joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r9
mov rbx, r8
mov edi, edx
mov ebp, ecx
cmp ecx, edx
je 0x1400710c4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rax, 0xffffffffffffffff
mov r9, rax
nop dword [rax + rax]
inc r9
cmp byte [rbx + r9], 0
jne 0x1400710d0
movzx ecx, bpl
sub cl, dil
sub cl, sil
mov rsi, qword [rsp + 0x50]
sub cl, r9b
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400710f0
add cl, al
movsx r14d, cl
cmp edi, ebp
jb 0x14007117b
xor ecx, ecx
mov edx, 0x3e4
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x1fb
add edi, eax
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0x17c
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx r9, dil
mov r8d, r14d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, str.sherry
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, 0x6a
xor ecx, ecx
lea r8d, [rdx - 0x65]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea rax, str.cytoplasm
add rsp, 0x20
pop r14
ret
Function at 0x140071240
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movzx r14d, r8b
xor r12d, r12d
mov rsi, r9
mov rdi, rdx
mov ebp, ecx
cmp ecx, r14d
jle 0x14007133f
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [r12 + 0x16]
mov edx, 0x1b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1400712c0
mov ecx, r14d
imul ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x3b5
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x319
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r15, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp ebp, r14d
jge 0x1400713e8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0xffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r15d
lea rdx, str.cormorant
mov r9d, ebp
mov r8, rsi
mov ecx, ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rdx, str.cormorant
mov r8d, r15d
mov r9d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.spank
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140072d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x230]
mov esi, dword [rsp + 0x240]
movsxd r13, r9d
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x238]
movsxd r15, r8d
movsx ebp, dl
mov rdi, rcx
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, r15
mov r9, r15
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ecx, ebp
mov r14d, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r13d, r15d
jne 0x140072e49
mov rcx, rdi
movsx rbx, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.landform
mov r9, rbx
mov rcx, rax
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
or rbx, 0xffffffffffffffff
mov r12, rax
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140072e56
movzx eax, byte [rsp + 0x68]
lea r8, str.c0ret
lea rdx, str.nonconformist
mov r9d, esi
imul sil
movzx ecx, al
movzx eax, byte [rsp + 0x60]
shl cl, 3
sub cl, r15b
imul cl
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r15d
add al, 5
add bl, al
mov dword [rsp + 0x30], 0x40
mov ecx, r14d
mov dword [rsp + 0x28], esi
add bl, bpl
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movsx eax, bl
cmp esi, eax
jne 0x140072eda
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x389
lea r8d, [rcx + 0xe]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x32e
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x249
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, r12
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140072f70
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.cymbals
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.cymbals
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x267
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.c0ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0x329
lea ebx, [rax*4 + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
add ebx, edi
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r13d, r13d
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, ebp
shl ecx, 4
imul edi, edi
sub ecx, edi
lea edx, [rcx + rcx*4]
imul ecx, esi, 7
sub edx, ecx
sub edx, r15d
add edx, eax
lea eax, [rbp + 2]
add edx, r12d
add eax, edx
cmp eax, ebx
jne 0x140073113
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov dword [rsp + 0x30], r13d
xor r9d, r9d
mov r8, r14
mov rdx, r12
mov rcx, r14
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c1a5
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400734e0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movsxd rbx, edx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
mov edx, 0x19a
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.pyramid
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x283
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x30e
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.bookend
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x180
pop rbx
ret
Function at 0x140073720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
movzx ebx, dl
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [rbx - 2]
mov r15d, ebx
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [rsp + 0x70], 8
mov qword [rsp + 0x68], rax
lea rax, str.c0a1
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x161
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, str.faucet
lea rdx, [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
lea rcx, [rsp + 0xb0]
mov r9, r12
mov r13, rax
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x20], rax
call fcn.1400dcda0
mov ebp, ebx
lea r14d, [r13 - 7]
sub ebp, r12d
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
add r14b, bl
movups xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x90], xmm1
movups xmmword [rsp + 0xa0], xmm0
cmp bpl, 4
je 0x140073892
mov edi, dword [rsp + 0xa8]
lea rcx, str.mention
imul edi, dword [rsp + 0x68]
imul edi, r12d
add edi, 3
add edi, ebx
lea edi, [rdi + rbp*4]
movzx ebx, dil
shl bl, 2
add bl, 0xd
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
mov eax, edi
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 4
movzx ecx, bl
mov dword [rsp + 0x30], 4
lea rdx, str.c2a0
lea r8, str.c1a1
movsx r9d, r14b
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp ebx, ebp
jle 0x1400738c3
xor ecx, ecx
mov edx, 0x140
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
imul ebx, ebx
lea rcx, str.c0a1
mov qword [rsi], rcx
lea rcx, str.c0a0
lea r11, [rsp + 0xe0]
mov rbp, qword [r11 + 0x38]
mov qword [rsi + 8], rcx
mov ecx, dword [rsp + 0x84]
imul ecx, r13d
lea edx, [rcx + rbx*8]
mov rbx, qword [r11 + 0x30]
movsx rcx, r14b
add edx, ecx
sub edx, eax
sub edx, r12d
lea eax, [r15 + rdx]
add eax, edi
add eax, r15d
mov dword [rsi + 0x10], eax
mov rax, rsi
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140073b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x68], rax
cmp r14d, r12d
je 0x140073bcd
xor ecx, ecx
mov edx, 0x35a
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, str.lentil
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov edx, 0x16a
lea r8d, [rcx + 5]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rbx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x239
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x70], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
movsxd r15, eax
cmp r13b, 1
jb 0x140073caa
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0x19f
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
lea r8, str.c0a1
lea rdx, str.cassock
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r14d
mov r9d, r15d
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
imul eax, r14d, 0x2a
lea ebp, [rax + rbx*4]
sub ebp, r12d
add ebp, 0xffffffdf
add ebp, r13d
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
movzx esi, ax
movzx eax, r13b
imul dil
lea edi, [rax - 7]
add dil, r12b
add dil, r14b
movzx eax, dil
imul sil
lea ebx, [rax - 5]
add bl, bpl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x70]
add ecx, ecx
sub r15d, ecx
mov rcx, qword [rsp + 0x60]
add r15d, 0x15
imul ecx, r13d
imul ecx, dword [rsp + 0x68]
lea edx, [rcx + r15*2]
movsx rcx, bl
sub edx, ecx
movzx ecx, dil
sub edx, ecx
sub edx, eax
sub edx, esi
sub edx, ebp
sub edx, r12d
lea eax, [r14 + rdx]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140074260
Capabilities:
Create thread

Disassembly:
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea ecx, [rax + rax*2]
shl ecx, 2
cmp ecx, 4
jae 0x1400742ee
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.cicada
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
ret
Function at 0x140074d90
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
movzx ebx, cl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.midwife
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.garter
lea rcx, str.midwife
movsx r8d, bl
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
Function at 0x140076270
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14d, dword [rsp + 0x80]
mov rbp, r9
mov rsi, rdx
mov r12, rcx
imul r14d, ecx
or rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400762a7
xor eax, eax
imul edi, r12d
xor edx, edx
add edi, r8d
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor ecx, ecx
mov r9d, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffff
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov rcx, rbx
movsxd rdx, eax
nop word [rax + rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400762f0
imul ecx, dword [rsp + 0x80]
imul r15d, edi
mov eax, 1
movsx rdx, dl
imul ecx, dword [rsp + 0x70]
imul r15d, r14d
shl r15d, 3
sub eax, r15d
imul eax, r12d
add eax, r14d
add eax, ecx
add edx, 0xfffffffb
nop word [rax + rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140076330
mov rbp, qword [rsp + 0x68]
add eax, edx
add eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140076360
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx esi, r9b
movsxd rdi, r8d
mov rbx, rdx
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
cmp sil, dil
jl 0x1400763ca
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x40]
lea rcx, str.world
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x8a
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx ecx, sil
imul ebx, edi
imul ecx, ebp
imul edx, eax, 0xfffffff9
lea eax, [r14 + 7]
sub edx, ecx
sub edx, ebx
add eax, edx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140076430
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movsx r15, r9b
or rbx, 0xffffffffffffffff
mov rsi, rcx
mov rcx, r15
mov rdi, rbx
mov rbp, r8
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140076465
mov rax, rbx
inc rax
cmp byte [rax + r8], 0
jne 0x140076471
mov r12, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
imul edi, eax
sub edi, ecx
mov rax, rbx
sub edi, r12d
inc rax
cmp byte [r14 + rax], 0
jne 0x140076496
add edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x28], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x98], rax
cmp r15b, 8
jge 0x1400764d7
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp r15b, 8
jle 0x1400764df
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rbx
mov r9, rax
inc rdx
cmp byte [rsi + rdx], 0
jne 0x1400764f4
mov r10, qword [rsp + 0x78]
movzx eax, r12b
imul byte [rsp + 0x28]
movzx ecx, al
movzx eax, r15b
imul cl
mov rcx, rbx
sub dl, al
sub dl, r10b
movzx r8d, dl
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140076520
movsx rax, r15b
mov edx, r13d
imul ecx, eax
mov eax, r8d
imul eax, r9d
imul ecx, r12d
sub edx, eax
add ecx, ecx
imul edx, r8d
imul eax, r10d, 7
imul edx, r9d
sub edx, ecx
sub edx, eax
mov rax, rbx
sub edx, r13d
sub edx, dword [rsp + 0x98]
add edx, edi
inc rax
cmp byte [rsi + rax], 0
jne 0x140076562
add eax, 0xfffffffd
add eax, edx
inc rbx
cmp byte [rbx + rbp], 0
jne 0x140076570
lea r11, [rsp + 0x40]
add eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret