joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006dd80
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x12f
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x14006ddf5
imul ecx, edi
mov edx, 0x186
lea ebx, [rcx*8 - 0x46]
add ebx, ecx
xor ecx, ecx
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x144
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x137
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.peony
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edi, edi
lea r8, [0x140001b00]
lea r9d, [rdi + 8]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rdi + 0x1b]
mov edx, 0xf4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.economics
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9d, [rdi + 8]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
Function at 0x14006e200
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rdi, r9
mov r13, r8
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rbx, 0xffffffffffffffff
mov r12, rax
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14006e242
mov r14d, dword [rsp + 0x260]
mov r15d, dword [rsp + 0x268]
mov rax, rbx
lea ebp, [r14 + r15]
sub ebp, edx
inc rax
cmp byte [rsi + rax], 0
jne 0x14006e264
add ebp, eax
lea rax, str.tooth
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], rax
lea rax, str.vineyard
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rbx
mov dword [rsp + 0x58], eax
nop dword [rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14006e2a0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14006e2b0
imul edx, ebx
mov eax, r12d
lea rcx, [rsp + 0xb0]
imul edx, dword [r13]
imul eax, ebp
mov r8d, 0x140
mov qword [rsp + 0x60], r12
imul edx, r14d
imul edx, r15d
sub edx, eax
lea rax, [0x1400ed4d4]
add edx, 6
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x5c], edx
xor edx, edx
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.c0a2
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x80]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm1
movups xmm0, xmmword [rsp + 0x60]
lea r8, str.mallet
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
movaps xmmword [rsp + 0xa0], xmm0
call fcn.1400dc730
lea rax, str.jiffy
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x248]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ea70
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, qword [rsp + 0x200]
mov rsi, rcx
mov ebp, edx
lea rcx, [rsp + 0x90]
mov edx, 0x104
mov r14, r9
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movzx ebx, byte [rsp + 0x208]
xor r15d, r15d
cmp bl, 1
jne 0x14006eb16
lea r8d, [r15 + 0x11]
mov edx, 0x289
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
movzx r9d, al
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
or r8, 0xffffffffffffffff
mov rcx, r8
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], r15b
jne 0x14006eb20
movsx rax, bl
mov edx, 0xfffffffe
sub edx, eax
add ecx, edx
inc r8
cmp byte [rsi + r8], r15b
jne 0x14006eb36
movsx edx, bl
mov eax, ebp
mov r9d, ecx
lea rcx, [rsp + 0x60]
imul edx, edi
sub eax, edx
lea edx, [rax + 1]
lea rax, str.link
add edx, r8d
mov r8b, 4
mov qword [rsp + 0x20], rax
call fcn.1400daa90
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
add ebx, ebx
lea eax, [rdi + rdi*2]
sub ebx, eax
cmp bpl, 4
jl 0x14006ebeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], ebx
mov r9d, 1
mov dword [rsp + 0x30], ebx
mov r8, r14
mov rdx, rsi
mov ecx, r9d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x1a4
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006f5b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x1f0]
lea rcx, str.jute
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x330]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, str.jute
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.aftershave
mov edx, 0xb0
mov qword [rsp + 0x40], rax
lea rax, str.c1a2
mov r8d, 3
xor ecx, ecx
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [rsp + 0x58], 0xffffffef
mov dword [rsp + 0x5c], 8
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov qword [rsp + 0x60], rax
lea rax, str.planter
mov r9d, 0xffffffeb
mov qword [rsp + 0x68], rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9, [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, str.whole
lea r8, str.c0ret
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm1
movups xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.c0ret
lea rcx, [rsp + 0x40]
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x20], rbx
call fcn.1400dc730
lea rax, str.pine
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x450
pop rbx
ret
Function at 0x14006f850
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbp, rcx
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea r8, [0x140001b00]
lea r9d, [r15 + 9]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov r14, rax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea edi, [rbp + 3]
xor ecx, ecx
shl al, 2
sub bpl, al
sub bpl, 0x49
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9d, [r15 + 9]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov rbx, rax
movzx edi, dil
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 9
movsx rdx, bpl
movsx ecx, bpl
lea r8, str.c0a0
sub edx, ebx
mov r9d, ecx
sub edx, esi
add edx, edi
sub edx, eax
add edx, 4
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], 9
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edx
lea rdx, str.economics
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.turret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rax, r14
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14006fac0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movzx eax, byte [rsp + 0x210]
mov rbx, qword [rsp + 0x218]
movsxd r13, dword [rsp + 0x220]
mov rbp, rcx
xor ecx, ecx
mov r15, r8
mov r12, rdx
lea r8d, [rcx + 0xf]
mov edx, 0x301
mov qword [rsp + 0x70], r9
mov byte [rsp + 0x60], al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
add esi, 2
or rdi, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x14006fb40
mov rax, qword [rsp + 0x68]
movzx r14d, sil
sub r14b, r13b
sub r14b, byte [rsp + 0x70]
add r14b, al
mov rax, rdi
sub r14b, cl
inc rax
cmp byte [rbx + rax], 0
jne 0x14006fb64
sub r14b, al
mov rax, rdi
sub r14b, 2
inc rax
cmp byte [rax + rbp], 0
jne 0x14006fb77
lea rcx, [rsp + 0x80]
mov edx, 0x104
add r14b, al
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x30a
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp byte [rsp + 0x60], sil
jbe 0x14006fcea
mov rsi, rdi
nop dword [rax + rax]
inc rsi
cmp byte [r12 + rsi], 0
jne 0x14006fbf0
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x14006fc00
imul esi, eax
mov rcx, rdi
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14006fc10
mov rax, qword [rsp + 0x68]
xor edx, edx
lea ebx, [rax + 2]
imul ecx, eax
lea eax, [rbx + rbx*4]
sub ecx, eax
add esi, ecx
xor ecx, ecx
sub esi, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r10d, byte [rsp + 0x60]
mov rcx, rax
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp byte [r12 + rdx], 0
jne 0x14006fc50
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x14006fc60
imul edx, eax
imul ecx, esi
mov eax, r10d
imul eax, dword [rsp + 0x70]
imul eax, r13d
add edx, eax
mov rax, qword [rsp + 0x68]
add edx, ecx
mov rcx, qword [rsp + 0x78]
add ecx, 2
lea eax, [rax + rcx*4]
add ecx, eax
movsx rax, r14b
add ecx, edx
add eax, ecx
nop dword [rax]
inc rdi
cmp byte [r15 + rdi], 0
jne 0x14006fca0
xor ecx, ecx
sub eax, edi
lea r8, str.garter
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], ebx
mov r9d, esi
mov rdx, r12
mov ecx, r10d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140070670
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x20b
mov r8d, 0x16
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c0a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, 0x37c
mov r8d, 0x13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.mary
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x170
pop rbx
ret
Function at 0x140070ac0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx ebx, byte [rsp + 0x1f0]
mov rdi, r9
mov qword [rsp + 0x58], r9
mov rsi, r8
mov qword [rsp + 0x68], r8
mov rbp, rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, ebp
mov dword [rsp + 0x38], ebx
imul ebx, ebp
mov ecx, eax
mov r8, rax
mov qword [rsp + 0x60], rax
sub edx, esi
movzx eax, bpl
mov dword [rsp + 0x3c], edx
imul sil
sub al, 0x40
imul ecx, edx
add al, byte [rdi + 0x20]
lea r13d, [rcx + rcx*4]
xor ecx, ecx
movsx eax, al
shl r13d, 6
imul eax, eax, 7
mov dword [rsp + 0x34], eax
imul eax, r8d
lea r8d, [r14 + 0x18]
imul eax, edx
sub ebx, eax
mov edx, 0x275
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov r12, rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov r15, rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea ecx, [rbx + rbx*2]
add ecx, ecx
mov rdi, rax
sub ecx, r12d
add ecx, ebp
lea ebp, [rax - 0x140]
add ebp, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov r14, rax
mov edx, 0x3b3
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.view
mov rbx, rax
mov rax, qword [rsp + 0x40]
mov qword [rax], rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r8, qword [rsp + 0x40]
imul r12d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x34]
mov qword [r8 + 8], rax
movzx eax, sil
imul bpl
lea ecx, [rdi + rdi*2]
imul edx, r13d
imul edx, dword [rsp + 0x3c]
shl edx, 4
add edx, ecx
movsx rcx, al
mov rax, qword [rsp + 0x48]
sub edx, ebx
imul eax, dword [rsp + 0x1f8]
lea edx, [rcx + rdx*4]
sub edx, eax
lea eax, [rbp + 1]
imul eax, esi
add edx, eax
mov rax, qword [rsp + 0x58]
sub edx, r12d
sub edx, dword [rax + 0x20]
mov rax, qword [rsp + 0x60]
sub edx, r15d
dec eax
sub edx, dword [rsp + 0x68]
add edx, dword [rsp + 0x38]
add edx, dword [rsp + 0x50]
add edx, r14d
add eax, edx
mov dword [r8 + 0x10], eax
mov rax, r8
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140070cf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
or rax, 0xffffffffffffffff
movzx r15d, r8b
mov r13d, edx
mov rbx, rax
mov r12, rcx
nop word [rax + rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140070d20
mov rsi, qword [rsp + 0xc0]
inc rax
cmp byte [rsi + rax], 0
jne 0x140070d32
mov ebp, dword [rsp + 0xc8]
imul ebx, eax
imul ebx, ebp
sub ebx, r15d
add ebx, ecx
cmp ebp, r15d
je 0x140070d58
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx eax, r12b
xor ecx, ecx
lea r8d, [rcx + 7]
mov edx, 0x303
imul r13b
lea r14d, [rax + rbp]
add r14b, bl
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp r13d, dword [rsp + 0xd0]
jb 0x140070e11
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8, qword [rsp + 0xa0]
movzx ecx, r14b
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
xor r9d, r9d
mov rcx, r8
mov rdx, r12
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
movzx r9d, byte [rsp + 0xb0]
xor edi, edi
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rdi + 0x17]
mov edx, 0x11c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
jmp 0x140070e13
xor edi, edi
xor ecx, ecx
mov edx, 0x2ab
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rbp
movzx ecx, r14b
mov dword [rsp + 0x38], ebp
lea r8, str.birthday
mov dword [rsp + 0x30], ecx
mov r9d, ebp
mov rdx, rsi
mov ecx, ebx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x21e
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x27d
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x252
lea r8d, [rcx + 0x10]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_FindResourceA]
Function at 0x140070ed0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea edi, [rax*4]
cmp edi, 0xf
je 0x140070f1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ride
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
mov ebx, eax
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.councilman
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movsxd rdi, edi
lea rdx, str.songbird
mov r9, rdi
mov r8d, 0x10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.c4ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.c1a3
mov r9d, 0xf
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x26b
lea r8d, [rcx + 0x12]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.azimuth
movzx ebx, bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.ride
mov r9d, ebx
mov rcx, rax
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rdx, str.c4ret
mov r9d, 4
mov r8, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
mov ebx, eax
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c1a3
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.azimuth
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
lea r8, [0x140001b00]
movzx r9d, bl
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.bafflement
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret