joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c6b50
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x2e8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
movsxd r15, ecx
mov ebx, edx
mov dword [rsp + 0x40], edx
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x190]
lea rcx, str.chess
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r14d, [r15 - 3]
mov r12, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx edx, r14b
mov esi, edx
imul esi, r12d
add esi, r13d
cmp r15d, edx
jge 0x1400c6d33
xor ecx, ecx
mov edx, 0xda
mov qword [rsp + 0x330], rbp
lea r8d, [rcx + 0xd]
mov qword [rsp + 0x2e0], rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, r15b
imul bl
movzx ebp, al
movzx edi, al
sub bpl, sil
call qword [sym.imp.USER32.dll_GetActiveWindow]
movsx ecx, bpl
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
neg bpl
shl bpl, 2
add bl, 5
mov rsi, rax
movzx eax, r14b
xor r8d, r8d
mov edx, 0x10f
xor ecx, ecx
imul r13b
sub bpl, al
sub bpl, r12b
add bpl, dil
add bpl, bl
mov ebx, dword [rsp + 0x40]
sub bl, 0xc
add bl, r15b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x4e
xor ecx, ecx
lea r8d, [rdx - 0x3d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.chess
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x26f
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x2f7
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx ecx, bl
movsx eax, bpl
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
xor r9d, r9d
mov r8, r12
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdi, qword [rsp + 0x2e0]
mov rbp, qword [rsp + 0x330]
lea rax, str.rainbow
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret
Function at 0x1400c7510
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx r13d, cl
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r12d, r13b
lea ebx, [rax*4]
lea r15d, [r13 - 4]
lea rcx, [rsp + 0x70]
sub r12b, bl
mov edx, 0x104
mov rsi, rax
mov dword [rsp + 0x64], ebx
mov ebp, r13d
add r15d, eax
add r12b, 4
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea ecx, [r15 + 2]
mov r14, rax
imul edx, ecx, 7
lea edi, [rdx + rbx*4]
sub edi, esi
add edi, r13d
add edi, eax
mov dword [rsp + 0x60], edi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, sil
add cl, cl
mov rbx, rax
add sil, cl
sub dil, sil
add dil, r13b
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rsi, rax
add eax, 0xffffffe0
imul ecx, ebx, 7
sub ecx, r15d
sub ecx, dword [rsp + 0x64]
add ecx, r13d
add eax, ecx
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r9d, dword [rsp + 0x60]
mov r8, rax
movzx eax, bl
imul r9b
movzx ebp, al
mov al, 7
imul r12b
add bpl, al
movzx eax, r12b
sub bpl, dil
imul r15b
movzx ecx, al
mov al, 7
sub bpl, 6
add bpl, r13b
add bpl, r14b
imul cl
movzx edx, al
movzx eax, r8b
imul sil
mov esi, dword [rsp + 0x64]
movzx ecx, al
add cl, cl
lea edi, [rcx + rax]
add dil, dil
sub dil, dl
sub dil, sil
sub dil, 0x14
add dil, r9b
add dil, r13b
cmp r8b, 6
jg 0x1400c76d9
lea rcx, str.c0a1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
movsx r9, bl
xor ebx, ebx
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8d, [rbx + 0x1d]
mov edx, 0x122
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], esi
movzx eax, dil
movzx edx, bpl
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str.numismatist
lea r8, str.c1ret
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x100
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1a1
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.c1ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.typewriter
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c7760
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movsx rbx, byte [rbp + 0x18]
mov r15, rax
mov qword [rsp + 0xa8], rax
mov byte [rsp + 0x90], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
mov r13, rax
xor eax, eax
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
add eax, 5
mov byte [rsp + 0x98], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
movzx eax, r13b
imul r13b
movzx ebx, al
shl bl, 2
add bl, byte [rbp]
add bl, r14b
add bl, dil
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdi, rax
movzx eax, byte [rsp + 0x90]
imul r15b
movzx ecx, al
shl cl, 2
lea r15d, [rcx + rax]
shl r15b, 2
sub r15b, 7
add r15b, byte [rbp]
add r15b, sil
add r15b, bl
add r15b, byte [rsp + 0x98]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ecx, bl
mov r9, rax
mov qword [rsp + 0x30], rax
mov edx, r13d
sub edx, ecx
mov rcx, qword [rsp + 0xa8]
movzx eax, dil
dec ecx
add esi, 0xfffffff7
imul r15b
movzx ebx, al
sub bl, r9b
add bl, 0xe
imul ecx, r12d
lea r8d, [rcx + rdx*2]
add r8d, dword [rbp + 8]
sub r8d, r14d
add esi, r8d
add bl, sil
add bl, r12b
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, qword [rbp + 0x10]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400c78a3
movzx eax, r12b
imul cl
movzx edx, al
movzx eax, sil
imul dil
movzx ecx, al
movzx eax, r12b
imul cl
movzx ecx, al
movzx eax, bl
imul cl
movzx ecx, al
mov al, 7
imul cl
sub r14b, al
movzx eax, r15b
sub r14b, r13b
imul byte [rsp + 0x30]
movzx ecx, r14b
shl cl, 2
add r14b, cl
sub r14b, al
movzx eax, byte [rsp + 0x90]
add dl, r14b
imul byte [rsp + 0xa8]
add al, dl
sub al, byte [rsp + 0xa0]
sub al, 9
add al, byte [rsp + 0x98]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c7a80
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movsxd rbx, r8d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.ride
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x9f
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x306
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c2a0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x180
pop rbx
ret

Function at 0x1400c7b40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, qword [rsp + 0x1b0]
movzx eax, cl
cmp r8d, eax
ja 0x1400c7bea
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x2e0
mov r8d, 9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 8]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x180
pop rbx
ret
Function at 0x1400c7ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
cmp al, byte [rsp + 0x178]
jbe 0x1400c804e
xor ecx, ecx
mov edx, 0x1dd
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov edx, 0x286
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x252
lea r8d, [rcx + 0x1d]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x1ed
lea r8d, [rcx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x107
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x226
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0xb]
mov edx, 0x1d2
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x18a
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c1ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x85
lea r8d, [rdx - 0x77]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx eax, dil
cmp dword [rsp + 0x178], eax
jl 0x1400c812d
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, [0x1400ed360]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x1400c8160
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x299
mov r8d, 0x1d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x20b
mov r8d, 0xb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x2c8
mov r8d, 0xf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x140
pop rbx
ret

Function at 0x1400c8250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.nonconformist
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edi, [rsi - 0xd]
cmp dil, sil
jl 0x1400c82ba
xor ecx, ecx
mov edx, 0xd7
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x21
xor ecx, ecx
lea r8d, [rdx - 0x15]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
add esi, 0xfffffff7
cmp dil, bl
jle 0x1400c82ed
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
movsxd r9, esi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c8340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsx ebx, dl
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x274
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x238
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x140
pop rbx
ret
Function at 0x1400c8d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x178
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
movsx ecx, al
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.mother
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x178
ret

Function at 0x1400c8e30
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movsxd rsi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [0x1400ed3b8]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x30]
mov edx, ebx
mov r9, rax
call fcn.1400da860
cmp ebx, dword [rsp + 0xc0]
jg 0x1400c8ea5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
movsx r9, sil
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400c8ef0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x18]
mov edx, 0x162
mov r13, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rbx, 0xffffffffffffffff
mov rcx, rax
mov qword [rsp + 0x68], rax
mov rdx, rbx
nop word [rax + rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400c8f60
movzx r15d, r14b
lea r8, [0x140001b00]
sub r15b, r12b
sub r15b, dl
xor edx, edx
sub r15b, 4
movsx rax, r15b
mov r12d, eax
mov qword [rsp + 0x60], rax
imul r12d, r14d
sub r12d, 4
lea eax, [rcx + r12*4]
xor ecx, ecx
add r12d, eax
xor eax, eax
mov qword [rsp + 0x28], rax
movsxd r9, r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov rcx, rbx
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400c8fc0
imul ecx, r13d
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x1400c8fd0
mov rdx, qword [rsp + 0xb0]
imul eax, r14d
lea r13d, [rax + rcx*4]
xor ecx, ecx
sub r13d, r12d
add r13d, 0xa
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x60]
movsx r15d, r15b
mov qword [rsp + 0xb0], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r15d
mov r9d, 4
mov dword [rsp + 0x30], r15d
lea r8, [0x1400ed3b8]
lea rdx, str.wrist
mov ecx, r9d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rbx
mov rdx, rax
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x1400c9060
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400c9070
imul ecx, eax
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400c9080
imul ecx, ebx
lea r11, [rsp + 0x80]
imul r15d, r12d
inc ecx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
imul ecx, r14d
sub r14d, dword [rsp + 0x68]
sub r14d, dword [rsp + 0x70]
add r14d, 4
lea eax, [rcx + r14*2]
add eax, r15d
sub eax, edx
sub eax, dword [rsp + 0xb0]
sub eax, r13d
add eax, dword [rsp + 0x78]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400c90e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x148
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x148
ret
Function at 0x1400ca2c0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov r12d, edx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
movzx esi, ax
mov r14d, r15d
sub r14d, r12d
lea r8d, [rcx + 0x12]
mov edx, 0x31e
lea ebx, [r14 - 5]
add ebx, esi
add ebx, ebp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xd0]
lea rcx, str.deodorant
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor r13d, r13d
lea r8, str.deodorant
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r13d
lea r9d, [r13 + 1]
lea rdx, str.slice
mov ecx, r12d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rax, str.handsaw
lea r8, [0x140001b00]
mov qword [rsp + 0x60], rax
lea rax, str.minion
mov r9d, r12d
mov qword [rsp + 0x68], rax
lea rax, str.hardboard
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x7c], r14d
mov qword [rsp + 0x80], r15
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdi, str.pine
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xa0]
lea r8, str.management
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movups xmm0, xmmword [rsp + 0x80]
lea rdx, str.fahrenheit
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0x20], rbx
call fcn.1400dc730
test r12d, r12d
jne 0x1400ca4a9
lea r8d, [r13 + 0x14]
mov edx, 0x346
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.management
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.soap
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x270]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret