joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400be7d0
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rdi, rdx
mov edx, 0xb
mov esi, r8d
mov dword [rsp + 0x64], r8d
mov r13, rcx
lea r8d, [rdx + 0x10]
xor ecx, ecx
mov dword [rsp + 0x60], r9d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x70], rax
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400be854
imul ebx, r13d
add ebx, 0xa
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea ecx, [rbx + rbx*4]
shl ecx, 2
mov r15d, r13d
mov edx, 0x9d
mov r14, rax
imul r15d, esi
sub r15d, ecx
xor ecx, ecx
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [r12 + r12]
mov ebp, r13d
imul ebp, dword [rsp + 0x68]
sub ebp, eax
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
add ebp, 9
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, r14d
mov esi, eax
mov eax, dword [rsp + 0x60]
imul edi, ebx
lea ecx, [rdi + rdi*4]
xor ebx, ebx
lea r9d, [r15 - 7]
imul r13d, eax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rdx
sub r13d, ecx
mov ecx, dword [rsp + 0x64]
sub r13d, dword [rsp + 0x70]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
lea r8, str.c3ret
lea rdx, str.c1ret
mov ecx, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x78]
mov r9d, r13d
mov qword [rsp + 0x30], rax
lea rax, str.rack
mov r8d, esi
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], ebx
call fcn.1400da770
lea r8, [0x140001b00]
mov r9d, r13d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [r15 - 7]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0xd3
mov rbx, rax
lea r8d, [rcx + 0xf]
sub ebx, r12d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x82
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, str.wine
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rax, str.comportment
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bf030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov esi, edx
mov rdi, rcx
lea ebx, [r8 + rsi]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
test bl, bl
jle 0x1400bf09f
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.friday
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], 0
mov qword [rdi], rax
imul eax, esi, 7
add eax, ebp
mov dword [rdi + 0x10], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 1
mov qword [rdi + 0x18], rax
sub ecx, ebp
movsx eax, bl
add eax, 6
imul ecx, esi
add ecx, eax
mov rax, rdi
mov dword [rdi + 0x20], ecx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400bf130
Capabilities:
Check if file exists
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movzx ebx, cl
cmp cl, 2
jb 0x1400bf190
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, bl
add al, al
movsx ecx, al
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x3d
xor ecx, ecx
lea r8d, [rdx - 0x2e]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rbx - 2]
movsxd rdi, eax
cmp edi, 2
je 0x1400bf1cb
xor ecx, ecx
mov edx, 0x257
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
test dil, dil
jg 0x1400bf26b
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
movsx ecx, bl
movzx eax, sil
lea r9d, [r14 + 2]
lea r8, str.cleric
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ecx
lea rdx, str.cleric
mov ecx, edi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [r14 + 0x1d]
mov edx, 0x23a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c5a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, rbp
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400bf670
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r15, qword [rsp + 0x1d0]
mov r14, r9
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, [0x140001b00]
movzx r9d, al
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x100
mov r8d, 0xd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
mov rbp, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8d, [rax*4 + 4]
sub r8d, ebx
sub r8d, edi
add r8d, esi
add r8d, ebp
cmp r8d, 5
jge 0x1400bf74b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r8d, 5
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rax, r12
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400bf790
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x350
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x340], rax
or rbx, 0xffffffffffffffff
mov rsi, rcx
mov rbp, rbx
nop dword [rax + rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x1400bf7d0
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx r13d, bpl
mov ecx, r13d
add r15d, 5
mov qword [rsp + 0x68], rax
imul ecx, edi
sub ecx, r12d
add r15d, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r14, rax
xor eax, eax
mov r9d, r15d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x200]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp bpl, r15b
jle 0x1400bf925
movsx rcx, bpl
mov rdi, rbx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400bf896
mov eax, ecx
sub eax, r12d
add eax, r14d
mov r14, rbx
add edi, eax
add edi, r15d
nop
inc r14
cmp byte [rsi + r14], 0
jne 0x1400bf8b0
lea eax, [rdi*4 - 0xc]
sub eax, ecx
lea rcx, str.thong
add r14d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor edx, edx
lea ecx, [r14 + 5]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov eax, ecx
lea r8, str.c2ret
lea rdx, str.prompt
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
mov r9d, edi
mov ecx, r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400bf925
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
movsx rax, bpl
imul ebx, eax
imul eax, r15d, 0xb
sub ebx, eax
add r8d, 0xfffffffb
lea rax, str.pansy
sub ebx, r12d
lea rcx, [rsp + 0x70]
mov edx, 0x10
add r8d, ebx
mov qword [rsp + 0x20], rax
call fcn.1400db730
lea rax, str.pimple
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400bfc10
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movzx ebp, r9b
mov rdi, r8
mov esi, edx
mov r14, rcx
cmp r9b, dl
jl 0x1400bfc6a
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx r12d, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r13, rax
xor eax, eax
mov r9d, r12d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
lea r15d, [rsi + r14]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
or rcx, 0xffffffffffffffff
movzx r8d, ax
mov rdx, rcx
nop
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400bfcd0
movzx eax, sil
imul dl
movzx edx, al
movzx eax, bpl
imul dl
movzx edx, al
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400bfcf0
movzx eax, cl
sub r12b, 9
add al, al
add cl, al
movzx eax, r14b
add cl, cl
add dl, cl
imul dl
movzx edx, al
movzx eax, r13b
imul r14b
movzx ecx, al
movzx eax, sil
imul cl
movzx ecx, al
movzx eax, bl
sub cl, r15b
imul cl
movzx ecx, al
shl cl, 2
add al, cl
sub dl, al
mov al, 0xe
imul r15b
add al, dl
sub al, r8b
add al, r12b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bfff0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
mov r15, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.rainbow
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
test ebx, ebx
jns 0x1400c0151
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.objective
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x2c5
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.rainbow
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.rainbow
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edi, edi
lea r9d, [rdi + 4]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], 4
lea r9d, [rdi + 4]
lea r8, str.demur
lea rdx, str.c1a2
mov ecx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
neg esi
lea ebp, [r15 + 7]
mov ecx, esi
mov edi, eax
mov r14, rax
sub ecx, ebx
add ebp, ecx
sub edi, ebp
add edi, 6
cmp ebx, edi
jg 0x1400c01df
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x1c7
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [r15*4]
lea ecx, [rbp + 6]
sub eax, edi
add eax, ebx
add ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [rsi + rbx]
add ebp, 0xfffffffa
add eax, r14d
add eax, ebp
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400c1390
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movsx esi, byte [rsp + 0x1d0]
mov ebx, r9d
movsxd rbp, edx
mov r14d, ecx
mov edi, esi
cmp r9d, esi
jae 0x1400c13d9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r15d, r15d
lea r8, [0x140001b00]
movsx r9, sil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp ebp, ebx
je 0x1400c1512
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea r8d, [r15 + 0x15]
mov edx, 0x3e1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea edx, [r15 + 0x3d]
lea r8d, [r15 + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rdx, str.turret
lea rcx, str.c1a1
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8d, [r15 + 0xe]
mov edx, 0x24e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8d, [r15 + 0xb]
mov edx, 0xff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea edx, [r15 + 0x63]
lea r8d, [r15 + 0xf]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x1400ed3f4]
lea rdx, str.turret
mov r9d, ebx
mov ecx, r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, str.pressroom
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c1df0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx ebx, r8b
cmp dl, r8b
je 0x1400c1ea9
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.extreme
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x87
lea r8d, [rdx - 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp bl, 0x40
jl 0x1400c1f8d
xor ecx, ecx
mov edx, 0x347
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.extreme
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x1b0
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0xec
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
cmp bl, al
jg 0x1400c1fc2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret