joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a070
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
sub rsp, 0x178
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, 0x1cd
mov r8d, 0xd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.coil
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x29c
mov r8d, 0x1a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x9c
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.duplexer
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, str.hard_hat
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x178
ret
Function at 0x14006ab50
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov r14, r8
mov qword [rsp + 0x30], r8
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edi, dword [rsp + 0x1d0]
imul ebx, edi, 7
mov ecx, 0xffff
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov rdx, r14
movzx esi, al
xor ecx, ecx
mov r12d, eax
add sil, sil
add sil, bl
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, r14d
mov rbp, rax
movzx eax, sil
mov r13d, 1
imul ecx, edi
sub r13d, ecx
mov ecx, dword [rsp + 0x38]
mov r15d, 0xfffffffe
sub r15b, dil
lea edx, [rcx + r14*2]
sub r13d, eax
sub r13d, ebx
shl edx, 2
mov r14d, 7
sub r14d, edx
sub r14d, eax
mov rax, qword [rsp + 0x30]
sub r15b, al
mov edi, r14d
sub r15b, sil
movsx ebx, r15b
imul edi, r13d
sub edi, ebx
add edi, ebp
cmp sil, r14b
jae 0x14006ac64
xor ecx, ecx
mov edx, 0x38b
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, r14d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov rax, qword [rsp + 0x30]
imul ebx, edi
imul ebp, r14d
lea eax, [rax*2]
movzx ecx, sil
imul ebp, r13d
sub ebp, ebx
lea ebx, [r12 + 0xd]
add eax, ebp
sub eax, ecx
add ebx, eax
cmp r12d, ebx
jl 0x14006ac97
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
mov edx, 0x15a
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp r15b, bl
je 0x14006acc9
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rax, str.c0a2
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006b0a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r15d, [rax + rax]
add eax, eax
lea edx, [rdi + rdi*2]
sub eax, edi
lea r13d, [rdx + rdx]
mov r14d, edi
lea r12d, [rax*2]
xor eax, eax
sub r14d, r15d
mov qword [rsp + 0x28], rax
add r14d, 6
lea r8, [0x140001b00]
movsxd rbx, r14d
xor edx, edx
xor ecx, ecx
mov r9, rbx
add r12d, r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9, rbx
mov rbp, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
lea esi, [rdi - 0xe]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
mov rdi, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.scorn
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
imul r15d, r14d
sub r13d, r15d
sub r13d, eax
lea eax, [r12 - 0x2d]
sub r13d, ebx
sub r13d, esi
add r13d, dword [rsp + 0x30]
add r13d, edi
add r13d, ebp
add eax, r13d
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006b650
Capabilities:
Copy file
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov esi, dword [rsp + 0x190]
mov rdi, qword [rsp + 0x198]
xor ebp, ebp
mov ebx, r9d
lea r8, [0x140001b00]
xor edx, edx
imul edi, esi
lea eax, [rcx + rdi*4]
mov r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
add edi, eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [rbp + 0x19]
mov edx, 0x1be
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r8d, dword [rsp + 0x1a0]
lea rdx, str.c0a4
lea rcx, str.plant
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, esi
jle 0x14006b76b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [rbp + 1]
mov edx, 0x2a2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
movsxd r9, edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006b7b0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov edi, r8d
mov r14, rdx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r15d, r15d
lea r8, [0x140001b00]
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [r15 + 0x1c]
mov edx, 0x21f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, str.c0a2
lea rcx, [rsp + 0x30]
mov rdx, rax
mov rbx, rax
call fcn.1400dc300
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movsxd rsi, eax
movsx ebp, sil
cmp edi, ebp
jbe 0x14006b88a
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx rbx, sil
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp edi, ebp
jbe 0x14006b903
xor ecx, ecx
mov edx, 0x3ca
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006bed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, r8
mov r12, rdx
mov r15d, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rdi, 0xffffffffffffffff
mov rax, rdi
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x14006bf20
imul eax, r15d
mov dword [rsp + 0x70], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
imul ecx, eax, 7
mov edx, eax
movzx eax, r15b
lea r14d, [rbx + rbx*8]
mov r8, rsi
add r14d, r14d
imul dl
sub r14d, ecx
movzx ecx, al
movzx eax, r12b
mov r9d, r14d
imul cl
movzx ecx, al
shl cl, 3
lea ebp, [rcx + rax]
xor eax, eax
movsxd rcx, r14d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
mov ecx, r14d
mov rdx, rsi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
movzx r13d, bpl
lea r8d, [rcx + 0x10]
mov edx, 0x3df
sub r13b, al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14006bfc0
movzx eax, bl
lea r8, [0x140001b00]
xor edx, edx
imul byte [rsp + 0x70]
movzx ecx, al
movzx eax, bpl
imul r13b
sub al, cl
xor ecx, ecx
sub al, r12b
add al, r14b
add al, r15b
sub al, dil
dec al
movzx r9d, al
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp bpl, 0x40
je 0x14006c03b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x7f
xor ecx, ecx
lea r8d, [rdx - 0x7b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x218]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006c080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov esi, edx
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xffff
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ebp, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
test r14d, r14d
jg 0x14006c0e2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r12d, r12d
mov rbx, rax
cmp edi, esi
jb 0x14006c153
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
lea r8, str.c1a2
lea rdx, str.cleric
movzx ecx, bpl
mov r9d, r15d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
movzx ecx, bpl
movzx eax, bpl
lea r8, [0x1400ed3b8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r12d
lea rdx, str.cleric
mov ecx, edi
mov r9d, r14d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14006c1d0
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r13, qword [rsp + 0x200]
mov r14, qword [rsp + 0x208]
mov rbx, r8
imul ebx, ecx
mov ebp, ebx
mov rdi, r9
movzx r15d, dl
sub ebp, r13d
mov r12, rcx
add ebp, r14d
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp ebx, ebp
ja 0x14006c25b
xor ecx, ecx
mov edx, 0x270
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8, [0x140001b00]
xor edx, edx
mov rsi, rax
movsx r9, al
xor eax, eax
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp sil, bl
jle 0x14006c320
imul r14d, ebx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x14006c295
add eax, r14d
add eax, r12d
add eax, ebp
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x38], rax
lea eax, [r14 + rbx]
add eax, r13d
add eax, ebp
mov dword [rsp + 0x40], eax
lea rax, str.ticket
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x39e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, str.c0ret
lea rdx, [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
call fcn.1400dcda0
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp r15b, sil
jg 0x14006c35f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx ecx, sil
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x49
xor ecx, ecx
lea r8d, [rdx - 0x2d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006cb90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, qword [rbx + 0x28]
or rbx, 0xffffffffffffffff
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14006cbd0
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x14006cbe0
add dil, al
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14006cbf0
movzx eax, dil
movzx esi, dil
mov rdx, rbp
add al, al
mov r9d, esi
mov r8d, esi
xor ecx, ecx
add bl, al
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
cmp bl, dil
jbe 0x14006cc56
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.rambler
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x188]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ce60
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r14d, edx
mov r13d, r9d
mov rsi, r8
mov r12, rdx
mov rax, rcx
mov qword [rsp + 0x48], rcx
imul r14d, ecx
or rbx, 0xffffffffffffffff
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [r8 + rdi], 0
jne 0x14006ceb0
mov r8d, dword [rsp + 0x240]
mov r15, qword [rsp + 0x230]
mov ecx, r13d
imul ecx, r15d
add ecx, edx
imul edi, r8d
add ecx, eax
add edi, r14d
add ecx, dword [rsp + 0x238]
add ecx, r8d
mov dword [rsp + 0x30], ecx
mov ecx, edx
mov edx, 0x104
imul ecx, r13d
imul ecx, eax
imul ecx, dword [rsp + 0x238]
sub ecx, r8d
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x60], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ebp, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x20]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
cmp ebp, edi
jg 0x14006cfbf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0xa9
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov r9d, dword [rsp + 0x238]
mov r11d, eax
mov dword [rsp + 0x34], eax
cmp r9d, r13d
je 0x14006cff7
xor ecx, ecx
mov edx, 0x2e4
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, dword [rsp + 0x238]
mov r11d, dword [rsp + 0x34]
mov r10d, dword [rsp + 0x240]
mov ecx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
imul ecx, r8d
mov edx, r13d
imul edx, edi
imul edx, r10d
lea eax, [rdx + rcx*8]
sub eax, dword [rsp + 0x40]
add eax, r14d
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14006d020
shl ebp, 5
imul r15d, edi
mov ecx, 8
add ebp, eax
sub cl, al
imul r15d, r9d
shl ebp, 2
movsx rax, cl
imul r15d, r10d
sub ebp, r15d
add ebp, 0xfffffffe
lea ecx, [rax + rbp*2]
mov rax, qword [rsp + 0x50]
imul eax, dword [rsp + 0x38]
add eax, ecx
sub eax, r12d
add eax, r13d
add eax, ebx
add eax, r11d
add eax, r8d
add eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006d0a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov edi, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rax + rax*4]
mov esi, 4
lea ebx, [rdi*2 - 4]
add r8d, r8d
mov r14, rax
mov edx, r8d
imul edx, edi
sub esi, edx
mov edx, 0x148
sub ebx, esi
add ebx, r8d
lea r8d, [rcx + 1]
mov dword [rsp + 0x38], ebx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ecx, bl
movzx edx, bl
shl cl, 2
movzx ebp, dil
mov r13, rax
add dl, cl
xor ecx, ecx
add dl, dl
lea r8d, [rcx + 0x1d]
sub bpl, dl
mov edx, 0x1e3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3e5
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov eax, edi
add ebx, 0x22
sub eax, esi
lea r8, [0x140001b00]
mov r9d, edi
add eax, r12d
xor edx, edx
add ebx, eax
movzx eax, bpl
imul bl
movzx ecx, al
mov al, 0x1c
imul cl
xor ecx, ecx
mov byte [rsp + 0x30], al
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x144
mov qword [rsp + 0x48], rax
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1a]
mov edx, 0x157
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x40], rax
cmp edi, esi
jg 0x14006d1d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx eax, byte [rsp + 0x38]
add r13b, 0x12
imul sil
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
mov al, 7
imul bpl
sub al, cl
sub al, byte [rsp + 0x40]
sub al, byte [rsp + 0x50]
sub al, byte [rsp + 0x48]
sub al, r14b
sub al, byte [rsp + 0x30]
add al, bl
add al, r13b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14006dc30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r12, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov r15, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, r15d
sub ebp, eax
lea rcx, [rsp + 0x30]
mov ebx, 0xffffffdb
sub ebp, 0x3c
xor edx, edx
mov r8d, 0x140
sub ebx, ebp
mov r14, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c1a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
lea edi, [rbx*8 + 0x1ff]
lea r8d, [rcx + 0x11]
mov edx, 0x13a
mov rsi, rax
add edi, ebx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.c2a0
imul r9d, ebx, 7
mov qword [r12 + 8], rax
lea eax, [rdi + rdi*4]
mov r8d, r14d
shl r8d, 4
mov edx, r15d
mov qword [r12 + 0x18], r14
sub edx, edi
lea ecx, [r8 + rbp]
mov qword [r12 + 0x20], r15
lea ecx, [rcx + rbp*4]
mov qword [r12 + 0x28], r15
lea ecx, [rcx + 0x114c]
lea ecx, [rcx + rdx*4]
add ecx, r9d
add ecx, esi
sub esi, eax
lea eax, [rbp - 0x2b3]
sub esi, r8d
mov dword [r12], ecx
sub esi, r9d
add esi, r15d
add eax, esi
mov dword [r12 + 0x10], eax
mov rax, r12
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret