joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096a00
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp ecx, 0x31
je 0x140096af9
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.anywhere
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.trust
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, 0x312
mov r8d, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, 0x160
mov r8d, 0x12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
ret
Function at 0x140096b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov edi, r9d
movzx ebx, dl
mov r13, rcx
cmp dl, r9b
je 0x140096b8a
mov edx, 0x57
xor ecx, ecx
lea r8d, [rdx - 0x51]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x1c
xor ecx, ecx
lea r8d, [rdx - 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [r13 + 5]
movsx ecx, al
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x300
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ecx, bl
lea ebp, [r13 + 6]
sub ecx, edi
mov r12, rax
add ebp, ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0xca
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ebx, [r13*4]
lea rcx, str.cicada
add ebx, r13d
mov rsi, rax
sub ebx, edi
sub ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rsi
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
lea r8d, [rcx + 0x10]
mov edx, 0x2aa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ecx, r12b
mov rdx, rax
add cl, cl
mov al, 7
add r12b, cl
sub r12b, bl
mov rbx, qword [rsp + 0x60]
imul bpl
sub r12b, 2
add r12b, r12b
sub r12b, al
movzx eax, dil
add r12b, sil
add r12b, r12b
imul dl
add r12b, al
movzx eax, byte [rsp + 0x68]
imul r13b
movzx ecx, al
shl cl, 2
add al, cl
add r12b, al
movzx eax, r14b
add al, al
add r14b, al
sub r12b, r14b
sub r12b, r15b
add r12b, byte [rsp + 0x78]
movzx eax, r12b
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140096c90
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movzx r14d, byte [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1e8]
mov rdi, r9
mov r13, r8
mov r15, rcx
cmp r14b, byte [rsp + 0x1f0]
jae 0x140096cf4
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140096d00
movzx eax, r15b
mov edx, 0x104
imul cl
lea rcx, [rsp + 0x60]
lea ebp, [rsi + rax]
movzx r12d, bpl
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140096d26
imul ebx, r13d
movzx esi, r14b
imul esi, r12d
lea eax, [r15 + rbx]
add esi, eax
cmp r14b, bpl
ja 0x140096e2e
xor ebx, ebx
lea r8, [0x140001b00]
mov r9, r12
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8d, [rbx + 0x18]
mov edx, 0x29f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movzx r9d, r14b
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 2
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], esi
lea rdx, str.eight
lea ecx, [rbx + 0x40]
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rbx + 3]
mov edx, 0x2b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [rbx + 9]
mov edx, 0x319
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x235
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140097540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movzx ebp, dl
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea esi, [r15 + 7]
movsx rbx, ax
movsx rdi, bl
mov ecx, edi
sub ecx, r14d
add esi, ecx
lea rcx, str.bloom
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
movsx eax, bl
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebp
lea r8, str.clove
lea rdx, str.bloom
mov r9d, r14d
mov ecx, esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x3de
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x342
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rax, r15
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140097660
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x38], rcx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r14, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
lea r8d, [rcx + 0x17]
mov edx, 0x12e
mov rbp, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
shl ebp, 6
mov rsi, rax
add eax, 0x49
add ebp, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
mov rdi, rax
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.cash
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rdx, str.contribution
lea rcx, str.c1ret
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x40]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8, qword [rsp + 0x38]
add bpl, sil
shl bpl, 6
movzx eax, r15b
imul r14b
movzx ecx, al
mov al, 0xe7
imul cl
movzx edx, al
movzx eax, dil
sub dl, bpl
imul bl
movzx ecx, al
movzx eax, r8b
imul cl
mov rcx, qword [rsp + 0x40]
sub dl, al
movzx eax, r12b
add al, al
add r12b, al
mov al, 7
shl r12b, 2
sub dl, r12b
imul cl
add al, dl
sub al, r13b
sub al, cl
add al, 0xb
add al, byte [rsp + 0x30]
add al, r8b
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140097e10
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov ebp, dword [r8 + 0x38]
movsxd rsi, ecx
mov r15, rdx
lea rcx, [rsp + 0x1a0]
mov rdi, r9
mov rbx, r8
imul ebp, edx
imul ebp, esi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor r13d, r13d
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
movzx eax, sil
mov edx, 0x104
imul byte [rbx + 0x20]
movzx ecx, al
movzx eax, r15b
imul cl
lea rcx, [rsp + 0x1a0]
movzx ebx, al
sub bl, dil
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdi, rax
cmp bl, sil
jl 0x140097ef2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea r8d, [r13 + 0x14]
mov edx, 0x122
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8d, [r13 + 9]
mov edx, 0x260
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsx eax, bl
imul eax, esi
imul eax, edi
lea r14d, [rax + rax*2]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
imul r12d, edi
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov eax, r14d
mov ebx, r15d
lea r8, [0x1400ee0dc]
mov qword [rsp + 0x40], rax
sub ebx, r12d
lea rdx, str.c0ret
add ebx, esi
mov r9d, esi
mov ecx, r14d
add ebx, ebp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebp, ebx
jle 0x140097f93
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c4a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp r14d, edi
jb 0x140097f9e
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rax, rdi
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140098310
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8, [0x140001b00]
xor edx, edx
movzx r9d, al
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor r8d, r8d
mov edx, 0x3c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x188
ret

Function at 0x140098400
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [rsp + 0x1a8]
mov r10d, edx
lea r12d, [rcx - 8]
imul r10d, r8d
mov rsi, rdx
mov rdi, rcx
imul eax, dword [rsp + 0x1a0]
sub r10d, eax
lea rdx, str.november
lea rcx, str.november
mov rbx, r9
mov ebp, r8d
add r12d, r10d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
mov edx, 0xaf
lea r8d, [rcx + 8]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x20], rax
cmp ebp, 0x20
jge 0x1400984d2
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.c1ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rax, qword [rsp + 0x20]
imul ebx, dword [rsp + 0x1a8]
imul eax, eax, 7
imul ebx, dword [rsp + 0x1a0]
sub ebx, 0x20
shl ebx, 5
sub ebx, eax
sub ebx, esi
sub ebx, ebp
sub ebx, r13d
sub ebx, r12d
lea eax, [rdi + rbx]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098790
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edi, [rsi + rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
sub dil, al
movzx eax, dil
cmp esi, eax
jae 0x140098829
mov eax, esi
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
imul eax, esi
movsxd r9, eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.wrist
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp dil, sil
ja 0x140098844
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, rbx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140098880
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
lea r8, [0x140001b00]
xor edx, edx
lea r9d, [rbx + 8]
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8d, [rbx + 0x1b]
mov edx, 0x18e
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [0x1400ee230]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r9d, [rbp - 0x33]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r9d, [rbx + 8]
lea r8, [0x1400ee230]
lea rdx, str.bookend
mov ecx, r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9d, [rbx + 8]
lea r8d, [rbx + 0x20]
lea rdx, str.c6a1
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
shl r12d, 7
lea r11, [rsp + 0x60]
dec r12d
imul edi, r15d
imul eax, ebx
mov rbx, qword [r11 + 0x20]
imul eax, eax, 0x31
lea ecx, [r14 + 0x158]
imul r12d, ebp
mov rbp, qword [r11 + 0x28]
lea edx, [rcx + rcx*2]
sub r12d, edx
add eax, r12d
add eax, edi
mov rdi, qword [r11 + 0x38]
sub eax, esi
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400989f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx esi, dl
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
movzx eax, sil
imul dil
movzx r14d, al
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r8, rax
movzx eax, r14b
imul r8b
movzx ecx, al
add cl, cl
lea ebp, [rcx + rax]
shl bpl, 5
sub bpl, bl
add bpl, dil
test sil, sil
jle 0x140098a93
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, 0x51
lea r8d, [rdx - 0x39]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
test bpl, bpl
je 0x140098af7
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx ecx, r14b
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
mov edx, 0x315
lea r8d, [rcx + 0x1a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, str.c10ret
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140099050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea eax, [r8*4]
mov ebx, ecx
mov rdi, r8
sub ebx, eax
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
sub esi, edi
add ebx, 5
add esi, 8
add ebx, esi
cmp esi, ebx
jne 0x1400990b8
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
cmp esi, ebx
jl 0x1400990db
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x3b6
lea r8d, [rcx + 0x16]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x50]
lea rcx, str.c6a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rax, [0x1400ed3f4]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret