joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400819a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r13, rdx
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x1c
xor ecx, ecx
lea r8d, [rdx - 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0xf5
mov r8d, 0xe
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, r14b
mov rsi, rax
imul edx, ebx, 0xfffffffc
imul esi, ecx
imul ecx, ebp, 0x31
sub edx, ecx
sub edx, r13d
sub edx, r15d
add edx, r12d
imul edx, edi
sub esi, edx
add esi, 4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0xbd
mov r8d, 0xb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp r14b, sil
jbe 0x140081abf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, 0x11b
mov r8d, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140081b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x12e
mov r8d, 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x273
mov r8d, 0x19
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.typewriter
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0xfa
mov r8d, 0xb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.c0a1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x140
pop rbx
ret
Function at 0x140082ed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x238
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.anywhere
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea edx, [rdi - 0x14]
lea ecx, [rax + rax*4]
mov rbx, rax
lea edx, [rdx + rcx*8]
cmp edx, 8
jge 0x140082f66
xor ecx, ecx
mov edx, 0x387
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x140083ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
cmp sil, 8
jge 0x140083d5b
mov ecx, 0xffff
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
lea ebx, [rsi + rbp]
mov ecx, esi
lea edi, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
sub dil, bl
sub dil, 8
xor eax, eax
lea r8, [0x140001b00]
add dil, bpl
mov qword [rsp + 0x28], rax
xor edx, edx
add dil, sil
xor ecx, ecx
mov dword [rsp + 0x20], eax
movsx r9, dil
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 7]
mov edx, 0x28d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x34c
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1c5
lea r8d, [rcx + 0x15]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, qword [rsp + 0x50]
lea rax, str.c0a2
add rsp, 0x30
pop rsi
ret
Function at 0x140084170
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsx edi, byte [rsp + 0x180]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov ebx, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, edi
ja 0x140084258
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 4]
mov edx, 0x1ae
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.slice
movsx rdi, dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.slice
mov r9d, ebx
mov r8, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ecx, ecx
mov edx, 0x127
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.alley
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140084480
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
movsxd rbx, dword [rsp + 0x1f0]
mov r12, qword [rsp + 0x1f8]
mov rbp, qword [rsp + 0x200]
mov r15, rcx
mov rdi, r8
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], r9d
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor r13d, r13d
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov r14, rax
mov rsi, rbx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [rsp + 0x208]
imul ebx, edi
mov rdi, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
imul ebx, dword [rdi]
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, r14d
imul ecx, ebx
lea edx, [rax + 0x26]
mov r13, rax
add edx, ecx
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1400845a6
mov rax, qword [rsp + 0x30]
lea eax, [rax*8]
sub r14d, eax
sub r14d, esi
mov esi, r12d
sub r14d, dword [rsp + 0x208]
imul esi, dword [rsp + 0x40]
imul esi, edx
lea eax, [rdx + r14]
add ebx, eax
mov eax, dword [rdi + 8]
add ebx, dword [rdi]
imul eax, dword [rsp + 0x3c]
add esi, eax
sub esi, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 3]
mov edx, 0x3e6
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.manservant
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp ebx, esi
jne 0x14008463b
lea rdx, str.c0a2
lea rcx, str.dimple
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.c7ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [r15], r13
mov qword [r15 + 8], 0
mov rax, r15
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400846d0
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
or rax, 0xffffffffffffffff
mov rdx, rax
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140084703
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140084710
imul dl
sub al, sil
lea esi, [rcx - 0xb]
add al, 6
movzx edi, al
add esi, edi
cmp esi, edi
jbe 0x140084779
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x3a2
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r8d, r8d
mov edx, 0xd9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp esi, edi
jb 0x14008478d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.mary
lea rcx, str.c1a3
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 0x2f
xor ecx, ecx
lea r8d, [rdx - 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
lea rax, str.igloo
add rsp, 0x20
pop rdi
ret
Function at 0x140084d40
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rbx, qword [rsp + 0x3e0]
mov edi, edx
mov esi, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
cmp byte [rsp + 0x3e8], dil
je 0x140084d92
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x280]
mov edx, 0x104
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp edi, 4
jne 0x140084e1d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.mixer
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, 4
jle 0x140084e65
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
sub ebx, edi
sub ebx, ebp
sub ebx, r14d
add ebx, 0xfffffffc
add ebx, esi
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.c3a2
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400854d0
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15d, 2
mov rdi, rax
sub r15d, ebx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx esi, r15b
lea edx, [r14 + r14*2]
xor ecx, ecx
shl edx, 4
sub sil, dil
lea r8d, [rcx + 0x14]
add edx, 8
add sil, 0x14
add sil, dl
add sil, al
movzx ebp, sil
sub ebp, edi
shl dil, 3
sub ebp, eax
sub ebp, edx
sub dl, 0xa
add ebp, 0x20
add ebp, r15d
sub r15b, dil
sub r15b, al
sub r15b, r14b
add r15b, dl
mov edx, 0x2bc
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movzx r9d, sil
mov rbx, rax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.c0ret
lea rcx, str.plough
imul eax, ebx
lea ebx, [rax + rax*4]
movsx eax, r15b
sub ebx, eax
add ebx, ebp
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c0ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.farmer
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140085b30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, rcx
mov rdi, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 2]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
or rbx, 0xffffffffffffffff
mov rdx, rax
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140085bb0
mov rcx, qword [rsp + 0x1b0]
movzx eax, sil
imul byte [rcx + 8]
xor ecx, ecx
lea r8d, [rcx + 0xf]
shl al, 2
sub al, dl
mov edx, 0x280
add bl, al
add bl, bpl
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.dimple
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp bl, 2
ja 0x140085c18
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0x283
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rax, str.c1a1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140085c70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0xea
lea r8d, [rcx + 0x17]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x16]
mov edx, 0x254
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xe8
lea r8d, [rcx + 0x12]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, esi
sub edx, ebp
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
lea r13d, [rdi + rdx*8]
mov qword [rsp + 0x40], 5
add edx, 0xfffffffb
mov dword [rsp + 0x38], esi
add r13d, edx
mov dword [rsp + 0x30], 9
lea rdx, str.flare
lea r9d, [rax + 9]
lea r8, str.eight
mov ecx, esi
mov dword [rsp + 0x28], 9
mov dword [rsp + 0x20], 5
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea eax, [rdi + rdi*2]
lea edi, [rax*2 + 0x17]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx ecx, bl
cmp ecx, 8
jg 0x140085db0
lea eax, [r14 + rsi]
imul eax, r15d
sub eax, edi
sub eax, r13d
inc eax
add ecx, eax
add ecx, r12d
add ecx, esi
add ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rax, str.c1a0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140085e50
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, ecx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, esi
lea r14d, [rdi - 0xc]
sub edx, ebx
mov r9, rax
mov r10d, esi
add r14d, edx
sub r10d, edi
lea ebp, [rsi + 0x2f]
imul r9d, ebx
add r10d, 6
lea eax, [r14 + r14*4]
lea ecx, [r14*4]
add eax, eax
lea edx, [r10 + r10*4]
lea ebx, [rdi + 0x18]
sub eax, r9d
lea r8d, [rcx + rdx*2]
add eax, esi
sub r8d, edi
add eax, r10d
add ebp, r8d
add ebx, eax
imul ebx, ebp
shl ebx, 2
cmp r10b, 5
ja 0x140085f08
xor ecx, ecx
mov edx, 0x217
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x204
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
cmp ebp, r14d
ja 0x140085f51
xor ecx, ecx
mov edx, 0x123
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.patio
lea rcx, str.bafflement
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140086650
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r13d, dword [rsp + 0x1f8]
movzx r12d, byte [rsp + 0x200]
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
cmp r12b, r13b
jge 0x140086716
movsx ecx, r12b
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x1b1
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, [0x1400ed3b8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov edx, 0xd4
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov rsi, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.scorn
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp r12b, 1
jg 0x1400867a0
mov ecx, dword [rbx + 0x18]
lea ebx, [rsi - 0x1e]
xor esi, esi
add ecx, r13d
lea r8, [0x140001b00]
movsx r9, r12b
add ecx, eax
xor edx, edx
mov qword [rsp + 0x28], rsi
add ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x30]
imul eax, dword [rbx + 0x38], 7
xor ecx, ecx
lea ebp, [rdi*4]
lea r15d, [rbp + 0x14]
lea r8d, [rcx + 1]
mov edx, 0xf3
add r15d, eax
lea r14d, [r15 - 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, dil
movzx edi, byte [rbx + 8]
shl cl, 2
mov edx, 0x88
sub dil, cl
lea r8d, [rdx - 0x72]
xor ecx, ecx
sub dil, r14b
mov rsi, rax
add dil, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov rbx, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.rack
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r8, qword [rsp + 0x38]
lea rcx, str.washtub
mov qword [r8 + 8], rcx
movzx ecx, dil
mov qword [r8], rax
add ecx, 6
mov qword [r8 + 0x18], rax
lea edx, [rcx + rcx*4]
mov rcx, qword [rsp + 0x30]
imul ecx, dword [rcx], 7
add edx, ecx
movsx rcx, r12b
sub edx, ecx
sub edx, ebx
add edx, ebp
add edx, r13d
add edx, eax
mov rax, qword [rsp + 0x40]
add edx, esi
mov qword [r8 + 0x20], rax
lea rax, str.c14a3
add edx, r14d
mov qword [r8 + 0x28], rax
mov rax, r8
add edx, r15d
mov dword [r8 + 0x10], edx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret