joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ea20
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x1f
xor ecx, ecx
lea r8d, [rdx - 0x1a]
mov rsi, rax
lea edi, [rax + 0x1ac]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rdx, str.pool
lea rcx, [0x1400ed4fc]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movzx ecx, bpl
shl dil, 3
shl cl, 2
imul eax, eax, 0x3a
lea edx, [rcx + rbp]
sub dl, dil
lea edi, [rbx - 9]
add dl, 6
movsx ecx, dl
mov edx, 0x104
sub ecx, eax
sub ecx, esi
add edi, ecx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov edx, 0x1ed
lea r8d, [rcx + 0xa]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 7
sub ecx, ebp
sub ecx, esi
mov dword [rsp + 0x3c], ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x17]
mov edx, 0x2e5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
shl sil, 3
sub sil, bl
sub sil, 0x5e
add sil, byte [rsp + 0x3c]
cmp sil, 0x40
jge 0x14007eba6
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.biplane
movsxd rbx, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.angora
mov r9d, 8
mov r8, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, str.c0a0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0xdc
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14007f080
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movsxd rbx, edx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed4fc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 8]
mov edx, 0x179
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 4]
mov edx, 0x201
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x35c
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x1c]
mov edx, 0x270
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 4]
mov edx, 0x319
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x180
pop rbx
ret
Function at 0x14007f1d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r15, r9
mov rbp, r8
mov r14, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, byte [rsp + 0xa0]
or r11, 0xffffffffffffffff
mov edi, eax
mov r10, r11
nop dword [rax + rax]
inc r10
cmp byte [rbx + r10], 0
jne 0x14007f210
mov rcx, qword [rsp + 0xa8]
imul r10d, esi
mov rax, r11
imul r10d, r14d
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14007f230
sub r10d, eax
mov rcx, r11
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14007f240
movzx eax, bpl
imul cl
mov rcx, qword [rsp + 0xb0]
movzx edx, al
nop word [rax + rax]
inc r11
cmp byte [rcx + r11], 0
jne 0x14007f260
movzx eax, r15b
mov r9d, esi
mov r8, rbx
imul r11b
sub dl, al
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], edi
movzx ecx, dl
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r10d
mov rdx, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, str.cultivar
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
mov edx, 0x327
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x34f
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r11, [rsp + 0x60]
lea rax, [0x1400ee018]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14007fd20
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx ebx, byte [rcx + 8]
movzx edi, byte [rcx + 0x28]
xor eax, eax
mov r13, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
mov r12d, edi
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
sub r12d, ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.c0a2
lea r15d, [rax + 9]
mov qword [rsp + 0x40], rax
add r15b, sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [r13 + 0x10]
imul ebp, edi
xor edx, edx
xor ecx, ecx
imul ebp, esi
add ebp, 4
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
imul sil
movzx r14d, al
shl r14b, 2
sub r14b, byte [rsp + 0x38]
add r14b, byte [rsp + 0x48]
cmp r15b, bl
jne 0x14007fe08
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ecx, dword [r13 + 0x18]
movzx eax, bl
imul edi, eax
shl edi, 3
lea eax, [rsi + rsi*2]
sub ecx, edi
add ecx, eax
movsx rax, r14b
sub ecx, eax
movsx rax, byte [rsp + 0x30]
add ecx, eax
movsx rax, r15b
add ecx, eax
lea eax, [r12 - 9]
sub ecx, dword [rsp + 0x38]
add ecx, dword [rsp + 0x40]
add ecx, ebp
add eax, ecx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400808a0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov ebx, edx
mov r15, rcx
mov qword [rsp + 0x30], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x48], rax
test ebx, ebx
jne 0x140080950
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.motel
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rdx, str.motel
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [rbx + 0x20]
lea r8d, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x2f9
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ebp, [r15 - 4]
mov r13, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0x11]
mov edx, 0x11e
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, edi
lea edi, [rbp + 5]
mov r12, rax
mov rax, qword [rsp + 0x38]
imul esi, ebx
lea ecx, [rax*8]
xor eax, eax
lea edi, [rsi + rdi*4]
add edi, r15d
sub r15d, ecx
mov qword [rsp + 0x28], rax
add r15d, 2
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
movsxd r9, r15d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x2a9
lea r8d, [rcx + 1]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x1bb
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
imul r14d, ebp
imul eax, edi, 0xfffffffa
sub eax, r14d
sub eax, esi
sub eax, r13d
sub eax, dword [rsp + 0x48]
add eax, dword [rsp + 0x30]
add eax, r12d
add eax, ebx
add eax, dword [rsp + 0x40]
add eax, r15d
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140080a90
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsxd rdi, ecx
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov r9, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx eax, bl
cmp edi, eax
jle 0x140080b3d
xor ecx, ecx
mov edx, 0x3d8
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0xdb
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.pajamas
lea rcx, str.pajamas
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x177
lea r8d, [rcx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, str.c5ret
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x140080cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.vixen
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x1e5
mov r8d, 0x1d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x1cd
mov r8d, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x390
mov r8d, 0x16
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov edx, 0x10a
mov r8d, 0x1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x170
pop rbx
ret
Function at 0x140080df0
Capabilities:
Copy file
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x158
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r15d, dword [rcx + 0x10]
mov rsi, r9
mov r14, r8
add r15d, edx
or rdi, 0xffffffffffffffff
mov r12, rdx
mov rbx, rdi
mov r13, rcx
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140080e30
add bl, byte [rcx + 8]
movzx ebp, r15b
xor ecx, ecx
shl bpl, 4
add bl, dl
add bpl, dl
movzx eax, bl
add bpl, bl
cmp r15d, eax
jb 0x140080e8f
mov qword [rsp + 0x28], rcx
lea r9d, [rcx + 0x40]
lea r8, [0x140001b00]
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp bpl, r15b
jb 0x140080ea3
mov r8d, r15d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp bl, r15b
jae 0x140080f34
xor eax, eax
lea r8, [0x140001b00]
movzx r9d, bpl
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.terrapin
mov r8d, r15d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0x13b
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x382
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0xb1
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140080f40
sub bl, cl
movzx eax, r12b
inc bl
imul bl
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140080f54
shl dil, 3
sub bpl, 0x1d
sub al, dil
add al, r15b
add al, bpl
add al, byte [r13]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140080fa0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
movzx edi, cl
mov rsi, r9
mov rbx, rdx
sub dil, byte [r8]
movzx ebp, cl
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x12]
mov edx, 0x27d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea eax, [rsi + rbp]
cmp dil, al
jle 0x14008104f
movsx ecx, bpl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x20
xor ecx, ecx
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret

Function at 0x140081090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.misogyny
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0xf2
lea r8d, [rcx + 0x19]
lea ebx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, ebx
sub esi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
lea edi, [rax - 0xa]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x32f
lea r8d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 8
lea ecx, [rbx + 8]
lea r8, [0x1400ed3b8]
lea rdx, str.couch
mov r9d, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8, [0x140001b00]
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.c1a3
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400814d0
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
mov qword [rsp + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r13d, r13d
movsx r14, dil
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov r9, r14
mov qword [rsp + 0x28], r13
mov esi, eax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp bl, dil
je 0x14008157d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov ecx, ebx
movzx r9d, bl
movsx edx, dil
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], edx
lea rdx, str.pressure
lea r8, str.c1ret
mov ecx, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r9d
call qword [sym.imp.USER32.dll_CreateWindowExA]
imul eax, r15d, 0xb
lea edi, [r12*4]
movzx ebp, bl
sub edi, eax
sub edi, ebp
sub edi, r14d
add edi, ebx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebp
lea r8, str.hovercraft
lea rdx, str.pressure
mov r9d, esi
mov ecx, ebp
mov dword [rsp + 0x28], ebx
mov r12, rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [r12 + r12*4]
mov r13d, edi
sub r13d, eax
cmp esi, ebx
ja 0x140081605
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
lea r8, [0x140001b00]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xc0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.methodology
mov qword [rsp + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0xb0], eax
cmp edi, 0x20
jg 0x140081681
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov eax, dword [rsp + 0xb0]
movzx eax, al
lea r8d, [r14 + r14*4]
lea edx, [r15 + r15*4]
add r8d, r8d
lea ecx, [rbp*4 + 3]
imul eax, r15d
add ecx, r13d
shl ecx, 3
sub r8d, ecx
sub r8d, eax
mov eax, edx
imul eax, edi
sub r8d, eax
sub r8d, edx
sub r8d, dword [rsp + 0xb8]
sub r8d, esi
add r8d, dword [rsp + 0xc0]
lea eax, [r12 + r8]
add eax, r15d
add eax, dword [rsp + 0xc8]
add eax, ebx
add eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret