joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066520
Capabilities:
Copy file
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x1a5
mov rcx, rax
movzx eax, bl
mov r8d, 0xc
imul cl
xor ecx, ecx
movzx ebx, al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, 0x104
mov r8d, 0xf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
test bl, bl
jne 0x1400665b9
mov edx, 0x1ba
mov r8d, 0x1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x272
mov r8d, 0x18
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.glue
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x4c
xor ecx, ecx
lea r8d, [rdx - 0x35]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rdx, str.c0a6
lea rcx, str.cloister
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.c0a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.inspector
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
Function at 0x1400666b0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
or rdi, 0xffffffffffffffff
mov rbx, rcx
mov rbp, rdi
nop word [rax + rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x1400666e0
mov rsi, rdi
nop dword [rax]
inc rsi
cmp byte [rcx + rsi], 0
jne 0x1400666f0
movzx r15d, dl
cmp esi, r15d
je 0x140066883
mov qword [rsp + 0x1d0], r12
mov qword [rsp + 0x188], r13
mov rcx, rdi
mov qword [rsp + 0x180], r14
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140066721
movzx eax, bpl
imul cl
movzx ecx, al
movzx eax, dl
imul cl
movzx r13d, al
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r8, [0x140001b00]
mov r12, rax
xor eax, eax
mov r9d, ebp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
mov r14, rdi
mov r9d, eax
inc r14
cmp byte [rbx + r14], 0
jne 0x140066775
mov eax, esi
sub eax, r12d
sub eax, 0x28
add r14d, eax
nop word [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140066790
movzx eax, r12b
xor r12d, r12d
lea r8, str.paper
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
imul r9b
movzx ecx, al
mov al, 0x3c
mov rdx, rbx
imul cl
sub al, r13b
movzx ecx, r13b
add al, 5
add dil, al
mov eax, r14d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, str.cloister
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
movsx edx, dil
movsx rax, dil
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edx
lea rdx, str.peer_to_peer
lea r8, str.paper
mov r9d, r15d
mov ecx, r14d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov r14, qword [rsp + 0x180]
mov r13, qword [rsp + 0x188]
mov r12, qword [rsp + 0x1d0]
lea rax, str.c0ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x190
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140068070
Capabilities:
Create thread
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movsx r14d, byte [rsp + 0x238]
mov ebp, dword [rsp + 0x240]
mov edi, r9d
mov qword [rsp + 0x60], r8
mov r12, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, r15d
sub esi, r14d
add esi, edi
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13, rax
cmp esi, edi
jne 0x1400681b7
mov r8, qword [rsp + 0x60]
xor eax, eax
movsx rbx, r14b
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
lea rdx, str.psychoanalyst
mov r9d, esi
mov ecx, esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 0x1b]
mov edx, 0x271
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
lea r8d, [rcx + 0x15]
mov edx, 0x164
call qword [sym.imp.KERNEL32.dll_FindResourceA]
movzx ebx, dil
sub bl, r12b
sub bl, r14b
sub bl, r13b
add bl, 0x1a
add bl, r15b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp edi, ebp
jbe 0x14006820f
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.psychoanalyst
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0xf]
mov edx, 0x166
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
movsx edx, bl
lea r8, [0x1400ed4fc]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edx
lea rdx, str.hydrogen
mov r9d, edi
mov ecx, edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140068790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x28], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov esi, eax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ebp, 0xfffffffc
mov r14, rax
sub ebp, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r13, rax
mov edx, 0x6c
mov al, 0xfb
lea r8d, [rdx - 0x55]
xor ecx, ecx
imul sil
mov byte [rsp + 0x20], al
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, 0x51
lea r8d, [rdx - 0x3a]
xor ecx, ecx
mov r15, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x30], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, str.c0ret
mov rdi, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov r15, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x50], rax
imul r15d, eax
test esi, esi
jne 0x140068892
lea r8d, [rsi + 0xa]
mov edx, 0x111
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
imul ebx, esi
lea rcx, [rsp + 0x60]
lea ebx, [rbx + rbx*4]
xor edx, edx
mov r8d, 0x140
sub ebx, edi
movzx edi, sil
mov r12, rax
shl dil, 4
sub ebx, r13d
sub dil, al
sub ebx, r14d
shl dil, 2
sub ebx, ebp
sub dil, bpl
add ebx, 8
add dil, 0x15
add dil, byte [rsp + 0x30]
add dil, r14b
add dil, byte [rsp + 0x28]
call fcn.1400e27d0
lea rdx, [rsp + 0x60]
lea rcx, str.c0ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
cmp r15b, 2
jae 0x140068916
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx eax, byte [rsp + 0x38]
add bl, bpl
sub r12b, 0x25
shl bl, 2
imul byte [rsp + 0x50]
sub bl, al
movzx eax, dil
imul byte [rsp + 0x28]
sub bl, al
movzx eax, r14b
imul sil
add al, bl
sub al, byte [rsp + 0x40]
sub al, r13b
sub al, byte [rsp + 0x20]
add al, byte [rsp + 0x48]
add al, r15b
add al, r12b
add al, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140068990
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, r8
mov r12d, ecx
mov r9d, ecx
xor ecx, ecx
mov rbp, rdx
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rcx
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or rbx, 0xffffffffffffffff
mov r13d, eax
mov rdi, rbx
nop word [rax + rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400689f0
add edi, r15d
mov rcx, rbx
add edi, r12d
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140068a02
imul ecx, r12d
mov r14d, r15d
mov rax, rbx
imul r14d, r13d
add r14d, 6
add r14d, ecx
mov rcx, qword [rsp + 0xb8]
mov rcx, qword [rcx + 0x20]
lea r14d, [r14 + rdi*2]
inc rax
cmp byte [rcx + rax], 0
jne 0x140068a30
sub r14d, eax
mov rax, rbx
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140068a40
xor ecx, ecx
mov edx, 0x338
add r14d, eax
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xaa
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, str.helium
lea rdx, str.helium
mov qword [rsp + 0x60], rax
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], 6
mov ecx, r15d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
lea r8, str.border
lea rdx, str.helium
mov r9d, r13d
mov ecx, r12d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 6
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140068b10
lea eax, [rax + rax*4]
imul edi, r13d
imul r15d, r15d
add eax, eax
imul edx, edi, 0xfffffff8
sub edx, r15d
sub edx, eax
lea eax, [r14 + r14*2]
add eax, eax
sub edx, eax
mov rax, qword [rsp + 0xb8]
add edx, dword [rax + 8]
mov rax, rbx
add edx, dword [rsp + 0x60]
add edx, r12d
sub edx, ecx
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140068b50
add edx, eax
mov rax, qword [rsp + 0xc0]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140068b63
lea r11, [rsp + 0x70]
lea eax, [rdx + 0x2e]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
add eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140068b90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov r15d, dword [rsp + 0x260]
movzx eax, cl
mov rdi, r9
mov r14, r8
mov r12, rdx
mov esi, eax
cmp r15d, eax
jbe 0x140068c13
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x6a
xor ecx, ecx
lea r8d, [rdx - 0x58]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rdx, str.march
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov r8d, esi
call fcn.1400dac60
or rbx, 0xffffffffffffffff
mov rcx, rbx
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140068c31
lea eax, [r15*4]
mov ebp, esi
mov rdx, r12
imul ebp, r12d
sub ebp, eax
sub ebp, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
cmp ebp, esi
jb 0x140068cd8
xor eax, eax
lea r8, [0x140001b00]
mov r9, r15
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov eax, ebp
lea r8, [0x1400ee168]
lea rdx, [0x1400ee168]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov r9d, ebp
mov ecx, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140068ce0
movzx eax, r12b
imul cl
movzx ecx, al
mov al, 0xfb
imul r15b
sub al, cl
sub al, r13b
add al, bpl
add al, sil
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140068d03
sub al, bl
add al, 7
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069a60
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov edi, edx
xor r15d, r15d
mov r14, r8
mov rbp, rdx
mov rsi, rcx
imul edi, r8d
cmp dl, dil
je 0x140069c0b
lea rcx, str.cottage
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea edx, [r15 + 0xa]
lea r8d, [r15 + 0x10]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov al, 0x42
imul bl
movzx ebx, al
sub bl, dil
add bl, 2
add bl, r14b
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea r9d, [r15 + 4]
mov edx, 0x763
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r8, [0x140001b00]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
movsx edx, bpl
movzx ecx, bl
movzx eax, bl
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edx
lea rdx, [0x1400edccc]
lea r8, str.midi
mov r9d, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rdx, [0x1400edccc]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LockResource]
lea r8d, [r15 + 4]
mov edx, 0xb7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, [0x1400edccc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
lea r8d, [r15 + 8]
mov edx, 0xf9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
mov edx, 0x1eb
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
lea r8d, [rcx + 2]
mov edx, 0x95
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsi], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx ecx, bpl
mov qword [rsi + 8], rax
mov eax, edi
mov qword [rsi + 0x10], r15
sub eax, ecx
sub eax, edi
add eax, 0xb
add eax, ebx
mov dword [rsi + 0x18], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsi + 0x20], rax
mov rax, rsi
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069ca0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
movzx esi, r8b
lea rcx, [rsp + 0x1b0]
mov edx, 0x104
mov r12d, r9d
mov rdi, r8
neg sil
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r14, rax
movzx eax, sil
imul r14b
movzx ebx, al
add al, al
add bl, al
add bl, bl
sub bl, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
lea rcx, str.gender
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, dword [rsp + 0x330]
mov ecx, 1
movsx r8d, sil
movsx r15d, bl
add r13d, 4
sub ecx, r15d
mov ebp, r8d
lea rdx, str.gender
imul ecx, edi
add ecx, r14d
imul ebp, r14d
add r13d, ecx
lea rcx, str.gender
sub ebp, edi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rsp + 0x60], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
cmp sil, bl
je 0x140069e02
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.gender
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edx, edx
lea r8, str.c7a2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov rcx, rax
movzx eax, dil
lea rdx, str.c7a2
mov r9d, r12d
imul dil
lea ebx, [rax + 2]
movsxd rax, r13d
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], ecx
add bl, bl
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r15d
sub bl, byte [rsp + 0x68]
mov dword [rsp + 0x20], eax
sub bl, sil
add bl, r14b
call qword [sym.imp.USER32.dll_CreateWindowExA]
movsx ecx, bl
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, str.c1a0
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rax, rdi
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069e70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
mov qword [rsp + 0x70], rax
mov eax, 0xc
sub eax, ebp
lea r8, [0x140001b00]
xor edx, edx
mov dword [rsp + 0x60], eax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 4]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 1]
mov edx, 0x310
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea ecx, [rbx + r15]
lea edx, [rbp*2]
lea ecx, [rcx + r15*4]
add edx, ebp
mov rsi, rax
lea ebx, [rdx*4 - 0x11]
add ebx, ecx
mov ecx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
mov r9d, 0xfffffff4
mov r13d, edi
mov r12d, eax
xor eax, eax
lea r8, str.c2a0
imul r13d, r15d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
imul r12d, ebx
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], 6
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov r14d, r12d
lea rdx, [0x1400ed4d4]
sub r14d, ebp
mov ecx, r9d
mov dword [rsp + 0x20], ebx
add r14d, 0xfffffffd
add r14d, r13d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r8d, dword [rsp + 0x60]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
lea ecx, [rdi + rdi*2]
shl ecx, 4
mov rbp, rax
movzx eax, sil
lea edx, [r10 + r10]
lea ebx, [r9 - 3]
lea edi, [r9 + 0x5b]
imul r14b
sub edx, ecx
shl bl, 2
movzx ecx, al
shl cl, 3
sub edx, r8d
add al, cl
add edx, r14d
lea rcx, [rsp + 0x80]
sub bl, al
add edi, edx
sub bl, r10b
sub bl, r15b
add bl, r8b
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x80]
lea rcx, str.c1a2
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edx, [r14 + 1]
imul ebp, edi
imul edx, dword [rsp + 0x68]
movsx rcx, bl
imul r8d, ecx, 0xfffffffb
sub r8d, edx
sub r8d, ebp
sub r8d, r12d
sub r8d, eax
mov rax, qword [rsp + 0x70]
add eax, 0x3d
add r8d, r13d
add eax, r8d
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret