joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c050
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
movzx ebp, r8b
mov qword [r11 - 0x38], r15
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
lea r8, [0x140001b00]
mov r9d, ebp
xor edx, edx
mov rsi, rax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0xe]
mov edx, 0x178
mov r13, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r15, rax
cmp bpl, r14b
jne 0x14007c1c8
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov qword [rsp + 0x1a8], r12
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdx, qword [rdi + 8]
or rcx, 0xffffffffffffffff
mov rdi, rcx
movzx r12d, bpl
inc rdi
cmp byte [rdx + rdi], 0
jne 0x14007c115
mov rdx, qword [rsp + 0x68]
lea eax, [rsi + rsi]
sub eax, r13d
add eax, 0xfffffffd
add eax, r12d
add eax, r15d
add eax, edx
add edi, eax
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14007c136
movzx eax, bpl
add r15b, r15b
add r15b, dl
imul cl
movzx ecx, al
movzx eax, sil
add r15b, r15b
imul cl
movzx ecx, al
movzx eax, r14b
imul cl
mov rcx, qword [rsp + 0x60]
sub al, r15b
sub al, 9
add al, byte [rcx + 0x10]
movzx ebx, al
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
movzx eax, r14b
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
movzx ecx, bpl
lea r8, str.c0a3
lea rdx, [0x1400ed3f4]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov r9d, r12d
mov ecx, ebx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r12, qword [rsp + 0x1a8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, qword [rsp + 0x190]
mov r13, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1e8]
cmp bpl, r14b
mov r14, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x1b8]
je 0x14007c25f
xor ecx, ecx
mov edx, 0x345
lea r8d, [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
mov edx, 0x26f
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x199
lea r8d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, rsi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c0
pop rsi
ret
Function at 0x14007c360
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x30
movsxd rbx, edx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9, rbx
xor ebx, ebx
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r9d, [rbx + 0x20]
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea r8d, [rbx + 0x12]
mov edx, 0x1cd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [rbx + 0x17]
mov edx, 0xe5
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_FindResourceA]
Function at 0x14007c440
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rcx
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbp, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edi, [rax + 7]
mov r14, rax
imul edx, ebx, 0xe
add edx, ebp
add edi, edx
cmp dil, 5
jne 0x14007c4d7
xor ecx, ecx
mov edx, 0x2b8
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp dil, 5
jge 0x14007c501
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsi], rax
lea eax, [rbx*2 + 2]
imul ecx, ebp, 0xfffffff3
sub ecx, eax
imul eax, r14d, 7
add ecx, eax
lea eax, [rdi + rdi*4]
sub ecx, eax
mov dword [rsi + 8], ecx
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
lea r8d, [rcx + 6]
mov edx, 0x1a2
mov qword [rsi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, str.c0a5
mov qword [rsi + 0x18], rax
lea rax, str.baobab
mov qword [rsi + 0x20], rcx
mov qword [rsi + 0x28], rax
mov rax, rsi
mov qword [rsi + 0x30], rcx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14007c5a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov rsi, r9
mov r14, r8
movzx ebp, dl
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
lea rax, str.panties
mov qword [rdi], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rcx, 0xffffffffffffffff
mov qword [rdi + 8], rax
lea rax, str.painting
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14007c620
mov r10d, dword [rsp + 0x98]
mov r8d, dword [rsp + 0x90]
movzx edx, bpl
movzx eax, r10b
movzx r9d, bpl
imul esi, r8d
imul r8b
imul r9d, r14d
sub dl, al
movzx eax, dl
lea edx, [rax + rax*4]
lea eax, [rbx + 0x40]
sub r9d, edx
movsx rdx, al
lea eax, [r10 - 0x40]
sub r9d, edx
add r9d, esi
sub r9d, ebx
sub r9d, r15d
add eax, r9d
add ecx, eax
mov rax, rdi
mov dword [rdi + 0x10], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x14007c6b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rdx
movsxd rbp, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, [rsp + 0x60]
mov esi, ebp
xor edx, edx
mov r8d, 0x140
mov r14d, eax
sub esi, eax
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.prompt
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor r13d, r13d
lea r8, [0x140001b00]
movsxd r9, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov r15, rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
cmp ebp, 0x20
jle 0x14007c778
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8d, [r13 + 0x13]
mov edx, 0x388
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov edx, 0x264
lea r8d, [rcx + 0x11]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xee
lea r8d, [rcx + 0xd]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx eax, r14b
imul sil
movzx ecx, al
movzx eax, bl
movzx ebx, bpl
imul cl
sub bl, al
add bl, 0x19
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], 7
mov dword [rsp + 0x38], ebp
movzx eax, bl
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
lea r8, str.c1a3
lea rdx, str.economics
mov r9d, ebp
mov ecx, r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
lea r8d, [rcx + 0x1d]
mov edx, 0x146
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [rsp + 0x30], r14d
xor r9d, r9d
mov r8, r15
mov rdx, r15
mov rcx, r12
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
mov edx, 0xe2
lea r8d, [rcx + 9]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007c8b0
Capabilities:
Copy file
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov r15, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x290]
movzx edi, cl
mov r14d, edi
mov r12, r9
mov esi, edx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x14007c8f3
mov ebp, dword [r8 + 8]
lea rcx, [rsp + 0x98]
lea r8, [0x1400ee018]
xor edx, edx
imul ebp, r14d
sub ebp, eax
mov r9d, ebp
call fcn.1400dab70
lea rcx, [rsp + 0xd0]
mov edx, 0x104
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x70], xmm1
movsd xmm1, qword [rax + 0x30]
movups xmmword [rsp + 0x80], xmm0
movsd qword [rsp + 0x90], xmm1
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xd0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub dil, byte [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov edx, 0x2d8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0x20
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, 2
je 0x14007ca16
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0xa
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, [0x1400ee310]
lea rcx, [0x1400ee018]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor ecx, ecx
movzx eax, dil
lea r8, [0x1400ee018]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 2
mov dword [rsp + 0x38], ebp
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea rdx, [0x1400edfe8]
mov ecx, r14d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x220
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007ca90
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movzx r14d, cl
lea r12d, [rdx - 8]
xor ecx, ecx
mov rbp, rdx
lea r8d, [rcx + 0x1b]
mov edx, 0x123
add r12d, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x249
lea r8d, [rcx + 8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
shl esi, 4
mov r13, rax
imul ecx, ebp, 0x38
sub ecx, esi
movzx ebp, dil
lea esi, [r14 + rcx]
mov edi, 4
add esi, 0xd
add esi, r15d
mov ecx, esi
shl ecx, 4
sub edi, ecx
sub edi, ebp
test esi, esi
jne 0x14007cc50
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor eax, eax
lea r9d, [rsi + 0x20]
mov qword [rsp + 0x28], rax
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsx ecx, bl
lea ebx, [rsi - 0x10]
lea r8d, [rsi + 0x1c]
mov edx, 0x32d
imul ecx, eax
lea eax, [r15 + r15*2]
add ecx, eax
lea eax, [r12 + r12*4]
add ecx, eax
sub ecx, r13d
add ecx, ebp
add ecx, r14d
add ebx, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [rsi + 0x1c]
lea r8d, [rsi + 0x13]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r8d, [rsi + 6]
mov edx, 0x123
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, str.washtub
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea rdx, str.c5a0
mov r9d, ebx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea r8d, [rsi + 0xd]
mov edx, 0x312
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.rack
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x1fa
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x200]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007d210
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov byte [rsp + 0x30], r8b
mov r12d, edx
mov r13, rcx
cmp edx, r9d
jb 0x14007d267
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov rbx, rax
xor eax, eax
mov r9, r12
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, r14d
sub esi, eax
mov rbp, rax
sub esi, 4
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx eax, byte [rsp + 0x30]
add r15b, r15b
sub r15b, 4
imul r12b
shl r15b, 3
sub r15b, al
movzx eax, bpl
shl al, 2
lea ecx, [rax + rbp]
mov al, 7
sub r15b, cl
imul bl
add r15b, al
movzx eax, r13b
add al, al
add al, r13b
sub r13b, 5
shl al, 2
add al, r15b
sub al, sil
sub al, r14b
add al, dil
add al, bpl
add al, r13b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007dc80
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x158
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, qword [rsp + 0x1c0]
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov esi, r9d
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
or rdx, 0xffffffffffffffff
mov rcx, rdx
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14007dcd6
nop
inc rdx
cmp byte [rdi + rdx], 0
jne 0x14007dce0
imul ecx, edx
xor edi, edi
lea ebx, [r15 + 4]
imul ecx, esi
lea r8, [0x140001b00]
mov r9, rsi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
imul ecx, ebp
add ecx, r14d
add ebx, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [0x140001b00]
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8d, [rdi + 0x11]
mov edx, 0x2b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x158
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007e400
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
movzx ebx, dl
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
add esi, 3
mov ebp, ebx
mov dword [rsp + 0x34], ebx
mov r12, rax
add esi, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor eax, eax
lea r8, [0x140001b00]
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0xdd
mov rdi, rax
lea r8d, [rcx + 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebp
imul ebx, r14d
mov r13, rax
imul ecx, dword [rsp + 0x30]
sub ebx, ecx
sub ebx, eax
sub ebx, edi
add ebx, 4
mov qword [rsp + 0x38], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [r13 + 1]
imul r12d, dword [rsp + 0x30]
imul edi, esi
lea ecx, [rdi + rdi*8]
imul eax, r12d, 0xfffffffa
imul edx, r15d
add edx, 0xffffffe7
lea ebp, [rcx + rdx*4]
sub ebp, dword [rsp + 0x30]
add ebp, ebx
imul ebx, r15d
imul ebx, r15d
shl ebx, 4
sub eax, ebx
sub eax, dword [rsp + 0x34]
lea ebx, [rax + rbp]
add ebx, 0xa
add ebx, r13d
add ebx, r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x3f
lea r8d, [rdx - 0x32]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
sub edi, ebx
lea ecx, [r15 + 8]
add ecx, eax
mov esi, 4
sub esi, ecx
lea ecx, [rdi + rdi*8]
imul esi, r15d
add esi, ecx
sub esi, eax
sub esi, ebp
sub esi, r13d
sub esi, dword [rsp + 0x38]
xor ecx, ecx
mov edx, 0x2ec
sub esi, dword [rsp + 0x34]
lea r8d, [rcx + 4]
sub esi, 8
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movsxd r9, dword [rsp + 0x30]
lea rdx, str.gazebo
movsxd r8, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.stranger
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret