joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003cc80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbp, r8
mov rsi, rcx
call fcn.1400b34e0
movsx rbx, al
call fcn.1400a2e10
mov ecx, ebx
mov r14, rax
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, ebx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov edx, 0x29
xor ecx, ecx
lea r8d, [rdx - 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r13d, r13d
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, bl
sub cl, al
add bl, 9
add cl, 0x15
cmp cl, bl
jbe 0x14003cd44
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, str.c4ret
lea rcx, [rsp + 0x30]
call fcn.1400db820
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ebx, [r12 + 5]
imul edi, r15d
imul edi, r14d
add edi, ebp
add edi, esi
add ebx, edi
mov edx, ebx
call fcn.1400d5010
lea rdx, str.c4ret
lea rcx, str.retina
call fcn.140094c80
xor ecx, ecx
mov edx, 0x122
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov rdi, rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.element
lea rdx, str.c4ret
mov r8, rdi
mov qword [rsp + 0x20], rcx
mov ecx, 0x10
mov r9, rax
call fcn.1400c0c40
mov rbx, qword [rsp + 0xa8]
lea rax, str.rainmaker
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140043230
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r14, ecx
xor ecx, ecx
mov r15, r9
mov rsi, r8
mov r12, rdx
call fcn.14006f850
or rdi, 0xffffffffffffffff
mov r13, rax
mov rbx, rdi
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140043261
xor eax, eax
lea r8, [0x140001b00]
mov r9, r14
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
imul ebx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov r8, r15
mov edx, ebx
mov ecx, r14d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x20], rax
call fcn.14008e170
mov byte [rsp + 0x70], al
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9, [0x1400ee230]
lea rdx, [0x1400ed4fc]
lea rcx, [0x1400ed4fc]
mov r8d, 8
mov rbx, rax
mov qword [rsp + 0x20], rax
call fcn.1400c9e70
lea r8d, [rbx + rbx*2]
mov rbp, rax
mov rax, qword [rsp + 0x88]
lea ecx, [rax + rax]
mov edx, r14d
mov dword [rsp + 0x78], r8d
sub edx, ecx
inc edx
imul edx, r15d
sub edx, r13d
sub edx, r14d
lea r13d, [rdx - 2]
lea rdx, str.jute
add r13d, r8d
mov ecx, r13d
call fcn.1400a4fe0
mov qword [rsp + 0x90], rax
call fcn.14009dcf0
mov rbx, rax
call fcn.1400cf420
mov rcx, rdi
mov edx, eax
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140043340
imul ecx, r12d
imul ecx, r14d
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140043351
imul edi, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
imul ebp, r13d
mov eax, 9
sub eax, r15d
add ecx, edi
add ecx, ebp
lea eax, [rcx + rax*2]
movsx rcx, byte [rsp + 0x70]
add eax, ecx
sub eax, edx
add eax, dword [rsp + 0x78]
add eax, dword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400433b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xf0
mov esi, r9d
mov r15, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov edi, eax
call fcn.1400d5010
cmp esi, edi
jb case.default.0x140043515
mov qword [rsp + 0x110], rbx
call fcn.140085df0
mov qword [rbp - 0x59], r15
movzx ebx, al
mov eax, r15d
mov dword [rbp - 0x51], 4
imul ebx, dword [rbp + 0x7f]
imul eax, r12d
imul eax, esi
imul ebx, edi
add ebx, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edi, edi
mov qword [rbp - 0x49], rax
lea rax, str.gown
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rax
lea rax, str.c0ret
mov qword [rbp - 0x31], rax
lea rax, str.station
mov qword [rbp - 0x29], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.icebreaker
movups xmm0, xmmword [rbp - 0x59]
movups xmm1, xmmword [rbp - 0x49]
mov qword [rsp + 0x30], rax
lea r9, str.paper
lea r8, [rbp - 1]
movaps xmmword [rbp - 1], xmm0
movaps xmmword [rbp + 0xf], xmm1
movups xmm0, xmmword [rbp - 0x39]
movsd xmm1, qword [rbp - 0x29]
mov edx, ebx
mov cl, 4
mov qword [rsp + 0x20], rdi
movaps xmmword [rbp + 0x1f], xmm0
movsd qword [rbp + 0x2f], xmm1
call fcn.14007c8b0
mov rbx, qword [rsp + 0x110]
mov rdx, qword [rbp + 0x7f]
xor ecx, ecx
mov dword [rbp - 0x71], 0x40
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp - 0x69], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp - 0x61], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9, str.gladiolus
movups xmm0, xmmword [rbp - 0x71]
movsd xmm1, qword [rbp - 0x61]
lea r8, str.peony
lea rcx, [rbp - 0x21]
mov rdx, rax
movaps xmmword [rbp - 0x21], xmm0
movsd qword [rbp - 0x11], xmm1
call fcn.140080df0
xor ecx, ecx
mov edx, 0x1c1
lea r8d, [rcx + 0x16]
lea r11, [rsp + 0xf0]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rbp
jmp qword [sym.imp.KERNEL32.dll_FindResourceA]
Function at 0x140044f50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0x130]
mov r15, qword [rbp + 0x128]
xor r12d, r12d
movzx esi, r8b
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmm2, xmmword [rax + 0x10]
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax + 0x20]
psrldq xmm2, 8
or rax, 0xffffffffffffffff
movq rcx, xmm2
movaps xmmword [rbp - 0x70], xmm0
inc rax
cmp byte [rcx + rax], r12b
jne 0x140044fc6
mov ebx, 2
sub ebx, r15d
sub ebx, eax
mov dword [rsp + 0x58], ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [rsp + 0x30]
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsp + 0x30], xmm0
lea rdx, str.whirlpool
mov cl, 0xf3
mov r9, rax
mov r14, rax
mov dword [rsp + 0x38], ebx
call fcn.140080fa0
mov rdi, rax
cmp sil, 0xf3
jbe 0x14004509f
movzx ebx, byte [rbp - 0x58]
mov edx, 0x104
add bl, sil
movzx ecx, bl
shl cl, 2
add bl, cl
lea rcx, [rbp - 0x50]
sub bl, byte [rsp + 0x58]
sub bl, r14b
add bl, al
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
movzx r9d, sil
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x1400ed3f4]
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
lea rcx, str.lamb
movaps xmmword [rsp + 0x50], xmm0
movsd xmm1, qword [rsp + 0x40]
movsd qword [rsp + 0x60], xmm1
movzx edx, bl
call fcn.140099d20
call qword [sym.imp.USER32.dll_GetActiveWindow]
imul ecx, r14d, 0xd
mov rsi, rax
add edi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea r8d, [rdi + 0x37]
movzx ecx, ax
mov r9, r14
mov dl, 0x40
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov byte [rsp + 0x20], bl
call fcn.1400a6020
mov rcx, rsi
call fcn.1400c8250
mov rax, rsi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140049170
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movups xmm0, xmmword [r8]
movzx r12d, dl
xor eax, eax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], rax
movups xmmword [rsp + 0x50], xmm0
mov r9d, r12d
xor edx, edx
xor ecx, ecx
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [r8 + 0x10]
lea r8, [0x140001b00]
mov dword [rsp + 0x20], eax
movaps xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_CreateThread]
movzx esi, dil
mov rbp, rax
mov qword [rsp + 0x48], rax
movzx eax, r12b
movups xmm0, xmmword [rsp + 0x50]
psrldq xmm0, 8
movd ecx, xmm0
imul cl
sub sil, al
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r9, [0x1400ede90]
mov dword [rsp + 0x30], eax
mov r8, rbp
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov byte [rsp + 0x20], sil
mov qword [rsp + 0x50], rax
call fcn.140096c90
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r15, rax
xor eax, eax
mov r9d, r12d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.c0a1
xor edx, edx
mov rbp, rax
call fcn.140088dd0
mov rbx, rax
cmp r12b, sil
ja 0x140049331
movzx ecx, sil
movzx esi, r12b
imul ecx, dword [rsp + 0x60]
imul ecx, dword [rsp + 0x48]
add ecx, edi
add esi, ecx
add esi, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r9, r12
mov ecx, esi
mov rdi, rax
mov qword [rsp + 0x20], rax
call fcn.1400b1930
imul ebp, edi
imul ebp, esi
shl ebp, 4
mov ecx, r14d
imul ecx, dword [rsp + 0x50]
lea r8d, [rcx + rcx*2]
sub r8d, ebp
sub r8d, eax
sub r8d, r13d
add r8d, dword [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400492f0
mov edx, 2
imul edi, r12d
lea rcx, [0x1400ee534]
sub edx, r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
shl edx, 2
lea rcx, str.c0a3
sub edx, edi
sub edx, r13d
sub edx, r14d
sub edx, esi
add edx, eax
call fcn.1400d6650
lea rax, str.couch
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140053520
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor r8d, r8d
mov rdi, rdx
mov ebx, ecx
call fcn.1400d0fb0
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
or rcx, 0xffffffffffffffff
mov rbp, rax
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140053570
lea edi, [rsi + rbx]
sub dil, cl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov dword [rsp + 0x30], eax
lea rax, str.folder
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rsi, [0x1400ed3f4]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rsp + 0x40]
movzx r8d, dil
mov rdx, rbp
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.14008dbd0
cmp dil, bl
ja 0x140053615
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
sub bl, byte [rsp + 0x30]
xor eax, eax
sub bl, dil
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
movzx r9d, bl
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x50]
call fcn.140075350
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140054350
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov r12, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rax
mov r15, rax
call fcn.1400cd5b0
lea r9, str.cleaner
lea r8, str.star
movsxd rbp, eax
movzx eax, r15b
lea rcx, str.mambo
imul r12b
movzx ebx, al
sub bl, bpl
movzx edx, bl
call fcn.14008ad10
xor ecx, ecx
mov edx, 0x25b
lea r8d, [rcx + 6]
mov dword [rsp + 0x30], 0x10
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
movsx rcx, bl
mov qword [rsp + 0x28], rdx
mov r14d, r12d
lea r8, [0x140001b00]
mov r9, rbp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], edx
imul r14d, r15d
add r14d, 0xfffffff9
mov dword [rsp + 0x20], edx
lea r14d, [r14 + rcx*4]
xor ecx, ecx
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, r12d
mov qword [rsp + 0x50], rax
lea eax, [rbp*4]
mov edx, 0x104
sub ecx, eax
sub ecx, 7
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x60]
mov rdx, r15
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
mov r8, rax
mov rdi, rax
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
call fcn.14009a0d0
mov ebx, eax
call fcn.1400b1850
movzx ecx, dil
mov esi, eax
movzx eax, r15b
shl cl, 2
add dil, cl
imul bpl
sub al, dil
sub al, bl
lea edx, [r12 + rax]
call fcn.1400c8340
xor ecx, ecx
mov edx, 0xab
lea r8d, [rcx + 0x18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rbx - 9]
lea r9, str.c1a0
imul r14d, r15d
sub r12d, r14d
sub r12d, esi
add r8d, r12d
lea rcx, str.beauty
mov rdx, rax
call fcn.1400c0a70
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.beauty
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140054540
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
movsx ebp, r8b
mov rdi, rcx
mov rsi, rdx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xffff
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea rdx, [0x1400ed3f4]
movzx r8d, al
mov rcx, r14
mov ebx, eax
call fcn.1400cc400
mov r8, rax
cmp bl, bpl
je 0x1400546c4
or rcx, 0xffffffffffffffff
mov rdx, rcx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400545a5
mov rax, rcx
inc rax
cmp byte [rsi + rax], 0
jne 0x1400545b1
imul dl
lea ebx, [rax + rbp]
mov rax, rcx
inc rax
cmp byte [r8 + rax], 0
jne 0x1400545c2
sub bl, al
xor esi, esi
mov rax, rcx
mov qword [rsp + 0x40], rsi
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x1400545e0
sub eax, r14d
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], sil
jne case.default.0x140054738
sub eax, ecx
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
movsx r9, bpl
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.world
lea r9, [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x40]
movsd xmm1, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea r8, str.lentil
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
lea rdx, [0x1400ed4d4]
movzx ecx, bl
mov qword [rsp + 0x20], rsi
call fcn.140095060
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9, str.bull_fighter
lea rdx, str.manservant
mov rcx, rax
call fcn.1400b4700
lea r8, [0x1400ed4d4]
lea rdx, [0x1400ed4d4]
lea rcx, [0x1400ed3f4]
call fcn.1400d8350
call fcn.14008a170
lea rdx, str.attendant
lea rcx, [rsp + 0x40]
mov r9d, 4
mov r8, r14
call fcn.1400c0eb0
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edx, 0x152
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x53
xor ecx, ecx
lea r8d, [rdx - 0x4a]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp qword [sym.imp.KERNEL32.dll_FindResourceA]
Function at 0x140056e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [rsp + 0x30]
movsd xmm0, qword [rsp + 0x30]
movsd qword [rsp + 0x30], xmm0
lea rdx, [0x1400ed4d4]
mov cl, 4
mov r9, rax
mov rdi, rax
mov dword [rsp + 0x38], 4
call fcn.140080fa0
mov rbx, rax
call fcn.1400d4eb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x23f
lea r8d, [rcx + 0xd]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebx
mov rdx, rax
call fcn.14007c6b0
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x140058590
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r14, rcx
mov ecx, 0xffff
mov qword [rsp + 0x58], r9
mov byte [rsp + 0x40], r8b
mov r15d, edx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov ecx, r15d
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, str.fortress
lea rcx, str.sneakers
mov qword [rsp + 0x48], rax
lea rax, str.element
mov r9d, ebp
mov qword [rsp + 0x30], rax
lea rax, str.misogyny
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.1400b6860
mov rsi, rax
call fcn.14008df70
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x29a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx r13d, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.c0a2
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x78]
mov r9, r12
xor r8d, r8d
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x50], rax
call fcn.14009b420
movups xmm0, xmmword [rax]
movsd xmm1, qword [rax + 0x10]
movsd qword [rsp + 0x70], xmm1
movups xmmword [rsp + 0x60], xmm0
cmp r13d, ebp
je 0x14005868d
lea rcx, str.manservant
call fcn.140093a60
call fcn.140085c70
mov rbx, rax
cmp r15d, ebp
jae 0x14005872f
lea rcx, str.sneakers
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x351
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rcx, 0xffffffffffffffff
mov rdx, rcx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400586e0
mov eax, 0xf
sub al, dl
mov rdx, rcx
shl al, 2
sub al, bpl
sub al, byte [rsp + 0x68]
sub al, r12b
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140058700
add al, dl
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140058710
add cl, al
add cl, r15b
add cl, byte [rsp + 0x40]
add cl, byte [rsp + 0x58]
add cl, byte [rsp + 0x50]
call fcn.1400a1570
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x90]
mov edx, 0x104
mov qword [r14], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
mov qword [r14 + 8], rax
xor eax, eax
mov r9, r13
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 0x10], rax
mov rax, r14
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400596d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
call fcn.1400d2730
movsx r12, al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
mov r14, rax
xor eax, eax
mov r9, r12
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, ebx
mov ecx, ebp
mov byte [rsp + 0x28], bl
mov r15, rax
mov qword [rsp + 0x20], rax
call fcn.140084d40
mov rdi, rax
cmp bl, bpl
jg 0x14005976b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov ecx, ebx
movsx edx, bl
lea r8, str.vixen
imul ecx, ebx
imul edx, r14d
imul ecx, ebp
add edx, ecx
movzx ecx, al
call fcn.1400b8a80
call fcn.14009c2b0
movsx ecx, bl
mov esi, eax
cmp eax, ecx
jl 0x140059792
xor ecx, ecx
mov edx, 0x17a
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9, rax
call fcn.14009a8a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, str.patio
lea rcx, str.interview
mov r13, rax
lea rax, str.c1a3
mov r9d, 4
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.1400b6860
or rcx, 0xffffffffffffffff
mov rdx, rcx
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400597d0
imul edx, r13d
movsx r8d, r12b
imul r8d, ebp
add edx, r14d
shl edx, 2
inc r8d
imul r8d, ebx
sub r8d, edx
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400597f5
mov rbp, qword [rsp + 0x78]
movsx rax, bl
mov rbx, qword [rsp + 0x70]
imul ecx, eax
add r8d, ecx
lea eax, [r15 + 9]
sub r8d, esi
mov rsi, qword [rsp + 0x80]
add eax, r8d
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret