joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d1c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, rcx
mov ecx, 0xffff
movsxd r13, r8d
mov qword [rsp + 0x50], rdx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r12d, ax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
imul ecx, r15d, 7
mov r14d, edi
mov qword [rsp + 0x30], rax
imul r14d, r12d
add r14d, ecx
sub r14d, eax
xor eax, eax
add r14d, 4
cmp r12d, r15d
jg 0x14009d25e
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
mov rbx, rsi
inc rbx
cmp byte [rbx + rbp], 0
jne 0x14009d270
lea edi, [rdi + 1]
lea r8, [0x140001b00]
xor edx, edx
lea eax, [rdi*2]
xor ecx, ecx
add eax, r13d
add ebx, eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov r9d, ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rsi
mov qword [rsp + 0x48], rax
inc rdi
cmp byte [rdi + rbp], 0
jne 0x14009d2c5
movzx eax, r15b
imul r12b
movzx ecx, al
mov al, 7
imul cl
sub al, 4
add dil, al
movzx ecx, dil
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
inc rsi
cmp byte [rsi + rbp], 0
jne 0x14009d2f4
mov rax, qword [rsp + 0x50]
shl cl, 4
movzx eax, byte [rax + 8]
imul sil
movzx r8d, al
movzx eax, byte [rsp + 0x40]
imul bl
lea edx, [rcx + rax]
movzx eax, r15b
shl dl, 2
imul r13b
movzx ecx, al
mov al, 7
imul cl
movzx ecx, al
movzx eax, byte [rsp + 0x30]
sub cl, dl
imul r14b
sub cl, al
movzx eax, byte [rsp + 0x38]
imul r12b
sub cl, al
lea eax, [rcx + r8]
movzx ecx, dil
shl cl, 2
add dil, cl
add al, dil
sub al, byte [rsp + 0x48]
add al, 0x13
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009d390
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r15d, ecx
mov ecx, 0xffff
mov byte [rsp + 0x20], r9b
mov rdi, r8
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x38], rdx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x3d7
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x178
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0x35f
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x30], rax
imul sil
movzx ebp, al
sub bpl, r12b
add bpl, r14b
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, qword [rdi + 8]
mov r13, rax
movzx eax, byte [rdi + 0x10]
sub al, bl
add al, r15b
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov byte [rsp + 0x21], al
inc rcx
cmp byte [rdx + rcx], 0
jne 0x14009d484
lea edi, [r14 + r14*4]
movzx ebp, bpl
lea rdx, str.spite
sub edi, r13d
mov r8d, ebp
add edi, r15d
add edi, r12d
sub edi, ecx
lea rcx, str.spite
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
mov r8, rax
nop dword [rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14009d4d0
movsx eax, byte [rsp + 0x21]
imul esi, r14d
imul esi, r12d
imul eax, edi
lea ecx, [rsi + rsi*2]
lea edx, [rax + rcx*4]
movzx eax, byte [rsp + 0x24]
sub edx, eax
movzx eax, byte [rsp + 0x20]
sub edx, eax
sub edx, dword [rsp + 0x38]
sub edx, r8d
sub edx, r13d
lea eax, [rdx + rbp]
add eax, r15d
add eax, dword [rsp + 0x30]
sub eax, ebx
add eax, 0xe
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009d7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 8
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [rdi*8]
imul ebx, edi
sub ecx, esi
mov ebp, 4
sub ebp, ebx
lea ebx, [rax + 6]
add ebx, ecx
sub ebp, eax
xor ecx, ecx
sub ebp, esi
call qword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, 8
je 0x14009d8a5
xor ecx, ecx
mov edx, eax
lea r8, str.c1a1
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
lea r9d, [rcx + 8]
lea rdx, str.patio
mov ecx, ebp
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
lea rax, str.mother
add rsp, 0x60
pop rdi
ret
Function at 0x14009e720
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x20], edx
movzx r14d, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx eax, ax
lea rdx, str.c0a0
lea rcx, str.lemonade
mov r8d, r14d
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movzx r12d, al
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x70]
movzx eax, ax
mov edx, 0x104
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea r8d, [rcx + 5]
mov edx, 0x9c
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
movsx r15, r14b
mov ebp, r14d
lea r8d, [rcx + 0x13]
mov edx, 0x129
sub ebp, r15d
mov qword [rsp + 0x68], rax
sub ebp, esi
add ebp, 6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x20]
shl ecx, 4
lea r13d, [r14 + 2]
mov rsi, rax
sub ecx, r12d
xor edx, edx
mov r8d, 0x140
imul eax, ebp
add ecx, r13d
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x24], ecx
imul r13d, ecx, 7
add r13d, eax
lea rcx, [rsp + 0x70]
add r13d, dword [rsp + 0x28]
add r13d, edi
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.turkish
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
imul ecx, eax, 7
mov eax, 4
sub eax, ecx
mov dword [rsp + 0x34], eax
lea eax, [rdi + rdi*2]
imul ecx, ebx, 7
mov dword [rsp + 0x30], ecx
add eax, eax
sub ecx, eax
mov dword [rsp + 0x28], eax
sub ecx, esi
mov esi, dword [rsp + 0x20]
sub ecx, dword [rsp + 0x24]
lea eax, [rsi - 0x86]
add ecx, r14d
add ecx, dword [rsp + 0x48]
add ecx, ebp
add eax, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, dword [rsp + 0x38]
mov qword [rsp + 0x58], rax
cmp r14b, bpl
jge 0x14009e8c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r8d, r8d
mov edx, 0x28c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
imul r15d, dword [rsp + 0x48]
imul eax, dword [rsp + 0x40], 7
imul r12d, ebp
imul r15d, esi
add r15d, r15d
sub r15d, r12d
shl r15d, 3
sub r15d, eax
lea eax, [rdi - 0xc]
sub r15d, dword [rsp + 0x3c]
sub r15d, dword [rsp + 0x58]
sub r15d, dword [rsp + 0x20]
sub r15d, dword [rsp + 0x34]
sub r15d, dword [rsp + 0x50]
sub r15d, dword [rsp + 0x68]
sub r15d, r13d
sub r15d, dword [rsp + 0x24]
add r15d, dword [rsp + 0x30]
add r15d, dword [rsp + 0x28]
add r15d, r14d
add eax, r15d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009e960
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx edi, byte [rsp + 0x170]
mov rbx, r9
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
cmp dil, al
jae 0x14009e9d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, dil
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rax, str.brush
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x14009ed30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, qword [rsp + 0x1d8]
mov r14, qword [rsp + 0x1e0]
mov rbp, r9
mov r15d, edx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
or r8, 0xffffffffffffffff
mov rax, r8
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14009ed80
imul eax, dword [r14 + 0x28]
mov edx, dword [rsp + 0x1d0]
mov edi, ebp
imul edi, edx
lea ecx, [rsi + rax]
add edi, ecx
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x14009eda0
movzx eax, bpl
xor ecx, ecx
imul dl
movzx edx, byte [r14]
sub dl, al
xor eax, eax
add dl, r15b
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
add dl, sil
sub dl, r8b
lea r8, [0x140001b00]
movzx r9d, dl
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x60
lea r8d, [rdx - 0x5c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.chess
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x1b7
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009f6a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
or rbx, 0xffffffffffffffff
mov rdi, rdx
mov rsi, rcx
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x14009f6d2
mov ebp, ecx
sub ebp, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r14, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0xb
lea r8d, [rdx + 1]
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x2f3
lea r8d, [rcx + 0x1b]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14009f745
imul ebx, r15d
sub esi, ebx
sub esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], 4
lea r9d, [rax + 4]
mov r8, rdi
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c1a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [0x1400ee168]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, r14
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009f830
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movsx r14d, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
mov rdi, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, edi
mov rdx, rax
movzx eax, bl
xor ebx, ebx
imul esi, r15d
mov ebp, eax
mov dword [rsp + 0x60], eax
imul ebp, edx
mov ecx, ebp
imul ecx, r14d
sub esi, ecx
sub esi, r13d
add esi, r12d
cmp esi, r15d
ja 0x14009f995
mov eax, r13d
mov edi, r14d
imul eax, r15d
imul edi, r12d
add edi, eax
imul eax, edx, 7
add edi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x19]
mov edx, 0x147
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0xc]
mov edx, 0x2c0
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, bl
movzx eax, bl
xor ebx, ebx
lea edx, [rdi + 1]
lea r8, str.fahrenheit
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
lea rdx, str.c1ret
mov r9d, edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdi, qword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
lea ecx, [r14 + rax]
add ecx, 0xfffffff9
add ecx, edi
mov dword [rsp + 0x70], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9d, r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ecx, byte [rsp + 0x70]
imul ebp, esi
mov r8, rax
imul ebp, r14d
sub cl, bl
imul ebp, r13d
movsx rdx, cl
imul eax, dword [rsp + 0x90], 0xfffffff9
sub eax, edx
sub eax, ebp
sub eax, ebx
sub eax, edi
sub eax, r12d
sub eax, r15d
add eax, r14d
add eax, r8d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009fd80
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
movsxd rdi, edx
mov rbx, r9
mov r15, r8
mov esi, ecx
cmp edi, ecx
jge 0x14009fdc4
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r12d, edi
lea rcx, [rsp + 0x40]
imul r12d, esi
mov ebp, r12d
mov edx, 0x104
sub ebp, r15d
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.mocha
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rcx, 0xffffffffffffffff
mov r15, rax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14009fe22
mov ebx, r14d
mov edx, 0x29e
imul ebx, ebp
sub ebx, edi
add ebx, 5
add ebx, esi
add ebx, ecx
xor ecx, ecx
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp ebp, r12d
ja 0x14009fe99
xor eax, eax
lea r8, [0x140001b00]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov r8, r15
mov rdx, r15
mov rcx, r14
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0xfc
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a0640
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 2]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x1f8
mov r8d, 7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x12c
mov r8d, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0xd9
mov r8d, 0xe
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.bookend
mov r8, rbx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov r9, rax
xor edx, edx
call fcn.1400dceb0
lea rax, str.c1a0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1a0
pop rbx
ret

Function at 0x1400a0720
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
lea esi, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx ebp, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
add dil, bl
xor ebx, ebx
cmp dil, sil
je 0x1400a07a8
lea r8d, [rbx + 6]
mov edx, 0x2bf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.songbird
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
movsxd r9, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
lea rax, str.mirror
add rsp, 0x30
pop rdi
ret