joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1ca0
Capabilities:
Check for time delay via gettickcount
Create thread
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov r12d, r9d
mov dword [rsp + 0x34], r9d
mov r15, r8
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetActiveWindow]
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
mov rbp, rsi
nop
inc rbp
cmp byte [rdi + rbp], 0
jne 0x1400a1cf0
imul ebp, r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14, rsi
mov dword [rsp + 0x30], eax
nop word [rax + rax]
inc r14
cmp byte [rdi + r14], 0
jne 0x1400a1d10
lea rcx, str.aftershave
imul r14d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rsi
mov r13, rax
nop dword [rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400a1d40
mov eax, r15d
imul eax, r12d
lea ecx, [rax + rax*4]
add ecx, ecx
sub ecx, ebx
lea ebx, [rcx + 3]
add ebx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r15, rsi
mov r12, rax
nop dword [rax + rax]
inc r15
cmp byte [rdi + r15], 0
jne 0x1400a1d70
mov eax, dword [rsp + 0x38]
mov ecx, 0x2c
imul eax, ebp
sub ecx, eax
sub ecx, ebx
add r15d, ecx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rdx, rsi
nop dword [rax + rax]
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400a1da0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
lea eax, [r15 + r15]
sub r12d, eax
mov eax, r13d
add r12d, r12d
imul eax, r14d
sub r12d, eax
mov eax, r9d
imul eax, ebx
lea eax, [rax + rax*4]
add r12d, eax
mov eax, dword [rsp + 0x30]
sub r12d, r8d
sub r12d, eax
add edx, r12d
inc rsi
cmp byte [rdi + rsi], 0
jne 0x1400a1de0
imul esi, dword [rsp + 0x34]
imul r13d, eax
lea ebx, [rbp + 2]
lea eax, [r13*4]
add eax, r13d
lea ecx, [rsi + rax*2]
lea eax, [r9 + r9*2]
add ecx, eax
sub ecx, edx
add ecx, r8d
add ecx, r15d
add ebx, ecx
cmp edx, 2
ja 0x1400a1e44
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400ed3f4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor eax, eax
lea r8, [0x140001b00]
mov qword [rsp + 0x28], rax
movsxd r9, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, [0x1400ed4d4]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a1ec0
Capabilities:
Check for time delay via gettickcount
Copy file
Extract resource via kernel32 functions

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
movsx r14d, byte [rsp + 0x110]
mov r12d, ecx
mov qword [r11 - 0x38], r15
mov dword [rsp + 0x64], r9d
mov dword [rsp + 0x60], r8d
imul r12d, r14d
mov qword [rsp + 0x70], rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, r14d
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
lea r13d, [rax + 4]
cmp r14b, r12b
jge 0x1400a2060
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xd8], rsi
lea rcx, str.deodorant
mov qword [rsp + 0xd0], rdi
movsx rsi, r14b
movzx edi, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.deodorant
mov r9d, edi
mov rcx, rax
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
movzx edi, byte [rsp + 0x70]
add bl, 0x31
mov ebp, eax
movzx eax, byte [rsp + 0x78]
imul byte [rsp + 0x68]
sub dil, al
sub dil, r14b
add dil, bl
add dil, r12b
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
lea ebx, [r12 - 7]
movzx esi, ax
mov rax, qword [rsp + 0x68]
lea rdx, str.wrist
lea ecx, [rax + rax*4]
movsx rax, dil
add ecx, eax
movzx eax, r15b
sub ecx, eax
sub ecx, dword [rsp + 0x64]
sub ecx, dword [rsp + 0x60]
add ecx, dword [rsp + 0x70]
add ebx, ecx
lea rcx, str.peer_to_peer
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], eax
lea r8, str.dimple
lea rdx, str.dimple
movsx r9d, dil
mov ecx, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0xe0]
xor ecx, ecx
mov edx, 0x27b
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xf8]
cmp r15b, r14b
mov r14, qword [rsp + 0xb8]
jae 0x1400a209c
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx eax, r15b
mov r15, qword [rsp + 0xb0]
cmp r13d, eax
mov r13, qword [rsp + 0xc0]
jl 0x1400a20d2
xor ecx, ecx
mov edx, 0x3b3
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x19f
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0xe8
ret
Function at 0x1400a21b0
Capabilities:
Create thread
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, str.scorn
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.scorn
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
lea r8d, [rcx + 0x13]
mov edx, 0x267
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, str.painting
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
shl bl, 3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 1]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.latency
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x1bf
lea r8d, [rcx + 3]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ed4d4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp bl, 5
jne 0x1400a239d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov edx, 0x24e
lea r8d, [rcx + 8]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x1a9
lea r8d, [rcx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
lea rcx, [rsp + 0x170]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x30]
lea rcx, str.scorn
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, 0x19
xor ecx, ecx
lea r8d, [rdx - 0x13]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x290
pop rbx
ret
Function at 0x1400a2e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
movsx rbx, ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movsx rcx, bl
sub edi, ecx
lea rcx, str.cattle
inc edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x235
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movsx ebx, bl
cmp edi, ebx
jne 0x1400a2eba
lea rcx, str.c0ret
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor eax, eax
lea r8, str.c0ret
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
mov dword [rsp + 0x30], ebx
lea rdx, str.c0a1
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x90]
lea rcx, str.c0a1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
xor ecx, ecx
mov edx, 0x38a
lea r8d, [rcx + 0x14]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0xff
lea r8d, [rcx + 0x1d]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov edx, 0x350
lea r8d, [rcx + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor ecx, ecx
lea r8d, [rcx + 9]
mov edx, 0x332
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400a3970
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebx, r9d
mov edi, edx
cmp edx, r9d
jne 0x1400a39e0
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x20]
lea rcx, str.hovercraft
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, str.underground
lea rcx, str.underground
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp ebx, edi
jge 0x1400a3a13
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x75
lea r8d, [rdx - 0x74]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rax, str.lasagna
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret

Function at 0x1400a3a40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x158
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, eax
lea r8, [0x140001b00]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9d, [rax + 1]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rax, str.c2a2
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x158
ret
Function at 0x1400a4560
Capabilities:
Copy file
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea edi, [rcx + 4]
mov r13, rcx
mov rbx, r9
add edi, r9d
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rsi, rax
mov qword [rsp + 0x68], rax
test edi, edi
jne 0x1400a4604
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
mov edx, 0xe1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x190]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [rsi + rsi*4]
mov edi, ebx
mov r14d, ebx
sub edi, eax
imul r14d, r13d
lea eax, [rdi*4]
add eax, r13d
add edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r15, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
movzx ebx, r14b
sub bl, dil
mov r12, rax
sub bl, 6
add bl, r13b
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [r14 + r14*4]
mov r8d, r13d
lea edx, [r12 + r15]
sub r8d, ecx
movsx ecx, bl
mov rbp, rax
mov eax, dword [rsp + 0x60]
xor r9d, r9d
imul edx, ecx
imul edx, r15d
lea esi, [rdx + r8*4]
lea r8, str.midi
lea rdx, str.cyclone
sub esi, dword [rsp + 0x70]
sub esi, edi
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], 4
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
sub esi, 5
mov dword [rsp + 0x20], r14d
mov ecx, esi
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rdx, str.midi
lea rcx, [0x1400ed3f4]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movzx eax, r12b
lea r8d, [rdi + 7]
imul r12b
movzx ecx, al
movzx eax, r15b
mov edx, 0x31d
imul cl
movzx ebx, al
movzx eax, bpl
xor ecx, ecx
imul sil
sub bl, al
add bl, r13b
inc r13b
add bl, r13b
add bl, byte [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
movzx r9d, bl
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, r12
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a4770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
xor ecx, ecx
movzx esi, r8b
mov rdi, rdx
lea r8d, [rcx + 0xb]
mov edx, 0x126
call qword [sym.imp.KERNEL32.dll_FindResourceA]
or rbx, 0xffffffffffffffff
mov r14, rax
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400a47c1
xor ecx, ecx
add bl, bpl
mov edx, 0x360
lea r8d, [rcx + 7]
add bl, sil
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp bl, 0x20
jb 0x1400a47f7
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x150
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400dd340
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400a5280
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push rbx
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
movsxd rbx, ecx
lea rcx, [rsp + 0x180]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, ebx
mov dword [rsp + 0x30], ebx
imul ecx, eax
mov dword [rsp + 0x34], ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rax, qword [rsp + 0x30]
shr rax, 0x20
cmp eax, 6
jae 0x1400a5375
mov qword [rsp + 0x2b8], rdi
xor edi, edi
lea r8, [0x140001b00]
movsxd r9, eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdi, qword [rsp + 0x2b8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rax, str.hell
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x2a0
pop rbx
ret
Function at 0x1400a53d0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
movzx esi, byte [rcx]
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, qword [rbx]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1400a5407
movzx edi, byte [rdi + 8]
xor ecx, ecx
mov edx, 0x763
lea r9d, [rcx + 4]
mov r8d, 0x3000
sub dil, al
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebp, ebp
movsx rbx, dil
lea r8, [0x140001b00]
xor edx, edx
xor ecx, ecx
mov r9, rbx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
test sil, sil
jne 0x1400a54aa
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
movzx edx, sil
movzx eax, sil
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edx
movsx ecx, dil
lea rdx, str.piracy
lea r8, str.patio
mov r9d, ecx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x1cf
lea r8d, [rcx + 0x12]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.USER32.dll_GetActiveWindow]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0x14d
lea r8d, [rcx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
test dil, dil
jns 0x1400a556b
xor ecx, ecx
mov edx, 0x389
lea r8d, [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea r8, [0x140001b00]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dd340
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret