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140131020], rax
test rax, rax
je 0x140080c5d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ec020]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140131030], rax
test rax, rax
je 0x140080c5d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ec030]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140131038], rax
test rax, rax
je 0x140080c5d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ec040]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140131048], rax
test rax, rax
je 0x140080c5d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ec050]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140131058], rax
test rax, rax
je 0x140080c5d
lea rcx, [0x1400ec060]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.ImageNtHeader
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130e50], rax
test rax, rax
jne 0x140080db7
lea rcx, str.imagehlp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.ImageNtHeader
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130e50], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.IsHungThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130ed0], rax
mov al, 1
add rsp, 0x28
ret
Function at 0x140091ba0
Capabilities:
Check os version

Disassembly:
mov dword [rsp + 0x18], r8d
mov byte [rsp + 8], cl
push rsi
push rdi
push r12
push r13
sub rsp, 0x98
mov r8d, dword [rdx + 0x50]
mov r13, rdx
movzx edi, cl
xor edx, edx
mov ecx, 0x800
xor r12b, r12b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x140091bf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x98
pop r13
pop r12
pop rdi
pop rsi
ret
mov rax, qword [0x140130d48]
mov qword [rsp + 0x90], rbx
test rax, rax
je 0x140091c39
mov rcx, rsi
test dil, dil
je 0x140091c21
call rax
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140091e07
call qword [0x140130d50]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140091e07
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jbe 0x140091c54
lea rcx, [r13 + 0x100]
jmp 0x140091c5e
mov r12b, 1
lea rcx, [r13 + 0xd0]
mov r8d, dword [r13 + 4]
xor edx, edx
mov r14d, edx
test r8d, r8d
je 0x140091c91
lea rax, [rcx + 0x48]
mov edx, r8d
add rcx, 0x44
cmp dword [rcx], 5
jne 0x140091c84
cmp dword [rax], 5
jne 0x140091c84
inc r14d
add rcx, 0x50
add rax, 0x50
dec rdx
jne 0x140091c77
test dil, dil
je 0x140091ca0
cmp r8d, r14d
jne 0x140091ca9
jmp 0x140091de2
cmp r8d, r14d
jne 0x140091de2
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x78], r15
lea rbp, [r13 + 0x100]
test r12b, r12b
je 0x140091cc9
lea rbp, [r13 + 0xd0]
mov r15d, edx
test r8d, r8d
je 0x140091dd5
lea rbx, [rbp + 0x48]
lea rsi, [rbp + 0x44]
add rbp, 0x30
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x48], rdx
movdqu xmmword [rsp + 0x58], xmm0
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xd8]
mov edx, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], gethostbyaddr
call qword [0x140130d58]
test eax, eax
jne 0x140091daa
mov rdi, qword [rsp + 0xd8]
test rdi, rdi
je 0x140091daa
cmp byte [rsp + 0xc0], al
je 0x140091d90
mov eax, dword [rsp + 0xd0]
test eax, eax
je 0x140091d6d
cmp eax, 1
jne 0x140091da1
cmp dword [rsi], 5
jne 0x140091d6d
cmp dword [rbx], 5
je 0x140091da1
lea rdx, [rsp + 0xc8]
mov rcx, rdi
call qword [0x140130d38]
cmp dword [rbx], 5
je 0x140091da1
cmp dword [rsp + 0xc8], 0
je 0x140091da1
inc r14d
lea rdx, [rsp + 0xc8]
mov rcx, rdi
call qword [0x140130d40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r15d
add rbp, 0x50
add rsi, 0x50
add rbx, 0x50
mov edx, 0
cmp r15d, dword [r13 + 4]
jb 0x140091cf0
movzx edi, byte [rsp + 0xc0]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
je 0x140091dfd
cmp dword [r13 + 4], r14d
jne 0x140091dfd
mov eax, 0x770
jmp 0x140091dff
xor eax, eax
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
add rsp, 0x98
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14009a290
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x830
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x820], rax
cmp byte [0x14012ae0c], 0
mov ebx, edx
je 0x14009a2ff
mov r8, rcx
lea rdx, str.Are_you_sure_you_want_to_kill__s_
lea rcx, [rsp + 0x20]
call fcn.14004a790
mov rcx, qword [0x14012bbd0]
lea r8, [0x1400d25b0]
lea rdx, [rsp + 0x20]
mov r9d, gethostbyaddr
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x14009a2ff
mov rcx, qword [0x14012bbd8]
call qword [sym.imp.USER32.dll_SetFocus]
xor al, al
jmp 0x14009a374
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14009a32c
mov rdx, qword [0x14012bbd0]
lea rcx, str.Error_opening_process
call fcn.14009aca0
xor al, al
jmp 0x14009a374
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14009a35e
mov rdx, qword [0x14012bbd0]
lea rcx, str.Error_terminating_process
call fcn.14009aca0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14009a374
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x830
pop rbx
ret
Function at 0x14009a390
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0xa60
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0xa50], rax
cmp byte [0x14012ae0c], 0
mov esi, edx
je 0x14009a406
mov r8, rcx
lea rdx, str.Are_you_sure_you_want_to_kill__s_and_its_descendants_
lea rcx, [rsp + 0x250]
call fcn.14004a790
mov rcx, qword [0x14012bbd0]
lea r8, [0x1400d25b0]
lea rdx, [rsp + 0x250]
mov r9d, gethostbyaddr
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x14009a406
mov rcx, qword [0x14012bbd8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x14009a59b
mov qword [rsp + 0xa78], rbx
mov rbx, qword [0x140126ab0]
test rbx, rbx
je 0x14009a588
mov qword [rsp + 0xa80], rbp
xor ebp, ebp
mov qword [rsp + 0xa88], rdi
mov rax, rbx
test rbx, rbx
je 0x14009a568
nop dword [rax]
cmp dword [rax + 0x54], esi
je 0x14009a453
mov rax, qword [rax + 0x68]
test rax, rax
jne 0x14009a440
jmp 0x14009a568
mov r8d, dword [rbx + 0x54]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x14009a521
mov r8, qword [rbx + 0x48]
lea rdx, str.Error_opening__s
lea rcx, [rsp + 0x250]
call fcn.14004a790
mov rdi, qword [0x14012bbd0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14009a4eb
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
mov ecx, 0x1100
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rsp + 0x40]
lea r8, [rsp + 0x250]
lea rdx, str._s:__s
lea rcx, [rsp + 0x50]
call fcn.14004ec00
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14009a504
lea r8, [rsp + 0x250]
lea rdx, [0x1400eb7b8]
lea rcx, [rsp + 0x50]
call fcn.14004ec00
lea r8, [0x1400d25b0]
lea rdx, [rsp + 0x50]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14009a568
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14009a55f
mov r8, qword [rbx + 0x48]
lea rdx, str.Error_terminating__s
lea rcx, [rsp + 0x250]
call fcn.14004a790
mov rdx, qword [0x14012bbd0]
lea rcx, [rsp + 0x250]
call fcn.14009aca0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx + 0x698]
test rbx, rbx
jne 0x14009a430
mov rdi, qword [rsp + 0xa88]
mov rbp, qword [rsp + 0xa80]
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0xa78]
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0xa60
pop rsi
ret
Function at 0x14009a9d0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r15d, r15d
lea r14, [0x14013a470]
mov r12d, 0x104
mov esi, r15d
movzx ebx, r15w
lea r13, [0x14013a270]
nop word [rax + rax]
movzx edi, bx
lea rdx, str._c:_
lea rcx, [rbp - 0x80]
lea r8d, [rdi + 0x41]
call fcn.140079370
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x14009aa69
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x14009ac05
lea r8d, [rdi + 0x41]
lea rdx, str.DosDevices_c:
lea rcx, [rbp + 0x1c0]
call fcn.140079460
mov rax, qword [0x140126518]
mov dword [rsp + gethostbyaddr], 0x30
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x48], 0x40
test rax, rax
jne 0x14009aac5
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400e45b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140126518], rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x70]
call rax
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x30]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x20001
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x50], xmm0
call qword [0x140130cd0]
test eax, eax
jne 0x14009ac05
mov rcx, qword [rsp + 0x20]
lea rax, [rbp - 0x50]
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x58], rax
mov word [rbp - 0x5e], r12w
call qword [0x140130ce8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140126518]
mov rdi, qword [rbp - 0x58]
mov dword [rsp + gethostbyaddr], 0x30
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x48], 0x40
test rax, rax
jne 0x14009ab78
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400e45b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140126518], rax
lea rcx, [rsp + 0x60]
mov rdx, rdi
call rax
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x30]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x20001
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x50], xmm0
call qword [0x140130cd0]
test eax, eax
jne 0x14009abda
mov rcx, qword [rsp + 0x20]
lea rax, [rbp - 0x50]
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x58], rax
mov word [rbp - 0x5e], r12w
call qword [0x140130ce8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp - 0x58]
movsxd rax, esi
mov edx, 0x100
imul rcx, rax, 0x202
add rcx, r13
call fcn.1400a97ac
lea eax, [rbx + 0x41]
inc esi
mov word [r14], ax
add r14, 0x202
invalid
invalid
Function at 0x1400a1020
Capabilities:
Link many functions at runtime
Set environment variable

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SymInitialize
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumerateLoadedModulesW64
mov rcx, rbx
mov qword [0x140130dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymEnumerateModulesW64
mov rcx, rbx
mov qword [0x140130e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymRegisterCallback64
mov rcx, rbx
mov qword [0x140130e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleInfoW64
mov rcx, rbx
mov qword [0x140130e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymCleanup
mov rcx, rbx
mov qword [0x140130e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFromAddrW
mov rcx, rbx
mov qword [0x140130df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSymFromName
mov rcx, rbx
mov qword [0x140130de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MiniDumpWriteDump
mov rcx, rbx
mov qword [0x140130de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x140130da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetOptions
mov rcx, rbx
mov qword [0x140130df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymLoadModuleExW
mov rcx, rbx
mov qword [0x140130dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140130e18], rax
test rax, rax
je 0x1400a1158
lea rax, [0x140091e60]
mov qword [0x140130e08], rax
jmp 0x1400a1186
lea rdx, str.SymLoadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
lea rdx, [0x140091e90]
test rax, rax
mov qword [0x140130e10], rax
cmovne rcx, rdx
mov qword [0x140130e08], rcx
lea rdx, str.SymUnloadModule64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImageNtHeader
mov rcx, rbx
mov qword [0x140130e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x140130e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x140130e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
mov qword [0x140130e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x14012b034], 0
mov qword [0x140130dd8], rax
jne 0x1400a1218
mov rax, qword [0x140130dc8]
test rax, rax
je 0x1400a1236
cmp word [0x14012b036], 0
je 0x1400a1233
lea rdx, [0x14012b036]
lea rcx, str._NT_SYMBOL_PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [0x140130dc8]
test rax, rax
setne al
add rsp, 0x20
pop rbx
ret