joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008df70
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
lea ebx, [rax + 0x2b]
mov r13, rax
add bl, r14b
movzx edi, bl
lea r15d, [r14 + rdi*4]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
movzx edx, r15b
imul esi, r14d, 7
mov ecx, 0xffff
sub esi, edx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor eax, eax
lea ebp, [r15 + 4]
mov qword [rsp + 0x28], rax
mov r12d, r14d
lea r8, [0x140001b00]
lea r9d, [rax + 0x20]
add ebp, r14d
sub r12d, r13d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], ebp
add r12d, 7
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp bl, r15b
ja 0x14008e02a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, qword [rsp + 0x48]
imul edi, r14d
lea ecx, [rbp*4]
mov edx, 0x104
imul edi, r15d
add ecx, ebp
lea edi, [rdi + r12*4]
add edi, ecx
lea rcx, [rsp + 0x80]
sub edi, eax
sub edi, esi
lea ebp, [rdi + rdi*8]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ebx, r12d
imul ebx, dword [rsp + 0x40]
lea ecx, [rdi + rbx*4]
mov rsi, rax
add ebx, ecx
imul ebx, dword [rsp + 0x48]
sub ebx, r13d
add ebx, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov r8, r13
mov rdx, rsi
mov rcx, r13
mov dword [rsp + 0x28], ebp
mov edi, eax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
mov edx, 0x167
lea r8d, [rcx + 0x15]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx rcx, bl
sub ecx, edi
lea edi, [r14 + 3]
add ecx, eax
add edi, ecx
cmp r15b, bl
jae 0x14008e0db
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp r15d, edi
jbe 0x14008e12f
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsxd r8, dword [rsp + 0x40]
lea rdx, str.slice
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov edx, 0x74
xor ecx, ecx
lea r8d, [rdx - 0x5a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rax, [0x1400ede90]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008e170
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov edi, dword [rsp + 0xf0]
movsxd r13, edx
mov r14d, 0x4a
sub edi, r8d
mov r12, r9
mov rsi, r8
add edi, ecx
mov ebp, ecx
add edi, r13d
sub r14b, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea r8, [0x140001b00]
mov ebx, eax
xor eax, eax
mov r9, r13
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, qword [rsp + 0xf8]
movzx edx, r14b
mov eax, esi
imul eax, ebp
imul ecx, edx, 0x2a
add eax, r15d
add ecx, eax
mov eax, 1
sub eax, esi
mov dword [rsp + 0x90], ecx
lea eax, [rbx + rax*4]
mov dword [rsp + 0xd0], eax
cmp ebp, edx
jle 0x14008e236
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
mov edx, 0x338
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movzx eax, ax
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x86
lea r8d, [rdx - 0x77]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, 0xffffffd5
sub ebx, r15d
cmp ebx, 0x40
jle 0x14008e288
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movzx eax, r12b
mov ecx, 4
lea r11, [rsp + 0xa0]
imul r13b
sub cl, al
movzx eax, sil
mov rsi, qword [r11 + 0x48]
imul cl
movzx edx, al
movzx eax, r14b
imul dil
movzx ecx, al
add cl, cl
add al, cl
shl al, 2
add al, byte [rsp + 0x40]
movzx ecx, al
add cl, cl
add al, cl
add al, al
sub dl, al
movzx eax, byte [rsp + 0xd0]
imul byte [rsp + 0x90]
sub dl, al
mov al, 0x47
imul r15b
sub dl, al
sub dl, bl
mov rbx, qword [r11 + 0x38]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x40]
inc al
add al, byte [rsp + 0xf0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008eb10
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov ebp, r9d
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r14, rax
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14008eb50
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor edx, edx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x3d3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx r8d, dil
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
movzx eax, r14b
lea r8, [0x1400ed4d4]
mov rdx, rsi
mov dword [rsp + 0x20], ebx
imul bl
movzx ecx, al
mov al, 7
imul cl
mov ecx, ebx
movsx r9d, al
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [rdi + 0x1e]
lea r8d, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rdi + 0x1c]
mov edx, 0x1ad
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.lion
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [rdi + 0x14]
mov edx, 0x2ac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, str.c5ret
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14008ee80
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsx rcx, bl
movsx r8d, bl
lea edi, [rax - 2]
add edi, ecx
cmp edi, r8d
je 0x14008ef59
lea rdx, [0x1400ed4d4]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.wetsuit
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x31f
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.c0a2
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x14008f2d0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r14, r8
mov edi, edx
mov rbp, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
cmp ebp, edi
jne 0x14008f30f
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rax, str.c0a4
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14008f320
movzx eax, bl
mov esi, 0xfe
shl al, 2
sub sil, r14b
add bl, al
add bl, bl
sub bl, 0x10
sub sil, bl
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.platinum
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor r12d, r12d
cmp sil, 0x10
jb 0x14008f414
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8d, [r12 + 2]
mov edx, 0xc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
movzx ecx, sil
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
lea r8, str.desk
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], ecx
lea rdx, str.inspector
mov ecx, ebp
mov r9d, ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [r12 + 8]
mov edx, 0x3d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r9d, [r12 + 0x10]
lea rdx, str.inspector
movsxd r8, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov edx, 0x30
xor ecx, ecx
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.c5a6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0x14]
mov edx, 0x109
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x3d6
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r9d, 0x10
lea rdx, str.inspector
mov r8d, r9d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movsx rax, bl
lea r8, [0x140001b00]
imul r14d, ebp
imul edi, r15d
lea ecx, [rdi + rdi*8]
xor edx, edx
mov qword [rsp + 0x28], r12
shl ecx, 6
mov dword [rsp + 0x20], r12d
add ecx, eax
lea eax, [rcx + rcx*4]
movzx ecx, sil
add eax, eax
sub r14d, eax
add r14d, 0xb
add ecx, r14d
movsxd r9, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.c0a0
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400901a0
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x60]
mov esi, 4
mov edx, 0x104
mov rbx, rax
sub esi, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ecx, sil
mov rdi, rax
shl cl, 2
add dil, cl
add dil, bl
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor ecx, ecx
mov edx, 0x2c4
lea r8d, [rcx + 0x14]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rcx, 0xffffffffffffffff
mov r14, rax
lea rax, str.loafer
inc rcx
cmp byte [rax + rcx], 0
jne 0x140090257
movzx eax, bpl
sub eax, esi
lea esi, [rax*4]
add esi, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dil, 4
je 0x14009032b
mov edx, 0x2c
xor ecx, ecx
lea r8d, [rdx - 0x26]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x201
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rsi + 2]
lea rdx, str.c0a0
lea rcx, str.c0a0
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, [0x1400ed7c8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x3c9
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x5e
xor ecx, ecx
lea r8d, [rdx - 0x43]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, rbx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140090360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, str.c2a0
mov rdi, r9
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, 4
lea rdx, str.c2a0
mov rcx, rax
mov r8d, r9d
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ecx, 0xffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, eax
ja 0x1400903fc
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.c2a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.painting
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
Function at 0x140090850
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbp, r9
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
imul esi, ebp, 7
mov r14d, eax
add esi, ebx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r15, rax
cmp r14d, esi
jb 0x1400908ab
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov edx, 0x56
movzx edi, ax
mov al, 7
lea r8d, [rdx - 0x3f]
xor ecx, ecx
imul bl
movzx ebx, al
sub bl, sil
sub bl, dil
sub bl, r14b
sub bl, 0x10
add bl, bpl
add bl, r15b
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edx, edx
movzx ecx, bl
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
movzx eax, bl
lea r9d, [rdx + 0x10]
lea r8, [0x1400ee40c]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], ecx
lea rdx, str.c5ret
xor ecx, ecx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor ecx, ecx
mov edx, 0x145
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, str.dirndl
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140090f40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, qword [rbx + 8]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x140090f67
lea ecx, [rdi + rdi*8]
shl ecx, 2
add eax, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x2e3
mov qword [rsp + 0x28], rax
lea rax, str.methodology
mov qword [rsp + 0x30], rax
mov eax, dword [rbx]
lea ecx, [rax + rax*8]
lea rax, str.virgo
shl ecx, 5
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
xor ecx, ecx
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r9, str.patio
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
mov dword [rsp + 0x58], eax
lea r8, [0x1400ee310]
lea rdx, [rsp + 0x70]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm1
lea rcx, [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
call fcn.1400db620
mov rbx, qword [rsp + 0xc0]
lea rax, str.c0a0
add rsp, 0xb0
pop rdi
ret
Function at 0x140092440
Capabilities:
Copy file
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.rainmaker
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400924a0
add ebx, eax
xor ecx, ecx
mov edx, 0x3ab
add ebx, r14d
lea r8d, [rcx + 9]
add ebx, ebp
lea edi, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [rdi + rdi*4]
mov esi, 2
lea rcx, [rsp + 0x30]
xor edx, edx
sub esi, eax
mov r8d, 0x140
sub esi, ebp
shl esi, 3
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea r8, [0x140001b00]
xor edx, edx
mov rdi, rax
movzx eax, r14b
xor ecx, ecx
imul r15b
shl al, 5
sub dil, al
xor eax, eax
sub dil, sil
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
inc dil
add dil, bpl
movsx r9, dil
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dil, r15b
jge 0x14009253b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, 0x10
jne 0x1400925a0
lea r8d, [rbx + 4]
mov edx, 0x380
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rbx - 5]
mov edx, 0x126
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rdx, str.c0a2
lea rcx, str.friday
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8d, [rbx - 9]
mov edx, 0x27e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.birthday
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140092930
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea r8, [0x140001b00]
xor r9d, r9d
mov ebx, eax
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test ebx, ebx
je 0x14009298e
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x150
pop rbx
ret