joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b6a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movsxd rbx, ecx
lea rcx, str.latency
mov edi, r8d
call fcn.1400a2bf0
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea r8, [0x140001b00]
movzx esi, ax
xor eax, eax
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, edi
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, str.c0a0
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
lea rcx, str.c0ret
movaps xmmword [rsp + 0x50], xmm0
movsd xmm1, qword [rsp + 0x40]
movsd qword [rsp + 0x60], xmm1
movzx edx, sil
call fcn.140099d20
xor ecx, ecx
mov edx, 0x1cc
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.continent
mov rdx, rax
call fcn.1400cf030
lea rax, str.harpooner
lea rbx, str.c1ret
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, rax
call fcn.140081bd0
lea rax, str.c3a0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005d160
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov eax, dword [rsp + 0x248]
or rsi, 0xffffffffffffffff
mov rbp, r9
mov r9, qword [rsp + 0x240]
mov dword [rsp + 0x64], eax
movzx r12d, r8b
mov rax, rsi
mov byte [rsp + 0x60], r8b
mov r13, rdx
mov r15d, ecx
inc rax
cmp byte [r9 + rax], 0
jne 0x14005d1b2
lea r14d, [rcx + rdx]
mov rdi, rsi
sub r14d, eax
inc rdi
cmp byte [rdi + rbp], 0
jne 0x14005d1c6
lea rcx, [rsp + 0x80]
mov edx, 0x104
imul edi, r15d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rdx, str.baobab
lea rcx, str.jute
mov r9d, edi
mov r8d, r14d
mov rbx, rax
mov qword [rsp + 0x30], rax
call fcn.14007dc80
mov ecx, dword [rsp + 0x64]
imul edi, r14d
movzx r10d, r12b
mov qword [rsp + 0x70], rax
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov r12d, r10d
lea r8, str.baobab
lea rdx, [0x1400ed3b4]
sub r12d, edi
lea edi, [r15 - 6]
mov r9d, r15d
sub r12d, eax
lea eax, [rcx + rcx]
mov dword [rsp + 0x68], r10d
sub eax, ebx
add r12d, r13d
lea eax, [rax*2]
add r12d, ecx
add eax, r13d
add r12d, r15d
add edi, eax
movzx eax, byte [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov ecx, r10d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
cmp edi, r12d
jae 0x14005d2b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, str.motel
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
nop dword [rax]
inc rsi
cmp byte [rsi + rbp], 0
jne 0x14005d2f0
mov rbp, qword [rsp + 0x70]
shl esi, 2
lea ebx, [r12 + 5]
sub esi, dword [rsp + 0x68]
lea rdx, str.jute
lea rcx, [0x1400ed3f4]
add esi, r13d
mov r8d, edi
add esi, r15d
add esi, ebp
add ebx, esi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, str.objective
lea rcx, str.vietnam
mov edx, ebx
mov r9d, eax
call fcn.140077850
mov edi, 2
sub dil, r14b
shl dil, 2
imul bl
movzx ecx, al
shl cl, 3
add al, cl
sub dil, al
mov eax, dword [rsp + 0x64]
sub dil, r12b
sub dil, al
sub dil, bpl
add dil, r15b
movzx ecx, dil
call fcn.14009f830
cmp dil, byte [rsp + 0x60]
jg 0x14005d39e
mov r9d, 1
lea r8, str.c0a1
lea rcx, str.c0a1
lea edx, [r9 + 7]
call fcn.140077850
call fcn.1400a8080
lea rax, str.cope
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005d920
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov r12d, r8d
mov r13, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rdi, 0xffffffffffffffff
mov r15, rax
mov rbp, rdi
inc rbp
cmp byte [rbx + rbp], 0
jne 0x14005d955
imul ebp, r13d
mov rax, rdi
inc rax
cmp byte [rsi + rax], 0
jne 0x14005d965
mov r9d, dword [rsp + 0xa0]
add ebp, eax
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rdi
mov qword [rsp + 0x30], rax
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14005d9a0
movzx eax, r12b
mov r8d, ebp
mov rdx, r15
imul cl
movzx ebx, al
lea rax, str.jiffy
mov qword [rsp + 0x28], rax
lea rcx, str.master
mov byte [rsp + 0x20], bl
call fcn.1400bb990
mov r14, rax
cmp r12d, ebx
je 0x14005daf7
call fcn.1400af010
mov edx, 0x95
xor ecx, ecx
lea r8d, [rdx - 0x80]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, r15
mov rdx, rax
mov r12, rax
call fcn.14005fbc0
mov rcx, rdi
movzx r8d, al
mov byte [rsp + 0x88], al
cmp byte [rbx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14005da15
mov eax, 1
lea edx, [rcx + rcx*4]
sub eax, r13d
imul eax, r15d
add edx, eax
mov rax, rdi
sub edx, r12d
inc rax
cmp byte [rsi + rax], 0
jne 0x14005da37
add edx, ebp
movzx ebx, r8b
add edx, eax
add ebx, edx
mov rdx, rdi
nop dword [rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x14005da50
movzx eax, byte [rsp + 0x30]
movzx r8d, r13b
imul bpl
movzx ecx, al
movzx eax, r15b
imul cl
mov cl, 1
sub r8b, al
add r8b, dl
mov edx, ebx
call fcn.14006d320
mov rcx, rdi
mov r8, rax
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14005da83
movzx eax, r13b
imul cl
movzx edx, al
movzx eax, byte [rsp + 0x90]
imul byte [rsp + 0xa0]
movzx ecx, al
mov al, 0xf9
imul r15b
sub al, cl
sub al, 5
add dl, al
add dl, bl
add dl, bpl
add dl, r8b
add dl, byte [rsp + 0x88]
cmp byte [r14 + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x14005dac1
lea ecx, [rdi + rdx]
call fcn.1400b4600
lea r8, [0x1400ed4d4]
lea rdx, str.spite
lea rcx, str.c0a0
mov r9b, 1
call fcn.1400d2e10
call fcn.14008c5e0
mov rax, r15
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005e7b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x210], rax
movsxd rsi, ecx
xor ebp, ebp
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov r9, rsi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x40]
movsd xmm1, qword [rsp + 0x50]
mov dword [rsp + 0x30], eax
lea rax, str.caterpillar
lea rcx, [rsp + 0x80]
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
mov r8, rdi
movzx edx, sil
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1400a6ef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.soap
movzx ecx, al
call fcn.140097440
lea rcx, str.c0a3
call fcn.1400d50b0
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xd0]
lea rcx, str.c0a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005ed30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, r14d
sub ebp, eax
add ebp, 0x24
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x35f
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
xor edx, edx
mov rbx, rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea edi, [rax + rbx*2]
lea r8d, [rcx + 0xe]
mov edx, 0x101
add edi, edi
sub edi, esi
add edi, ebp
add edi, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp edi, 0x40
jb 0x14005edf1
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rax, r14
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14005f200
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r14d, dword [rsp + 0x2f0]
movsxd rbp, dword [rsp + 0x300]
mov qword [rsp + 0x30], r9
mov r15, r8
mov r12, rdx
mov r13, rcx
cmp ebp, r14d
jge 0x14005f26d
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdi, qword [rsp + 0x2f8]
mov esi, r14d
imul esi, r15d
imul esi, r12d
sub esi, dword [rdi + 0x28]
cmp ebp, esi
jg 0x14005f345
lea rcx, str.eight
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.eight
mov r9, rbp
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.c2a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x399
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x160
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [rsi + rsi*4]
mov ebx, r12d
sub ebx, eax
sub ebx, ebp
sub ebx, r15d
cmp r14d, ebp
jbe 0x14005f389
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x3d1
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x48
xor ecx, ecx
lea r8d, [rdx - 0x42]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
imul r14d, dword [rsp + 0x30]
imul ecx, ebp
mov qword [r13], rax
mov eax, dword [rdi + 8]
mov edx, 0x2f
sub eax, ecx
add r15d, 0x19
lea r8d, [rdx - 0x16]
sub eax, r14d
xor ecx, ecx
mov qword [r13 + 0x10], r12
sub eax, ebx
sub eax, esi
add eax, r15d
mov dword [r13 + 8], eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [r13 + 0x18], rax
lea rax, str.vixen
mov qword [r13 + 0x20], rax
lea rax, str.psychoanalyst
mov qword [r13 + 0x28], rax
lea rax, str.c2a2
mov qword [r13 + 0x30], rax
mov rax, r13
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005f6d0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rsi, rcx
mov bl, 0x3a
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x13c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r13d, r13d
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov r14d, esi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [rsi + 1]
imul ecx, esi
lea ebp, [rax*4]
movsx r15, bl
movsx r12d, bl
add r15d, 5
xor r8d, r8d
add r15d, ecx
sub ebp, r12d
mov edx, 0x381
xor ecx, ecx
add ebp, esi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, 0x40
jne 0x14005f823
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x90], rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea r8d, [r13 + 0xb]
mov edx, 0x178
xor ecx, ecx
movzx edi, ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r13 + 2]
mov edx, 0x158
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], r15d
sub ebx, eax
lea r8, [0x1400ed4d4]
lea rdx, str.hovercraft
add ebx, 0x4a
mov r9d, r12d
mov ecx, edi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
lea r8, str.c0a3
lea rdx, str.c0a3
mov r9d, ebp
mov ecx, r15d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14005fbc0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, rcx
mov rcx, rdx
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov rbp, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.genetics
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x30], rax
cmp bl, 7
je 0x14005fc68
xor r8d, r8d
mov edx, 0x12b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r14d
mov r13d, ebx
mov r15d, ebx
mov edx, 0x1c1
imul ecx, edi
shl ecx, 3
imul r15d, esi
sub r13d, ecx
xor ecx, ecx
add r15d, 0xfffffff8
lea r8d, [rcx + 0x14]
add r13d, 7
add r15d, edi
add r13d, ebp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
lea r8d, [rcx + 0xd]
mov edx, 0x98
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movzx r9d, bl
mov qword [rsp + 0x38], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x40], rax
cmp r13d, esi
jne 0x14005fce9
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp r15d, 7
je 0x14005fd0f
movzx eax, dil
imul bpl
sub al, 0xe
add al, sil
add al, bl
add al, r12b
movzx ecx, al
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x8a
xor ecx, ecx
lea r8d, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r10, qword [rsp + 0x30]
lea ecx, [rdi + 1]
mov r9, rax
movzx eax, bl
imul cl
movzx edx, al
movzx eax, dil
sub dl, r15b
imul r12b
movzx ecx, al
add dl, 7
add dl, r13b
shl cl, 3
movzx eax, bl
add dl, r14b
inc cl
add dl, r12b
imul cl
movzx r8d, al
mov al, 7
imul r13b
add r8b, al
movzx eax, r12b
sub r8b, dl
sub r8b, byte [rsp + 0x40]
sub r8b, r10b
add r8b, 0x20
add r8b, r9b
add r8b, bpl
sub bpl, 0x5f
movzx ecx, r8b
add cl, cl
add r8b, cl
shl r8b, 2
dec r8b
imul r8b
movzx edx, al
movzx eax, r14b
imul sil
movzx ecx, al
movzx eax, bl
imul cl
add dl, al
mov al, 7
imul r10b
sub dl, al
sub dl, r15b
sub dl, dil
lea eax, [rdx + r13]
add al, r9b
add al, byte [rsp + 0x38]
add al, bpl
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140060080
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, 0x3c6
mov r8d, 0x1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret

Function at 0x140060160
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r15, rcx
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
imul esi, eax, 0x5f
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x60]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0x20
mov rbx, rax
lea rax, str.c4a0
mov qword [r15], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 - 1]
imul esi, ebx
imul edx, r14d
imul esi, edi
mov qword [r15 + 8], rax
sub edx, esi
mov ecx, 0x20
mov qword [r15 + 0x18], r14
imul eax, ebp, 0x5f
add eax, 6
add edx, eax
mov dword [r15 + 0x10], edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r15 + 0x20], rax
lea rax, str.tooth
mov qword [r15 + 0x28], rax
mov rax, r15
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140061a90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r14d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
movzx eax, r14b
imul r12b
lea ebx, [rax + 0xb]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx rsi, bl
mov ebp, esi
movsx r13d, bl
neg ebp
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x254
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x156
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ecx, ecx
mov edx, 0x38c
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x362
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x62
lea r8d, [rdx - 0x54]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
movsx r9d, r14b
lea edx, [r13 + 0x19]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov eax, r9d
lea r8, str.frazzle
mov ecx, r13d
imul eax, r12d
sub edi, eax
sub edi, esi
add edi, ebx
add edi, ebp
add edx, edi
movsxd rax, edx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r9d
lea rdx, [0x1400ed4fc]
mov dword [rsp + 0x28], 0x17
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0xd5
xor ecx, ecx
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, r12
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret